How do I run a composer-installed Drupal site from / instead of /web?

The default install with composer create-project drupal/recommended-project ./ will install Drupal in the /web directory. So when the site is uploaded to a host, the actual website root will be www.example.com/web. In most cases, the desired path to run the website is www.example.com/.

I have managed to do this, like this. And actually, I am asking if this is the definite correct way. (Clearly, I used my domain, not example.com.)

I have created a .htaccess file in the root with the following content.

RewriteEngine on
RewriteRule (.*) web/$1 [L]

I have uncommented the RewriteBase directive.

RewriteBase /web

I have added these lines in the web/sites/default/settings.php file.

if (isset($GLOBALS['request']) and
  '/web/index.php' === $GLOBALS['request']->server->get('SCRIPT_NAME')) {
  $GLOBALS['request']->server->set('SCRIPT_NAME', '/index.php');

I have also uncommented these lines in the web/sites/default/settings.php file to cover the trusted hosts issue.

$settings['trusted_host_patterns'] = [

Is this the correct way?


2 Answers 2


web is assumed to be the server document root directory. In some cases, the server document root directory is a different one, for example public_html.

You could either change the server settings to make the server use web as server document root directory, or change the commands executed, if you cannot do that.

As reported in Using Composer to Install Drupal and Manage Dependencies / To do a modified install, instead of running composer create-project drupal/recommended-project ./, you need to:

  • Run cd <directory containing the server document root directory>
  • Run composer create-project --no-install drupal/recommended-project ./
  • Change any reference to web found in the composer.json file with the server document root directory
  • Run composer install

For example, with the Linux distribution I am using (Endeavour OS), the default server documentation directory (indicated by httpd -S as Main DocumentRoot) is /srv/http. To install Drupal in that directory, I would execute the following commands.

cd /srv
composer create-project --no-install drupal/recommended-project ./

After, I would edit the composer.json file to change any occurrence of web with http. In the case the directory web is indicated with its full path, I would change that accordingly. Then, I would run composer install.

  • You are correct but there's an issue with this method. See here
    – pierostz
    Commented Mar 22, 2023 at 7:48

Is this the correct way?

No, it's not and it's a security risk.

Ideally, you would configure the web server to point the domain www.example.com to the sub-folder /var/www/my-project/web (or any other subfolder you have configured in composer.json). All web servers support this. If it's your own server configure a virtual host, hosting providers usually have a nice UI to manage these things.

Only if this is not possible use the legacy project:

composer create-project drupal/legacy-project .

It's important to use this project and not try to move the web folder yourself to root, because this project has extra protection for the vendor folder now being exposed in www.example.com/vendor.

This is the line that needs to be present in composer.json:

"require": {
    "drupal/core-vendor-hardening": "^10.0"

See https://github.com/drupal/legacy-project/blob/10.0.5/composer.json#L22

To be clear, the problem here is not renaming the subfolder, for example from /web to /public_html. It's about the original question, running Drupal without a subfolder from the web server's root.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.