WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to move wordpress out of the public html directory?

The PHP files responsible for generating html output should be hosted but the php files responsible for database connections and other logic should not be hosted. They can be included by the hosted files in the following way: ../../NotPublic/wp-admin/...

Symfony does this and actually has only one hosted php. For more explanation as to why this would be a good idea you can check out this video.

I've tried to find instructions on how to do this but cannot find it. Worpress seems to have trouble making a distinction of php files generating output that need to be in the public directory and those that do stuff and should not be able to be requested through the web server (only as includes).

Currently I can use .htaccess to not list the directories or host any of the wp-content directories except wp-content/uploads

share|improve this question

WordPress is very clearly engineered for being placed into web-accessible folder.

While attempt to move it from web folder could be made, it would be very challenging, especially for admin area which uses direct non-routed URLs to PHP files.

share|improve this answer

It is possible. I always move my default wordpress installation to a folder. this is totally different with installing wordpress in a folder. moving default wordpress installation make your site more secure. what you have to do is here:

  1. go to cpanel > login > file manager > in /public_html or root, create a folder, eg.: "site". it assumes, you now have folder /public_html/site
  2. login to your wordpress dashboard > settings > general
  3. change "WordPress Address (URL)" to: http://your-domain-or-whatever.com/site
  4. click "save changes" button. page will displayed error? no problem.
  5. in cpanel file manager, move your wordpress files, to /public_html/site *) what you don't need to move is only : .htaccess, robots.txt, php.ini, and "index.php". remember, do not move "index.php".
  6. open and edit "index.php" with code editor. in the last line, you see this code

    require( dirname( __FILE__ ) . '/wp-blog-header.php' );

change it to :

 @require( dirname( __FILE__ ) . '/site/wp-blog-header.php' );

remember: "site" can be changed to any folder name you defined in step number 1.

share|improve this answer
Thank you for your answer. Would that work if you place the wp files out of the public directory (public_html), now it's just a sub directory but still hosted by httpd. The .htaccess can shield some of it but when an admin does something wrong or someone hacks the main config then you won't have the added security that only your templates are hosted and your application is included with ../../notInPublic/myApp/something.php as with Symfony. It seems that WP doesn't make a distinction between application code and template code (html generating code). – HMR Dec 19 '13 at 0:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.