Is there a way to move wordpress out of the public html directory?

The PHP files responsible for generating html output should be hosted but the php files responsible for database connections and other logic should not be hosted. They can be included by the hosted files in the following way: ../../NotPublic/wp-admin/...

Symfony does this and actually has only one hosted php. For more explanation as to why this would be a good idea you can check out this video.

I've tried to find instructions on how to do this but cannot find it. Worpress seems to have trouble making a distinction of php files generating output that need to be in the public directory and those that do stuff and should not be able to be requested through the web server (only as includes).

Currently I can use .htaccess to not list the directories or host any of the wp-content directories except wp-content/uploads


WordPress is very clearly engineered for being placed into web-accessible folder.

While attempt to move it from web folder could be made, it would be very challenging, especially for admin area which uses direct non-routed URLs to PHP files.


It is possible. I always move my default wordpress installation to a folder. this is totally different with installing wordpress in a folder. moving default wordpress installation make your site more secure. what you have to do is here:

  1. go to cpanel > login > file manager > in /public_html or root, create a folder, eg.: "site". it assumes, you now have folder /public_html/site
  2. login to your wordpress dashboard > settings > general
  3. change "WordPress Address (URL)" to: http://your-domain-or-whatever.com/site
  4. click "save changes" button. page will displayed error? no problem.
  5. in cpanel file manager, move your wordpress files, to /public_html/site *) what you don't need to move is only : .htaccess, robots.txt, php.ini, and "index.php". remember, do not move "index.php".
  6. open and edit "index.php" with code editor. in the last line, you see this code

    require( dirname( __FILE__ ) . '/wp-blog-header.php' );

change it to :

 @require( dirname( __FILE__ ) . '/site/wp-blog-header.php' );

remember: "site" can be changed to any folder name you defined in step number 1.

  • 1
    Thank you for your answer. Would that work if you place the wp files out of the public directory (public_html), now it's just a sub directory but still hosted by httpd. The .htaccess can shield some of it but when an admin does something wrong or someone hacks the main config then you won't have the added security that only your templates are hosted and your application is included with ../../notInPublic/myApp/something.php as with Symfony. It seems that WP doesn't make a distinction between application code and template code (html generating code).
    – HMR
    Dec 19 '13 at 0:56
  • 2
    How is this more secure? Your installation is still inside a public folder. Apr 20 '18 at 11:54
  • I wonder as well @Denis but I guess anything that makes attackers having to think slightly more than the generic wordpress install would make a slight difference. not quite sure what that one would be, but I've seen recommendation that changing the default wp_ table prefix can send people wondering a bit. Aug 11 '20 at 17:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.