Where can I store logs in PHP app so that they cannot be accessed via HTTP?

Question

Sorry if this is a trivial question.

I am a kind of new to PHP and I'm creating a project from scratch. I need to store my application logs (generated using log4php) as files, and I don't want them to be public.

They are now stored in a subfolder under my PHP application folder, (/myAppFolder/logs) so they are served by Apache.

Where shall I store them, or what shall I do to keep them away from being served as content by Apache?

Answer 1

You can either have them in a directory above the root, or, if you're on shared host/ can't have the files above the root for whatever reason, you can have them in a directory that denies all HTTP access.

So you could have a folder called "secret_files" with a .htaccess file sitting inside:

.htaccess:

deny from all

Which will prevent HTTP access to files/subfolders in that folder.

Answer 2

Somewhere not under the public root!?

This is more a server config question as it depends on your server, but in apache you could use the custom log directives to set the location, so if you have

/www/myapp

Create

/www/log 

and put them there instead. You need control over the config to do this so look up your web hosts docs to find out how.