I am having a hard time finding out exact differences between making the file system public or private and picking the right location.

What a pros / cons of making file system public / private?

Say my website documents are located at /hsphere/user/mysite.net would I be better off having the file location at /mysite.net/sites/mysite.net/files (http accessable) or at /hsphere/user/files/mysite.net (not http accessable)?

My primary concern is to prevent, where possible, any leeching of content or unauthorized access.

Does the file size limitation (2 MB) for PHP not matter for either method / location? Note, I can not increase the limit (do not have access and my hosting company will not make the change).

Comments

zarko’s picture

zarko commented
Status: Active » Closed (fixed)

The main difference between public vs. private is that if the files are private Drupal will actually be involved with the rendering of the files. If you use public then the urls are all generated to go directly to the directory on the webserver and there is no Drupal authentication/authorization. You can of course add your own separate mechanism via you webserver in this case to project your assets.

When you enable private Drupal will modify (or create) the .htaccess file in the files directory and stop direct access via the web server. This means that you do not have to move your directory to somewhere that it is inaccessible ... but you could anyway for extra security.

The file size limitation is unrelated to the private/public mode.