A website is a folder of files on a server, and everything a visitor can reach lives inside one specific directory. Understanding which folder that is, and what sits outside it, explains why some files are public and others are not, where uploads go, and why a file you placed somewhere reasonable produces a page not found.
The one folder that matters
Every hosting account has a directory that is exposed to the web. Depending on the setup it is called public_html, www, htdocs, or public. Everything inside it can be requested by anyone. Everything outside it cannot.
That boundary is the single most useful thing to understand. Your home directory sits above it and typically contains other things: logs, mail, backups, and configuration. None of that is reachable by a browser, which is exactly as intended.
It is also why the blog queue arrangement works. A folder above the web root holds files that exist on the server and are not reachable by anyone until they are moved inside.
How addresses map to files
Directly, in most cases, which is simpler than people expect.
| Address | File on the server |
|---|---|
| yoursite.com/ | public_html/index.html |
| yoursite.com/about.html | public_html/about.html |
| yoursite.com/blog/ | public_html/blog/index.html |
| yoursite.com/images/van.jpg | public_html/images/van.jpg |
Two things follow. A folder with no index file will either show a list of its contents or an error, depending on configuration, and neither is what you want. And moving a file changes its address, which is why reorganising folders on a live site breaks links and search listings.
The files you will see and should not delete
- index.html or index.php. The default page for its folder. Removing it makes the folder behave unpredictably.
- .htaccess. A configuration file controlling redirects, security rules, and error pages. It begins with a dot, so file managers frequently hide it. A single wrong character here produces a site-wide error, which is why it is worth copying before editing.
- robots.txt. Instructions for crawlers. Lives at the top of the web root and nowhere else.
- sitemap.xml. The list of pages you want found.
- Anything in a cgi-bin folder, which is usually empty and part of the standard layout.
Where uploads and content actually go
On a hand-built site, wherever you put them, which is the advantage of the approach: the folder structure is the site structure and there is nothing to guess.
On a content management system, files are distributed across the platform's own folders and the content itself lives in a database rather than as files at all. That is why copying the folder does not copy the site, and it is the most common reason a do-it-yourself backup turns out to be incomplete.
Knowing which of the two you have determines what a backup needs to include, and it is worth establishing before you need one.
Permissions, briefly
Every file carries settings determining who can read, write, or run it. You will encounter them mainly when something breaks.
The conventional values are 644 for files and 755 for folders, and the number to avoid is 777, which allows anyone to write to it. Hosting support occasionally suggests it as a quick fix for an upload problem, and it is a security exposure rather than a solution.
Wrong permissions after a migration or a manual restore are a common cause of a site returning errors when the files themselves are perfectly fine.
Getting in
Three routes, each suited to different work.
The file manager in your hosting control panel needs nothing installed and works from any machine, which makes it the right tool for a quick look or a single edit. FTP or SFTP suits moving many files at once. SSH is command line access, faster for anyone comfortable with it and unnecessary for most site owners.
For most people the file manager covers everything they will ever need to do.
Rules worth keeping
- Copy before you edit. Duplicate the file first, particularly anything with a dot at the start of its name.
- Do not reorganise a live site's folders. Addresses change, links break, and search listings point at nothing.
- Keep nothing sensitive in the web root. Old backups, database exports, and spreadsheets placed there for convenience are publicly downloadable by anyone who guesses the name.
- Remove leftovers. Old versions, test folders, and copies of the site from a previous build accumulate, take space, and occasionally get indexed.
Ten minutes looking at your own file manager tells you more about how your site works than any amount of reading, and it is the knowledge that turns most hosting problems from mysterious into obvious. What the folders sit inside is covered in web hosting explained from scratch.
Frequently asked questions
Where do my website files live on the server?
Inside a single directory exposed to the web, usually called public_html, www, or htdocs. Anything inside it can be requested by a browser and anything outside it cannot.
Why does my folder show a list of files instead of a page?
Because it has no index file. Each folder needs an index.html or index.php as its default page, or the server will either list the contents or return an error.
What is the .htaccess file?
A configuration file controlling redirects, security rules, and error pages. It starts with a dot so file managers often hide it, and a single wrong character produces a site-wide error.
What file permissions should I use?
644 for files and 755 for folders is the conventional setting. Avoid 777, which allows anyone to write to the file and is a security exposure rather than a fix for an upload problem.
Can I copy the folder to back up my site?
On a hand-built site, yes. On a content management system the content lives in a database rather than in files, so copying the folder produces an incomplete backup.
Is it safe to store files in my web root?
Only files meant to be public. Old backups, database exports, and spreadsheets placed there for convenience can be downloaded by anyone who guesses the filename.
West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.
Not sure how your site is laid out on the server?
We map your hosting properly, remove the leftovers taking up space, and make sure nothing sensitive is sitting where the public can reach it.
Start a Conversation