linux - How secure is storing sensitive information in a .PHP file on an Apache server? -

linux - How secure is storing sensitive information in a .PHP file on an Apache server? -

i making easy-to-setup, no-database php website stores info instead in text files.

the setup linux/apache/php server.

up info has been non-sensitive, store in: ../data/system.txt theoretically type (url)/data/system.txt in browser , see info file in plain text, didn't matter now.

but want store passwords various groups can log in , see different information. these sites "low interest" , "low profile" sites , if bored plenty hack site , sees information, it's not end of world, want provide modicum of technical hurdles site can have individual , grouping access rights while retaining ease of creating e.g. 50 of these sites without having set , maintain 50 databases.

my question is, best way protect these text files on apache?

i can think of following:

1) alter "../data" directory random directory name, e.g. "../data928374928374" kind of obfuscating measure

2) alter .txt file .php , protect text php code this:

<?php echo 'access denied'; die; /* ...store info here... */ ?>

3) set .htaccess file in /data directory protect files .txt , other endings:

<filesmatch "\.(sqlite|xml|txt|csv|php)$"> deny </filesmatch>

here thoughts on these:

1) imagine there ways find out names of hidden directories on servers this, true?

2) awkward have text file named .php , have php code in them since want non-tech people able edit text files , drop them as-is in info directory , have them work, without having "edify them technical code". not mention messes syntax-coloring in editors.

3) will .htaccess file work on servers> e.g. if re-create website apache server, guaranteed files protected, or there other settings can turn off effect of .htaccess files on apache servers?

this require bruteforce check yeah. true, complicates things non-tech people. plus i'd imagine might not want. .htaccess rules work apache server directory allowed utilize htaccess rules (and allows overriding of parameters, if required). note on configuration file might not called .htaccess else.

you utilize sqlite or similar not require database server.

another thought have construction like

/app /public_html /data

and have public_html contain website exposed outside world , /data not accessible (only scripts).

in /app folder can create htaccess rule redirect requiests punlic_html folder not visible outside user (it's possible behind scenes). , if both folders copies on including .htaccess file, should plenty one-step deployment

php linux security apache