# Data directory accessible from the internet

**URL:** <https://help.nextcloud.com/t/data-directory-accessible-from-the-internet/14507>\
**Category:** ℹ️ Support\
**Created:** [June 24, 2017, 6:17am UTC](https://help.nextcloud.com/t/data-directory-accessible-from-the-internet/14507 "2017-06-24T06:17:38Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![enquirer](https://help.nextcloud.com/letter_avatar/enquirer/32/5_5575768a8748004e209b776fc1b2916d.png) [@enquirer](https://help.nextcloud.com/u/enquirer)\
**Post date:** [June 24, 2017, 6:17am UTC](https://help.nextcloud.com/t/data-directory-accessible-from-the-internet/14507/1 "2017-06-24T06:17:38Z")

</div>

Seems lots of chatter about this on github etc but no real solution?

Admin page has warning: “Your data directory and your files are probably accessible from the internet. The .htaccess file that ownCloud provides is not working. We strongly suggest that you configure your webserver in a way that the data directory is no longer accessible or you move the data directory outside the webserver document root…” Any update on this?

---

<div class="post-metadata">

**Author:** ![JasonBayton](https://help.nextcloud.com/user_avatar/help.nextcloud.com/jasonbayton/32/297_2.png) [@JasonBayton](https://help.nextcloud.com/u/JasonBayton)\
**Post date:** [June 24, 2017, 7:35am UTC](https://help.nextcloud.com/t/data-directory-accessible-from-the-internet/14507/2 "2017-06-24T07:35:26Z")

</div>

Normally means your htaccess can’t override the default Apache config.

---

<div class="post-metadata">

**Author:** ![enquirer](https://help.nextcloud.com/letter_avatar/enquirer/32/5_5575768a8748004e209b776fc1b2916d.png) [@enquirer](https://help.nextcloud.com/u/enquirer)\
**Post date:** [June 24, 2017, 9:32am UTC](https://help.nextcloud.com/t/data-directory-accessible-from-the-internet/14507/3 "2017-06-24T09:32:39Z")

</div>

thanks - and the solution to this or just leave the annoyance? I am using NextCloud on a dedicated VPS.

---

<div class="post-metadata">

**Author:** ![JasonBayton](https://help.nextcloud.com/user_avatar/help.nextcloud.com/jasonbayton/32/297_2.png) [@JasonBayton](https://help.nextcloud.com/u/JasonBayton)\
**Post date:** [June 24, 2017, 9:58am UTC](https://help.nextcloud.com/t/data-directory-accessible-from-the-internet/14507/4 "2017-06-24T09:58:21Z")

</div>

Edit `/etc/apache2/apache2.conf`

Scroll to the directory area and change

```auto
<Directory /var/www/>
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
</Directory>

```

To

```auto
<Directory /var/www/>
        Options Indexes FollowSymLinks
        AllowOverride All
        Require all granted
</Directory>

```

---

<div class="post-metadata">

**Author:** ![enquirer](https://help.nextcloud.com/letter_avatar/enquirer/32/5_5575768a8748004e209b776fc1b2916d.png) [@enquirer](https://help.nextcloud.com/u/enquirer)\
**Post date:** [June 26, 2017, 5:27am UTC](https://help.nextcloud.com/t/data-directory-accessible-from-the-internet/14507/5 "2017-06-26T05:27:30Z")

</div>

Thanks. That seemed to work and then it’s back again.

---

<div class="post-metadata">

**Author:** ![Nemskiller](https://help.nextcloud.com/user_avatar/help.nextcloud.com/nemskiller/32/875_2.png) [@Nemskiller](https://help.nextcloud.com/u/Nemskiller)\
**Post date:** [June 26, 2017, 6:10am UTC](https://help.nextcloud.com/t/data-directory-accessible-from-the-internet/14507/6 "2017-06-26T06:10:29Z")

</div>

It can be a bad chmod on files.

You should read the installation manual on the nextcloud site. There is a step where they give you the good permission to put on folders.

You should look the installation process from the beginning in order to see if you didn’t miss an important thing.

You can also look if in your nextcloud folder you have this two files : .htaccess and .user.ini , if not you have to pick them from your downloaded nextcloud.zip they are in the root folder

---

<div class="post-metadata">

**Author:** ![zaxxon](https://help.nextcloud.com/letter_avatar/zaxxon/32/5_5575768a8748004e209b776fc1b2916d.png) [@zaxxon](https://help.nextcloud.com/u/zaxxon)\
**Post date:** [August 27, 2019, 2:41am UTC](https://help.nextcloud.com/t/data-directory-accessible-from-the-internet/14507/7 "2019-08-27T02:41:36Z")

</div>

Thank you I recently had changed this back when trying to reconfigure my nextcloud hostname and just ran across the security warning in the nextcloud console. Your post just saved me a lot of time.

---

<div class="post-metadata">

**Author:** ![Fabricio\_Lucas](https://help.nextcloud.com/user_avatar/help.nextcloud.com/fabricio_lucas/32/17803_2.png) [@Fabricio\_Lucas](https://help.nextcloud.com/u/Fabricio_Lucas)\
**Post date:** [September 23, 2019, 10:27pm UTC](https://help.nextcloud.com/t/data-directory-accessible-from-the-internet/14507/8 "2019-09-23T22:27:50Z")

</div>

Hello, I was reading this information but I would like to know where can a make this change on an iocage (Freenas). I am using nginx.

Thank you

---

<div class="post-metadata">

**Author:** ![KarlF12](https://help.nextcloud.com/user_avatar/help.nextcloud.com/karlf12/32/46873_2.png) [@KarlF12](https://help.nextcloud.com/u/KarlF12)\
**Post date:** [September 24, 2019, 3:20am UTC](https://help.nextcloud.com/t/data-directory-accessible-from-the-internet/14507/9 "2019-09-24T03:20:08Z")

</div>

> [@enquirer](#):
>
> thanks - and the solution to this or just leave the annoyance?

This isn’t an annoyance. This is the internet downloading your stuff.

Don’t disregard this warning. I would resolve it before uploading personal data to the system.

---

<div class="post-metadata">

**Author:** ![ddinno](https://help.nextcloud.com/user_avatar/help.nextcloud.com/ddinno/32/20015_2.png) [@ddinno](https://help.nextcloud.com/u/ddinno)\
**Post date:** [December 28, 2019, 8:49pm UTC](https://help.nextcloud.com/t/data-directory-accessible-from-the-internet/14507/10 "2019-12-28T20:49:58Z")

</div>

i’ve changed http.conf but nothing change. any ideas?

---

<div class="post-metadata">

**Author:** ![Nemskiller](https://help.nextcloud.com/user_avatar/help.nextcloud.com/nemskiller/32/875_2.png) [@Nemskiller](https://help.nextcloud.com/u/Nemskiller)\
**Post date:** [December 29, 2019, 1:58am UTC](https://help.nextcloud.com/t/data-directory-accessible-from-the-internet/14507/11 "2019-12-29T01:58:24Z")

</div>

You have to change it into the nextcloud conf file in (by default ) /var/www/nextcloud/config/config.php  
You will have a line with this ’/var/www/nextcloud/data’  
You have to modify to a data folder that is outside /var/www/

---

<div class="post-metadata">

**Author:** ![ddinno](https://help.nextcloud.com/user_avatar/help.nextcloud.com/ddinno/32/20015_2.png) [@ddinno](https://help.nextcloud.com/u/ddinno)\
**Post date:** [December 29, 2019, 7:42am UTC](https://help.nextcloud.com/t/data-directory-accessible-from-the-internet/14507/12 "2019-12-29T07:42:20Z")

</div>

thank you in advance. sorry @Nemskiller i was very tired and i went off topic. my problem is that i get this message "Forbidden

You don’t have permission to access /nextcloud/index.php on this server. "After updating nc 17 on VPS  
this is error log:  
[Sun Dec 29 03:03:32.751037 2019] [core:crit] [pid 2655] (13)Permission denied: [client 93.66.198.128:57128] AH00529: /var/www/.htaccess pcfg\_openfile: unable to check htaccess file, ensure it is readable and that ‘/var/www/’ is executable, referer: [http://64.137.164.100/nextcloud/](http://64.137.164.100/nextcloud/)

i’ve tried to change /var/www permission with `sudo find /var/www -type f -exec chmod 664 {} \;` but nothing change

i’ve also disabled selinux and change httpd.conf (in file section set to Allow from all )

---

<div class="post-metadata">

**Author:** ![mhrsolanki2020](https://help.nextcloud.com/user_avatar/help.nextcloud.com/mhrsolanki2020/32/12742_2.png) [@mhrsolanki2020](https://help.nextcloud.com/u/mhrsolanki2020)\
**Post date:** [December 29, 2019, 10:22am UTC](https://help.nextcloud.com/t/data-directory-accessible-from-the-internet/14507/13 "2019-12-29T10:22:38Z")

</div>

hi @ddinno  
Can you try that same command for directories as well? But with chmod 750 {} ;  
Also rather than doing that for all websites in your www directory, do it only for nextcloud folder.

So try the following commands

`sudo find /var/www/nextcloud/ -type d -exec chmod 750 {} \;`  
`sudo find /var/www/nextcloud/ -type f -exec chmod 664 {} \;`

In my wordpress instance, I generally go for 644 for files. But 664 works aswell.

Also confirm that the folders are owned by www-data group, else do a chown for the same.

If your data folder is outside of /var/www, then do chown for data folder as well.

---

<div class="post-metadata">

**Author:** ![ddinno](https://help.nextcloud.com/user_avatar/help.nextcloud.com/ddinno/32/20015_2.png) [@ddinno](https://help.nextcloud.com/u/ddinno)\
**Post date:** [December 29, 2019, 5:52pm UTC](https://help.nextcloud.com/t/data-directory-accessible-from-the-internet/14507/14 "2019-12-29T17:52:03Z")

</div>

hi @mhrsolanki2020

i’ve tried on my /var/www/html/nexctcloud but same problem  
same error on log:  
[Sun Dec 29 12:49:36.752303 2019] [core:crit] [pid 1276] (13)Permission denied: [client 93.66.198.128:59590] AH00529: /var/www/html/.htaccess pcfg\_openfile: unable to check htaccess file, ensure it is readable and that ‘/var/www/html/’ is executable, referer: [http://64.137.164.100/nextcloud/](http://64.137.164.100/nextcloud/)

---

<div class="post-metadata">

**Author:** ![ddinno](https://help.nextcloud.com/user_avatar/help.nextcloud.com/ddinno/32/20015_2.png) [@ddinno](https://help.nextcloud.com/u/ddinno)\
**Post date:** [December 30, 2019, 7:30am UTC](https://help.nextcloud.com/t/data-directory-accessible-from-the-internet/14507/15 "2019-12-30T07:30:13Z")

</div>

i fix-it with  
chown apache:apache /var/www/html

---

<div class="post-metadata">

**Author:** ![zeroinf](https://help.nextcloud.com/letter_avatar/zeroinf/32/5_5575768a8748004e209b776fc1b2916d.png) [@zeroinf](https://help.nextcloud.com/u/zeroinf)\
**Post date:** [January 25, 2020, 7:11pm UTC](https://help.nextcloud.com/t/data-directory-accessible-from-the-internet/14507/16 "2020-01-25T19:11:26Z")

</div>

I have the same problem , but webserver is Nginx , wath .htaccess must edit ?  
/www/wwwroot/domain.cloud/data  
or  
/www/wwwroot/domain.cloud/

---

<div class="post-metadata">

**Author:** ![Nemskiller](https://help.nextcloud.com/user_avatar/help.nextcloud.com/nemskiller/32/875_2.png) [@Nemskiller](https://help.nextcloud.com/u/Nemskiller)\
**Post date:** [January 25, 2020, 7:49pm UTC](https://help.nextcloud.com/t/data-directory-accessible-from-the-internet/14507/17 "2020-01-25T19:49:40Z")

</div>

Nginx don’t use .htaccess.  
you have to specify it in your conf file.  
Look at this How to :

> **[Nextcloud 18 installation guide (Ubuntu 20.04/18.04) – Carsten Rieger...](https://english.c-rieger.de/nextcloud-installation-guide-ubuntu-20-04/)**

---

<div class="post-metadata">

**Author:** ![zeroinf](https://help.nextcloud.com/letter_avatar/zeroinf/32/5_5575768a8748004e209b776fc1b2916d.png) [@zeroinf](https://help.nextcloud.com/u/zeroinf)\
**Post date:** [January 25, 2020, 8:13pm UTC](https://help.nextcloud.com/t/data-directory-accessible-from-the-internet/14507/18 "2020-01-25T20:13:03Z")

</div>

I can do this , because i really have installed aaPanel on my vps ( CentOS 8 ) and everything is different for me . I leave al thins as is it .

---

<div class="post-metadata">

**Author:** ![Heroicman](https://help.nextcloud.com/letter_avatar/heroicman/32/5_5575768a8748004e209b776fc1b2916d.png) [@Heroicman](https://help.nextcloud.com/u/Heroicman)\
**Post date:** [September 23, 2023, 1:17pm UTC](https://help.nextcloud.com/t/data-directory-accessible-from-the-internet/14507/19 "2023-09-23T13:17:10Z")

</div>

Finally!!! I knew it would be a simple fix. However, I just didn’t know where the problem was originating from. Thank you, Jason.

---

<div class="post-metadata">

**Author:** ![Ethan.B](https://help.nextcloud.com/letter_avatar/ethan.b/32/5_5575768a8748004e209b776fc1b2916d.png) [@Ethan.B](https://help.nextcloud.com/u/Ethan.B)\
**Post date:** [May 13, 2024, 1:33pm UTC](https://help.nextcloud.com/t/data-directory-accessible-from-the-internet/14507/20 "2024-05-13T13:33:15Z")

</div>

That fixed it for me. Thanks man.

[Next page](https://help.nextcloud.com/t/data-directory-accessible-from-the-internet/14507.md?page=2)