The webroot is the designated directory on a web server where all publicly accessible website files-HTML, images, scripts, and stylesheets-are stored and served to users visiting the site. It acts as the base path for a domain's content, meaning the URL https://example.com/index.html maps directly to the file located at the webroot's index.html file.
Every website hosted online relies on a webroot. Without it, the server wouldn't know where to find the files needed to display a site. This directory is often called the "document root" in technical documentation and configuration files.
For example, if a site uses Apache on Linux, the default webroot is typically /var/www/html. On Windows servers using IIS, it's usually C:\inetpub\wwwroot. These paths are set during server configuration and determine where the web server begins searching for files when a request arrives.
When someone types a URL into a browser, the request goes to the web server. The server checks the domain name and maps it to a specific webroot directory. It then looks for the requested file-like index.html or about.php-within that directory. If found, the server sends the file back to the browser, which renders it as a webpage.
If the file doesn't exist, the server returns a 404 error. If the server lacks permission to read the file, it returns a 403 error. Both outcomes stem from misconfigurations involving the webroot or its contents.
Webroots are not limited to static files. Changing sites built with PHP, Python, or Node.js rely on the webroot to serve application logic. For instance, a Laravel PHP app stores its main entry point in public/index.php, making public/ the webroot. The structure routes requests through this file, even though the core application code lives outside the webroot.
Different hosting environments use different default webroot paths. The choice depends on the operating system, web server software, and hosting provider setup.
| Hosting Type | Typical Webroot Path | Server Software |
|---|---|---|
| Shared Hosting (cPanel) | /home/username/public_html |
Apache |
| Linux VPS (Apache/Nginx) | /var/www/example.com |
Apache or Nginx |
| Windows Server (IIS) | C:\inetpub\wwwroot |
IIS |
| Cloud Platforms (AWS, Google Cloud) | Custom-defined via configuration | Apache, Nginx, or reverse proxy |
Some developers create subdirectories within the webroot to organize content. For example, /public_html/blog might host a blog section, while /public_html/api serves an API endpoint. These are still part of the webroot, meaning they're accessible via URLs like https://site.com/blog.
A common mistake is placing sensitive files-like database credentials or configuration keys-inside the webroot. If such files are accidentally exposed, attackers can read them directly through a browser. Best practice is to store config files outside the webroot, so they cannot be accessed via HTTP.
The webroot is not the same as the site's root domain. While example.com points to the webroot, the webroot itself is a physical or logical folder on a server. Confusing the two leads to errors in deployment and security.
It's also not synonymous with the "root directory" in filesystem terms. The root directory of a Unix system is /, but the webroot is a subdirectory under it-like /var/www. The term "root" in "webroot" refers to the starting point of the website, not the OS root.
Another frequent mix-up: thinking the webroot is where all site files live. In reality, many files-such as logs, backups, or private scripts-should remain outside the webroot. Placing them there increases the risk of accidental exposure. For example, a backup file named db_backup.sql placed in the webroot could be downloaded by anyone who visits https://site.com/db_backup.sql.
Suppose you're launching a personal portfolio site. You create a folder named portfolio on your local machine and place index.html, style.css, and profile.jpg inside it. You then upload the entire portfolio folder to your hosting provider's public_html directory.
After uploading, you visit https://yourname.com. The server checks the domain, finds the public_html directory as the webroot, locates index.html, and sends it to your browser. The page loads correctly because the file is in the correct location.
If you had uploaded the files to public_html/portfolio instead, the site would appear at https://yourname.com/portfolio. That's still valid-but the webroot remains public_html. The site's actual root is public_html, not public_html/portfolio.
This distinction matters when setting up redirects, SSL certificates, or managing multiple domains on one server. Each domain may have its own webroot, but they all share the same underlying server structure.
Security experts recommend keeping sensitive files outside the webroot. According to the OWASP Application Security Verification Standard (ASVS), applications should store configuration files, encryption keys, and session data in directories not accessible via HTTP.
For example, a PHP application might use /var/www/app/config.php for settings, but only reference it from within the application code-not serve it directly. If this file were moved to /var/www/html/config.php, it would be readable by anyone who navigates to https://site.com/config.php.
Many hosting providers allow you to define a custom webroot in configuration files. In Apache, this is done using the DocumentRoot directive in the virtual host configuration. Misconfiguring this can cause the server to serve incorrect files or fail to load the site entirely.
During development, tools like php artisan serve in Laravel start a local web server with the project's public/ directory as the webroot. This mimics production behavior and helps only files in public/ are accessible through the browser.
While deploying a client's site, I once uploaded a config.json file directly into the webroot. The file contained API keys and database passwords. After the site went live, a security scan flagged it as exposed. I had to remove the file and move it outside the webroot, then update the application code to reference it safely.
Even though the file was small and seemingly harmless, its presence in the webroot created a vulnerability. This taught me that the webroot isn't just a technical boundary-it's a security frontier.
Understanding what the webroot is-and what it isn't-is essential for building secure, functional websites. site owner, knowing how the webroot functions prevents common deployment issues and strengthens site integrity.
The webroot is the foundation of how websites are delivered. It's not just a folder-it's the gateway between your content and the internet.