Webroot and assets
In TYPO3 files that are displayed in the web browser, must - for security reasons - be placed in certain directories.
In a standard Composer-based installation, which this tutorial assumes you have, the webroot
of the server points to directory public. Read more about this folder:
TYPO3 Explained, folder "public/". Files
placed outside of this folder cannot be called directly by the web browser.
There are 3 types of files that must be accessed directly by the browser:
- Media and downloads: Images, videos and audio files used within the content and managed by editors. Downloads like PDF files, Excel sheets etc.
- Assets: Including CSS, JavaScript, fonts, images and icons used for design purposes.
- Technical files managed by Composer and TYPO3, including the
index.as Entry point, automatically generated assets and scaled versions of images.php
Media and downloads
Media and downloads must be stored in fileadmin. In standard
Composer-based installations, as we assume you have here, they are stored in
public/.
Read more about this folder: TYPO3 Explained, folder "public/fileadmin/".
Files in the fileadmin directory are managed by the File abstraction layer (FAL).
They can be uploaded, moved and deleted in the backend module File > Filelist by administrators and depending on permissions, by editors.
Warning
For security reasons, do not store any templates, scripts or assets in this directory. Store them in a site package Assets in extensions and site packages.
Assets in extensions and site packages
Assets usually include CSS files, JavaScript and images / icons used for design purposes.
Within an extension, including a site package, they can only be placed in folder
Resources/ and subfolders of this folder.
During Composer installation the Resources/ directories of all
installed extensions are symlinked into the webroot, folder public/_.
For security reasons the folders in public/_ have hashed names.
Note
You must never reference any file in public/_ directly by
using the hash in an absolute or relative URL. The hashes can change at any
time. Only use TYPO3 library methods to reference the assets.
Read more about this folder: TYPO3 Explained, folder "public/_assets/".