---
title: "Webroot and assets"
manual: "Getting Started"
version: "13.4"
permalink: "https://docs.typo3.org/permalink/t3start:webroot@13.4"
source: "Concepts/Assets/Index.rst"
modified: "2026-09-15T08:44:38+00:00"
---

# Webroot and assets

In TYPO3 files that are displayed in the web browser, must - for
security reasons - be placed in certain directories.

In a standard Composer-based installation, which this tutorial assumes you have, the webroot
of the server points to directory `public`. Read more about this folder:
[TYPO3 Explained, folder "public/"](https://docs.typo3.org/m/typo3/reference-coreapi/13.4/en-us/Administration/DirectoryStructure/Index.html#directory-public). Files
placed outside of this folder cannot be called directly by the web browser.

There are 3 types of files that must be accessed directly by the browser:

-   [Media and downloads](https://docs.typo3.org/permalink/t3start:media@13.4): Images, videos and audio files used within the content and
    managed by editors. Downloads like PDF files, Excel sheets etc.
-   [Assets](https://docs.typo3.org/permalink/t3start:assets@13.4): Including CSS, JavaScript, fonts, images and icons used for design purposes.
-   Technical files managed by Composer and TYPO3, including the `index.php` as
    Entry point, automatically generated assets and scaled versions of images.

## Media and downloads

Media and downloads **must** be stored in fileadmin. In standard
Composer-based installations, as we assume you have here, they are stored in
`public/fileadmin/`.

Read more about this folder:
[TYPO3 Explained, folder "public/fileadmin/"](https://docs.typo3.org/m/typo3/reference-coreapi/13.4/en-us/Administration/DirectoryStructure/Index.html#directory-public-fileadmin).

Files in the fileadmin directory are managed by the
[File abstraction layer (FAL)](https://docs.typo3.org/m/typo3/reference-coreapi/13.4/en-us/ApiOverview/Fal/Index.html#fal_introduction).

They can be uploaded, moved and deleted in the backend module
**File > Filelist** by administrators and
depending on [permissions](https://docs.typo3.org/m/typo3/reference-coreapi/13.4/en-us/Administration/PermissionsManagement/Index.html#permissions-management),
by editors.

> [!WARNING]
> For security reasons, do not store any templates, scripts or assets in this
> directory. Store them in a [site package](https://docs.typo3.org/m/typo3/tutorial-sitepackage/13.4/en-us/Index.html#start)
> [Assets in extensions and site packages](https://docs.typo3.org/permalink/t3start:assets@13.4).

## Assets in extensions and site packages

Assets usually include CSS files, JavaScript and images / icons used for design
purposes.

Within an extension, including a site package, they can only be placed in the
`Resources/Public` folder and subfolders of this folder.

During Composer installation the `Resources/Public` directories of all
installed extensions are symlinked into the `public/_assets` webroot folder.
For security reasons the folders in `public/_assets` have hashed names.

> [!NOTE]
> You **must never** reference any file in `public/_assets` directly by
> using the hash in an absolute or relative URL. The hashes can change at any
> time. Only use TYPO3 library methods to reference the assets.

Read more about this folder:
[TYPO3 Explained, folder "public/\_assets/"](https://docs.typo3.org/m/typo3/reference-coreapi/13.4/en-us/Administration/DirectoryStructure/Index.html#directory-public-assets).