---
title: "Webroot and assets"
manual: "Getting Started"
version: "main"
permalink: "https://docs.typo3.org/permalink/t3start:webroot@main"
source: "Concepts/Assets/Index.rst"
rendered: "2026-09-24T15:16:18+00:00"
---

# Webroot and assets {#webroot}

In TYPO3 files that are displayed in the web browser, must - for
security reasons - be placed in certain directories.

In a standard Composer-based installation, which this tutorial assumes you have, the webroot
of the server points to directory `public`. Read more about this folder:
[TYPO3 Explained, folder "public/"](https://docs.typo3.org/m/typo3/reference-coreapi/main/en-us/Administration/DirectoryStructure/Index.html#directory-public). Files
placed outside of this folder cannot be called directly by the web browser.

There are 3 types of files that must be accessed directly by the browser:

-   [Media and downloads](https://docs.typo3.org/permalink/t3start:media@main): Images, videos and audio files used within the content and
    managed by editors. Downloads like PDF files, Excel sheets etc.
-   [Assets](https://docs.typo3.org/permalink/t3start:assets@main): Including CSS, JavaScript, fonts, images and icons used for design purposes.
-   Technical files managed by Composer and TYPO3, including the `index.php` as
    Entry point, automatically generated assets and scaled versions of images.

## Media and downloads {#media}

Media and downloads **must** be stored in fileadmin. In standard
Composer-based installations, as we assume you have here, they are stored in
`public/fileadmin/`.

Read more about this folder:
[TYPO3 Explained, folder "public/fileadmin/"](https://docs.typo3.org/m/typo3/reference-coreapi/main/en-us/Administration/DirectoryStructure/Index.html#directory-public-fileadmin).

Files in the fileadmin directory are managed by the
[File abstraction layer (FAL)](https://docs.typo3.org/m/typo3/reference-coreapi/main/en-us/ApiOverview/Fal/Index.html#fal_introduction).

They can be uploaded, moved and deleted in the backend module
**Media** by administrators and
depending on [permissions](https://docs.typo3.org/m/typo3/reference-coreapi/main/en-us/Administration/PermissionsManagement/Index.html#permissions-management),
by editors.

> [!WARNING]
> For security reasons, do not store any templates, scripts or assets in this
> directory. Store them in the [assets directory](https://docs.typo3.org/permalink/t3start:assets@main) of a
> [site package](https://docs.typo3.org/m/typo3/tutorial-sitepackage/main/en-us/Index.html#start).

## Assets in extensions and site packages {#assets}

Assets usually include CSS files, JavaScript and images / icons used for design
purposes.

Within an extension, including a site package, they can only be placed in the
`Resources/Public` folder and subfolders of this folder.

During Composer installation the `Resources/Public` directories of all
installed extensions are symlinked into the `public/_assets` webroot folder.
For security reasons the folders in `public/_assets` have hashed names.

> [!NOTE]
> You **must never** reference any file in `public/_assets` directly by
> using the hash in an absolute or relative URL. The hashes can change at any
> time. Only use TYPO3 library methods to reference the assets.

Read more about this folder:
[TYPO3 Explained, folder "public/\_assets/"](https://docs.typo3.org/m/typo3/reference-coreapi/main/en-us/Administration/DirectoryStructure/Index.html#directory-public-assets).