# Private folders

> How to close a folder of your own to the web with DooFiles, so nobody can open its files by address, and choose which administrators can open it in DooFiles. Includes which folders can be private, the server check, the rule for nginx and the daily check.

Source: https://doothemes.com/docs/doofiles/security/private-folders

---

## Overview

A private folder is a folder of your site that nobody can open from the web, not even with the exact address of a file. Inside DooFiles, only the administrators you choose can open it, and only after they confirm their password.

Use it for files that live on your server but must never be public, such as exports, client documents or backups of your own.

Before a folder becomes private, DooFiles checks with a real request that your server keeps it closed. It checks it again every day.

## Which folders can be private

A private folder must be a folder of your own, outside the folders of WordPress. For example, a folder at the top level of your site, such as `/client-files`.

These cannot be private:

- the main folder of your site;
- the folders of WordPress, such as `wp-admin`, `wp-includes`, `wp-content` and its `plugins`, `themes` and `uploads` folders, anything inside them, and any folder that contains them;
- a folder with another WordPress installation inside;
- a folder inside another private folder, or that has a private folder inside;
- shortcuts (symbolic links), and folders that the server does not let DooFiles write to.

A folder can have up to 200,000 files to be made private.

## Make a folder private

1. In the file list, right-click the folder and choose **Make private…**.
2. Choose the administrators who can open it. Only administrators who can use DooFiles appear in the list. If you leave yourself out, you will not be able to open it.
3. Click **Make private**, and confirm your password (and your [second factor](https://doothemes.com/docs/doofiles/security/second-factor), if you use one).

DooFiles closes the folder, checks with a real request that your server keeps it closed, and shows *“client-files” is now private.* The folder shows a padlock in the list.

If the folder contains a `.htaccess` or `web.config` file, DooFiles asks you to remove it first, because it could open the folder again.

[SCREENSHOT_HERE: The Make "client-files" private? dialog with the list of administrators and the Make private button]

### On nginx servers

Apache, LiteSpeed and IIS close the folder with the rules that DooFiles adds. nginx ignores those rules, so DooFiles does not make the folder private, and shows you the rule to add instead:

```nginx
location ^~ /client-files/ {
    deny all;
}
```

Add the rule that DooFiles shows inside the `server` block of your site, in the configuration of nginx, reload nginx, and try again. If you do not manage your server, send the rule to your hosting provider.

The first time, DooFiles may also ask you to close its own Trash and backups folder in the same way, because files from private folders pass through it.

See [Server configuration](https://doothemes.com/docs/doofiles/guides/server-configuration).

## Open a private folder

Administrators on the list open it like any other folder, after they confirm their password. Inside, a notice reminds them: *Private folder “client-files”: it cannot be opened by URL, and here only the administrators on its list can open it.*

Other administrators see the folder with a padlock, but cannot open it: *This folder is private and you are not on its list.*

## Change who can open it

Right-click the private folder and choose:

- **Who can open it…** to add or remove administrators, then **Save**.
- **Make public…** to make it a regular folder again. DooFiles removes its rules, and the folder can be opened by address again. The files stay where they are.

Both ask for your password.

### Claim a folder that nobody can open

If every administrator on the list was deleted, or DooFiles was installed again, nobody can open the folder. Any administrator can then right-click it and choose **Claim…**, confirm the password, and become the only one on its list. This is recorded in the [Activity](https://doothemes.com/docs/doofiles/views/activity) log.

## What else changes for a private folder

To keep its files private, DooFiles also:

- does not compress a private folder from outside, nor delete or compress a folder that contains one, so its files never end up in a public zip file or in the wrong place;
- does not move a private folder inside another private folder or a WordPress folder;
- does not allow `.htaccess` or `web.config` files inside it, by creating, uploading or extracting them;
- does not search inside it;
- shows its items in the [Trash](https://doothemes.com/docs/doofiles/views/trash) and its entries in the [Activity](https://doothemes.com/docs/doofiles/views/activity) log only to the administrators on its list.

## The daily check

Every day, DooFiles checks again that each private folder is closed to the web and still where it was. If one can be opened by address again, or is no longer there, the WordPress admin shows a notice: *DooFiles: a private folder can be opened by URL again or is no longer where it was.*, with a link to review it.

## The Private folders card

**DooFiles › Settings** lists every private folder in the **Private folders** card:

| State | What it means |
|---|---|
| **Closed to the web** | Your server keeps it closed. The card shows when it was last checked |
| **Open to the web** | The folder can be opened by address. Add the rule that the card shows to your server, or fix the rules of the folder |
| **Not checked** | It has not been checked yet |
| **Not found** | The folder is no longer where it was |

Each folder also shows who can open it. Click **Check now** to check it right away. The card also shows the state of the DooFiles **Trash and backups folder**, which must be closed too.

[SCREENSHOT_HERE: The Private folders card in Settings with a folder Closed to the web, who opens it, the last check and Check now]

Deleting DooFiles keeps your private folders closed. If you install it again, an administrator can claim them.

## Troubleshooting

| Problem | What to do |
|---|---|
| *WordPress folders, what is inside them and the folders that hold them cannot be private.* | Use a folder of your own outside the WordPress folders, such as one at the top level of your site |
| *This server ignores the rules DooFiles wrote, so the folder can still be opened by URL. Nothing was changed.* | Your server is nginx. Add the rule that DooFiles shows, reload nginx and try again |
| *DooFiles could not check that the folder is closed to the web (the site could not reach itself), so nothing was changed.* | Your server cannot reach its own address. Ask your hosting provider to allow it |
| *Remove /client-files/.htaccess first: a server rules file inside a private folder could open it to the web again.* | Delete or move that file, then try again |
| *This folder is private and you are not on its list.* | Ask an administrator on its list to add you with **Who can open it…** |
| *This folder has too many files to check. Split it into smaller folders.* | The folder has more than 200,000 files. Split it, and make the smaller folders private |
| The card shows **Open to the web** | Something changed on your server. Add the rule that the card shows, or ask your hosting provider |

Need more help? [Open a support ticket](https://doothemes.com/account/tickets/new).