# Problem with Direct Access to PDF Files, etc **URL:** \ **Category:** Using Concrete / Help\ **Created:** [April 10, 2026, 4:49am UTC](https://forums.concretecms.org/t/problem-with-direct-access-to-pdf-files-etc/9861 "2026-04-10T04:49:58Z")\ **Posts on this page:** 5\ **Page:** 2
**Author:** ![mlocati](https://forums.concretecms.org/user_avatar/forums.concretecms.org/mlocati/32/6208_2.png) [@mlocati](https://forums.concretecms.org/u/mlocati)\ **Post date:** [April 20, 2026, 2:23pm UTC](https://forums.concretecms.org/t/problem-with-direct-access-to-pdf-files-etc/9861/21 "2026-04-20T14:23:24Z")
> [@dsds](#): > > If I only have this server, where would be a good place to put it? Whenever you like. I usually keep these “protected” files “near” the webroot. For example, if your webroot (that is, where Concrete is installed) is at ```auto /var/www/my-site ``` I create a directoly like ```auto /var/www/my-site-protected-files ``` > [@dsds](#): > > However, when I access a file that isn’t a tracking URL displayed by the administrator using the method I’ve set up, all the files I don’t want to be displayed are redirected to the login screen, which is the desired behavior. > > Is something wrong? Since your “protected” files are the directory where Concrete is published, those may also be served by your web server (apache or nginx or whatever), without passing through Concrete. Hackers may try to guess your protected file URLs, trying for example accessing ```auto https://your-site.com/confidential-files////yourfile.pdf ``` (where `` are random numbers). That’s why it’s better to place protected files outsite the webroot. ---
**Author:** ![dsds](https://forums.concretecms.org/user_avatar/forums.concretecms.org/dsds/32/6042_2.png) [@dsds](https://forums.concretecms.org/u/dsds)\ **Post date:** [April 20, 2026, 10:18pm UTC](https://forums.concretecms.org/t/problem-with-direct-access-to-pdf-files-etc/9861/22 "2026-04-20T22:18:50Z")
Thank you so much for your repeated guidance. I have changed the file location as you instructed. Are the folder permissions okay in this new location? Finally, thank you again. ![file](https://forums.concretecms.org/uploads/default/original/2X/2/2b72ae946429969d3a96ff8e58c3fcc531914393.png) ---
**Author:** ![mlocati](https://forums.concretecms.org/user_avatar/forums.concretecms.org/mlocati/32/6208_2.png) [@mlocati](https://forums.concretecms.org/u/mlocati)\ **Post date:** [April 20, 2026, 10:29pm UTC](https://forums.concretecms.org/t/problem-with-direct-access-to-pdf-files-etc/9861/23 "2026-04-20T22:29:35Z")
> [@dsds](#): > > Are the folder permissions okay in this new location? Is this a linux server? If so, the owner of the folder should be the one impersonated by the web server (nginx or apache) ---
**Author:** ![dsds](https://forums.concretecms.org/user_avatar/forums.concretecms.org/dsds/32/6042_2.png) [@dsds](https://forums.concretecms.org/u/dsds)\ **Post date:** [April 20, 2026, 11:08pm UTC](https://forums.concretecms.org/t/problem-with-direct-access-to-pdf-files-etc/9861/24 "2026-04-20T23:08:09Z")
I apologize for the repeated messages. The OS is Linux-based (the official OS name isn’t explicitly stated, but it runs on a Linux-like system). Users can use Linux commands via SSH. However, there is no root privileges; it’s a restricted Linux environment for shared use. By the way, is it possible to use the created folder for multiple subdomains? Or would it be better to create one folder for each subdomain? Thank you in advance. ---
**Author:** ![mlocati](https://forums.concretecms.org/user_avatar/forums.concretecms.org/mlocati/32/6208_2.png) [@mlocati](https://forums.concretecms.org/u/mlocati)\ **Post date:** [April 21, 2026, 8:21am UTC](https://forums.concretecms.org/t/problem-with-direct-access-to-pdf-files-etc/9861/25 "2026-04-21T08:21:42Z")
If you can upload files from Concrete without errors, that means that the permissions are ok. > [@dsds](#): > > is it possible to use the created folder for multiple subdomains? A physical directory in the file system: - can’t be assigned to more than one Storage Location - can’t be used by more that one ConcreteCMS installation So, if you use the “multisite” feature of ConcreteCMS (that is, one Concrete for multiple websites) you can use the physical for all the sites managed by ConcreteCMS. If instead you have multiple ConcreteCMS installations, you should have one physical directory for every ConcreteCMS. [Previous page](https://forums.concretecms.org/t/problem-with-direct-access-to-pdf-files-etc/9861.md?page=1)