Server configuration
Public document roots, HTTPS and private storage for Nginx and Apache.
Public means public only
Use public as the document root. Keep source code, license storage, database credentials and backups outside it. Grant the PHP runtime write access only to storage.
Nginx
Nginx does not read .htaccess files. Configure routing in the server block: serve existing public assets and route other requests to index.php. Permit PHP execution only for that front controller, pass the HTTPS status to PHP-FPM and reject hidden or private file paths.
Apache
The distribution contains rewrite rules for Apache. Enable mod_rewrite and the appropriate AllowOverride permissions. A public document root is preferred over relying on parent-directory rewrites. Apache runtime verification is still pending for the development distribution.
Canonical HTTPS
Redirect HTTP and hostname aliases to the licensed HTTPS hostname, preserving the path and query. Sense CMS rejects unexpected installation hosts. Do not trust arbitrary forwarded headers from public clients.
Before production
Verify private-file denial, certificate renewal, database recovery and fresh installation in a separate environment. Current development builds are not stable production releases.