Renaming the 'contao' folder

**redwax** · 05/10/2013, 00:57

For the purposes (partly) of security, does anybody know if there is any means by which the backend 'contao' folder can be renamed?

**Ruud** · 05/10/2013, 12:09

I only know it can be renamed, but have never done so before. So I just tried and renamed the contao folder and searched for all instances of contao in the code. To be a bit more efficient I tried searching for "/contao[^\.]". There where a few results, but unfortunately replacing those was not enough. The admin path "contao" is hard coded. I think replacing all instances is the only way to do it, and it will take you some more work to find all of them.

One thing has to be said: While doing this is definitely possible, it is not update safe. If for security I would suggest to keep the contao dir as it is so you will be easier able to apply security updates.

**redwax** · 05/10/2013, 12:57

This is what I kinda thought unfortunately. And obviously, I really don't want to get into the habit of hacking the core code. I think this would be a fairly quick and easy feature to implement and would actually be really worthwhile don't you think?

**Ruud** · 05/10/2013, 14:04

Well, on one hand I'd like to divert attention away from the name Contao. My customers do not know the system and have never heard of it before. So as long as Contao is not a household name in CMS land and known to just about everyone I would like to brand it my own name (keep in mind that some restrictions apply to what you may do because of licensing)

On the other hand my customers go in blank; open up the administration through contao, administrator, admin, wp-admin or whatever link is trivial. So I don't really mind the url to be optional.

It depends on what Leo wants to do with Contao. My idea is he should make the system known to the masses with an easy templating system with a large template choice, together with a guided installation that sets up the system with a blank site and applies the chosen theme. At the moment Contao offers some themes and an installer that can install the music academy example site. Problem with this approach is that the choice for the music academy is not guided (should I get this and what does it do?) and the installation adds a lot of unneeded information. In any case, back on topic; I don't think this feature is a primary concern but a nice addition nonetheless. I couldn't find a feature request on github for this.

The contao directory was not the initial name, so it has already been changed once. The old typolight directory was kept for a while to redirect to the new one. I don't think this is what you'd want, but you can use the same tactic so you can have people go to /yourname which redirects to contao. Many customers may not even notice...

**redwax** · 05/10/2013, 14:28

Originally Posted by Ruud

My idea is he should make the system known to the masses

Catch 22. I like the fact very few people have heard of it. From a security point of view it is a winner. On the other hand, if it were more known then people might stop using blogging software (a.k.a. Turdpress) as a CMS.

Still, whatever the reason, I think it would be a good feature just to be able to rename the contao directory. Pretty much everything else I can think of allows this - WHMCS, ZenCart, OpenCart - the list is pretty endless

Feature request via Github is a good call!

**Ruud** · 05/11/2013, 10:12

That little people know the CMS is not a security feature. That Leo invested time in making it secure from the ground up is the winner here. Honestly I think we need more users to get a better forum with more of the hard questions answered and the easier questions answered faster. (And of course the changes I suggested so people can do an install without the need of reading documentation)

From one hand I agree; it is nice no-one knows about Contao (over here), it gives me a USP over competition. But they sell there websites with exotic features cheaper then I can because the community almost always already built an extension for everything. (For example I constructed a sync with a popular occasion management system, that all other CMS's have an extension for in the downloads section, for free. It took me 20 hours including testing.)

ps, I don't understand the catch 22 in that??

***lucina*** · 05/12/2013, 15:09

In fact, you are allowed to rename the backend folder only if you buy a commercial license. And I'm quite sure that you will get an extension for that after you bought it.

I also agree with Ruud that security by obscurity has never been (and will never be) a good idea.