No error message. I am asking whether PHP environment variables, private PHP config files outside htdocs, or .htaccess SetEnv directives are supported.
Other Information
I am not reporting a website error. I need to confirm the safest way to store production database credentials and other secrets on InfinityFree.
Please confirm whether my account supports:
PHP environment variables
A private PHP configuration file stored outside the htdocs directory
.htaccessSetEnv directives
I want to avoid storing sensitive credentials in publicly accessible files.
Welcome to the InfinityFree community forum! Good to have you here.
Most people answering here are volunteers. They’re often the fastest source of help. Admin (the only staff member) checks in about once a day for issues on our end.
Volunteers can’t see your account or website. Share what you actually see, like error messages and what happens when you try something. That’s more useful than your theory of what’s wrong.
AI tools often get InfinityFree wrong. If a volunteer’s advice differs from what an AI told you, please try the volunteer’s suggestion first.
Solving an issue is a joint effort. Try the suggestions you get and report back what happened.
Beep boop, I’m a bot! I dug through the forum to get you started. I sometimes get things wrong though, so do with this what you will until a human has a look.
I can’t confirm any of the three from what I found. Nothing in the knowledge base or the forum says whether PHP environment variables, a private config file outside htdocs, or SetEnv in .htaccess work on InfinityFree. I’d rather not guess on something that decides where your credentials live.
What I did find is a knowledge base article on installing Laravel. It says the web root is always the htdocs folder of your account and can’t be changed. It also says files in htdocs are reachable over the web unless you block them.
The article’s workaround is a rewrite rule in htdocs/.htaccess. Requests for sensitive files like /.env then return a 404 instead of the file:
That article is about Laravel, but the rewrite idea applies to any app that keeps its config inside htdocs. It doesn’t show that a location outside htdocs is usable, so it doesn’t answer your questions 1–3. If you keep secrets inside htdocs, check from a browser that the file actually returns a 404 and doesn’t show its contents.
You could settle the other two yourself with a quick test. Put a SetEnv line in .htaccess and read it with getenv() in a small PHP file. Or look at your FTP client’s folder tree to see whether you can create a folder next to htdocs. That would only tell you what works on your account. It wouldn’t be a documented guarantee.
I’ve been told that some changes were made regarding private files outside htdocs folders. For secondary domains (linked to their own domain folder, not to the main htdocs folder), PHP can now access files one level above their own htdocs directory. So they cannot read files from other websites on the same account, but you can store files safely outside of the htdocs folder.
If you are trying to set this up on a domain that’s currently assigned to the main htdocs folder, you can remove the domain from your account and then add it again to have it reassigned to a separate folder.
For environment variables, your best bet is to load a .env file. There is no way to configure environment variables that are automatically passed through to PHP.