Recommended Server Settings

Websites based on Publii don't require much to function correctly; in fact, any server that can host HTML files will handle the basics. However, to provide your visitors with a safe, user-friendly site experience, some factors are essential to bear in mind when deciding which type of server you want to use to host your site.

Key considerations for hosting a Publii website

Not all servers are configured to display an index.html file automatically when a visitor opens a directory URL, such as /about/. If your hosting does not support this behavior, enable Always add index.html in URLs in Site settings > Advanced options > URLs. This adds the filename to generated URLs, for example /about/index.html. If your server already serves directory index files correctly, you can leave this option disabled.
The FTP protocol may be simple to use and is supported by Publii, but it sends login details and files without encryption. Instead, we recommend using FTPS or SFTP, depending on what your hosting provider supports. FTPS uses TLS to protect FTP connections and file transfers, while SFTP transfers files over an encrypted SSH connection. Both provide an encrypted alternative to plain FTP.

Publii does not generate empty index.html files in every directory to prevent directory listing. Therefore, we recommend using hosting that disables directory listing or allows you to disable it manually. Directory listing is controlled by the web server or hosting service, rather than the protocol used to upload your site.

On Apache, you can usually disable directory listing by adding Options -Indexes to a .htaccess file, provided your hosting allows this directive. NGINX uses server configuration instead of .htaccess; its directory listing setting is autoindex off;.

The following table shows how this applies to the different deployment methods.

Deployment method	Directory listing
FTP / FTPS	Depends on the web server configuration. On Apache, directory listing can be disabled through .htaccess if the hosting provider permits it.
SFTP	Depends on the web server configuration, just as with FTP / FTPS. SFTP itself does not control what visitors can browse.
GitHub Pages	Does not provide automatic directory listings. Requests without a matching page normally return a 404 error.
GitLab Pages	Does not provide automatic directory listings. A directory without an index.html file returns a 404 error, as described in the GitLab Pages documentation.
Netlify	Does not provide automatic directory listings. Unmatched requests normally return a 404 error, although redirects and routing rules can change the response.
Google Cloud Storage	Bucket contents can be listed through the storage API if public permissions include storage.objects.list. Review the bucket's IAM roles; the Storage Object Viewer role includes both reading and listing objects.
Amazon S3	The website endpoint does not provide a directory listing. Listing objects through the S3 API requires s3:ListBucket permission; avoid granting this permission publicly.
Git repository	Depends on the service that publishes the repository's files as a website.
Manual deployment	Depends on the available settings of the destination server or hosting service.

Disabling directory listing prevents visitors from browsing an automatically generated file list. It does not prevent access to individual files when their URLs are known.

To protect traffic between your visitors' browsers and your website, we strongly recommend using HTTPS, which encrypts connections using TLS. Your hosting provider needs to provide a valid certificate and HTTPS support; many providers configure these automatically. Once HTTPS is working, select https:// for the Website URL on Publii's Server screen and synchronize your site. Configure your hosting to redirect HTTP requests to HTTPS as well.

With these points in mind, you can choose hosting that serves your pages correctly, protects connections, and avoids exposing directory listings.

Protecting the files.publii.json File

Starting from Publii 0.46, the synchronization process uses individual file checksums stored in the files.publii.json file for deployment methods that use this file list. These include FTP / FTPS, SFTP, Amazon S3, and Google Cloud Storage.

This file helps Publii manage synchronization by:

Tracking Each File Separately: The files.publii.json file records the paths and checksums of files managed by Publii, so they can be compared during synchronization.
Reducing Upload Times: By comparing the local and remote file lists, Publii can skip files whose paths and checksums have not changed.
Tracking Removed Files: The previous file list also helps Publii identify files that are no longer part of the generated site and should be removed from the server.

Other deployment methods may manage synchronization differently. For example, GitLab Pages stores its file list in the repository as publii-files.json, while GitHub Pages, Git repository, and Netlify use separate deployment mechanisms.

Why Hide or Protect this File?

The files.publii.json file contains information about files uploaded to your site using Publii. Generally, these files are already publicly accessible, as they form the visible content of your website. However, if you prefer not to expose a list of your site's files and their checksums, you can restrict public access to this file.

The examples below block requests made through the web server. They leave FTP / FTPS and SFTP access available, allowing Publii to continue reading and updating the file during synchronization.

Blocking Access on Apache
Add the following rule to the .htaccess file in your website's root directory. Your hosting must allow authorization directives in .htaccess.
```
<Files "files.publii.json">
    Require all denied
</Files>
```
This returns a 403 Forbidden response when someone requests the file through the website.
Blocking Access on NGINX
If you manage an NGINX server, add the following location block to the configuration for your website:
```
location = /files.publii.json {
    deny all;
}
```
If your website is published in a subdirectory, include that path in the rule, for example /blog/files.publii.json. Apply the configuration using your server's normal validation and reload procedure, or ask your hosting provider to configure it.

On managed hosting or object storage such as Amazon S3 and Google Cloud Storage, use the access controls supported by that service. Apache and NGINX rules do not apply to storage buckets. Keep the read and write access required by the credentials Publii uses for synchronization.

After applying a rule, check that the file is no longer publicly accessible and that Publii can still synchronize your site. Hiding this file does not protect the individual pages or assets it lists; private content needs its own access restrictions.

Important: Do not delete files.publii.json simply to hide it. For deployment methods that rely on this file, a missing or unreadable remote file list can require Publii to upload the whole site again.