← DocumentationProtected service files
storage/private/settings.json holds general settings without the MySQL password. storage/private/secrets.json holds that password. pages.json contains pages, translations, and label bindings; module-instances.json lists instances, while modules.json records installed-module state. installed.lock prevents the installer from running again. Do not edit these files manually on a live site, especially secrets.json and session data.
.htaccess provides Apache routing and blocks access to private directories. .user.ini supplies secure PHP settings. If the site runs on nginx, reproduce the relevant access-denial rules in its configuration.
Imported-site data lives under storage/imports/<source>. The source name comes from project settings rather than being hard-coded in the core. The compatibility layer reads it separately; new instances never write to imported JSON. Their own JSON files live under storage/modules/<module>/instances, and images under uploads/media/modules.
FoxCoreCMS separates the core, design, modules, public content, and private data. This separation matters for upgrades and backups.
Main directories
| Path | Purpose |
|---|---|
| admin/ | Control panel and its assets |
| content/ | CMS-managed content |
| database/migrations/ | Database migrations |
| design/ | Site designs and page templates |
| docs/ | Project documentation |
| install/ | System installer |
| modules/ | Module packages and their file templates |
| src/ | Core classes |
| storage/ | Settings, private data, backups, and imports |
| uploads/ | Uploaded public files |
| bootstrap.php, index.php | Bootstrapping and public routing |
What you may change
Put site designs under design/<name>/ and templates for a particular module under modules/<module>/templates/. Edit content and images through the control panel. Test any core changes in src/ separately before upgrading.
Do not manually edit storage/private/secrets.json, session files, or installed.lock. Imported data from an older CMS stays under storage/imports/<source>; new module instances live under storage/modules/<module>/instances/, and their images under uploads/media/modules/.
When moving a site, transfer files, settings, the media library, and the database together. After restoring, verify write permissions and that storage/ remains private.