# Choose where phpVMS lives

https://vmshost.io/kb/a/phpvms-folder-layout

phpVMS has a `public` folder. Only that folder should be reachable from the web. Everything else, such as `.env`, `config` and `storage`, holds passwords and private data and must stay out of reach.

There are two safe ways to set this up on your hosting.

## Option 1: A subdomain (recommended)

Run phpVMS on a subdomain, such as `crew.yourva.com`, and point the subdomain at the `public` folder. Your main domain stays free for a website. See [Set up phpVMS on a subdomain](https://vmshost.io/knowledgebase/article/setting-up-phpvms-on-a-subdomain).

## Option 2: Your main domain

Use this if phpVMS is your whole site.

1. Create a folder named `phpvms` in your home folder, next to `public_html`, and extract phpVMS into it.
2. Copy everything inside `phpvms/public` into `public_html`.

```
/home/youruser
  phpvms        <- extract phpVMS into here
  public_ftp
  public_html   <- copy the contents of phpvms/public into here
```

The folder must be named `phpvms`. phpVMS then finds it on its own.

**When you update phpVMS**, the update doesn't change the files in `public_html`. Copy the new contents of `phpvms/public` into `public_html` again after each update.

## Don't upload everything into public_html

If you put all of phpVMS inside `public_html`, a small mistake can expose your `.env` file and your database password to anyone. Use one of the options above.

## Sites installed with the installer

The automated installer uses its own layout: the public files go where you chose, and the rest of phpVMS goes into a separate folder that ends in `.phpvms`. See "Important Locations" in [Install phpVMS with the installer](https://vmshost.io/knowledgebase/article/setting-up-phpvms).