Files, folders and URLs

Éclair has no database: everything that makes up your site lives in files and folders you can see over FTP. This reference describes the file tree, the role of each file in data/, the settings in eclair-config.php, the .htaccess and Nginx rules, the permissions to set, what to back up and every URL the site generates on its own.

The eclair folder tree

The files and folders below are what you upload to your hosting's public folder (public_html, www…).

eclair/
├── index.php                  front controller: serves the cache without loading the application
├── .htaccess                  rewriting, protections, compression, browser caching
├── eclair-config.exemple.php  template for the optional advanced settings
├── app/                       Éclair's code (never reachable from the web)
│   ├── bootstrap.php          startup: PHP version, eclair-config.php, loading
│   ├── manifest.php           original fingerprints for the integrity check
│   ├── lib/                   classes: Content, Blocks, Seo, Analyzer, Media, Auth, Mcp…
│   ├── admin/views/           admin screens (.php.gz in the archive)
│   ├── install/               setup wizard and “Installation locked” screen
│   ├── lang/                  admin translations (6 languages, compressed JSON)
│   └── theme/                 public site templates, theme.css, themes/, directions.css
├── assets/
│   ├── admin/                 admin CSS and JavaScript
│   └── site/site.js           the public site's only script (1.2 KB compressed)
├── data/                      content, settings, accounts: never public
├── cache/                     generated pages: never public
└── media/                     uploaded images, site icons, heading font

app/ and assets/ contain the code: an update replaces them. Your data is in data/ and media/, which updates never touch. Next to the eclair folder, the official archive also contains the LISEZ-MOI.txt, LICENSE.txt and THIRD-PARTY-NOTICES.txt files: there's no need to upload them to your hosting.

How is a page served?

1. Every page request arrives at index.php; images, CSS and scripts are served directly by the server. For a read (GET or HEAD), index.php reads cache/runtime.php: whether the cache is on, its expiry date, and the required domain and HTTPS.
2. If the page exists in cache/pages/, it's sent as is, with its ETag; a browser that already has it gets a 304 Not Modified response.
3. Otherwise, app/bootstrap.php starts the application: it checks the PHP version, reads eclair-config.php if it exists, then routes the request to the installer, the admin, the form, the MCP connector or the site. The generated page is cached for the next visits.

The code is covered in detail in Éclair's architecture.

What does the data folder contain?

Each file in data/ is a .php file that starts with the line <?php exit; ?>, followed by JSON data. Even if a server ignored .htaccess files, opening one in a browser would display nothing. Writes are atomic (a temporary file, then a rename) and the files are private.

The cache and media folders

cache/

The cache clears itself on every change, and at the scheduled time for a scheduled post. To clear it by hand: Settings › Advanced › Clear cache.

media/

The media/.htaccess file only allows images: no scripts, HTML pages, SVG or file listings, with a security policy that forbids any active content. Uploads are covered in detail in Images and the media library.

What goes in eclair-config.php?

This optional file sits next to index.php. Copy eclair-config.exemple.php under the name eclair-config.php, then uncomment what you need. It's read when the application starts, before anything else, and the integrity check doesn't flag it as an unknown file.

<?php
defined('ECLAIR') || exit;

// Error details, while you solve a problem:
// define('ECLAIR_DEBUG', true);

// Data outside the public folder (move the data folder first):
// define('ECLAIR_DATA', '/home/myaccount/eclair-data');

// Stronger protection for API keys, to set before saving them:
// define('ECLAIR_SECRET', 'a-long-secret-phrase');

The code also recognizes two technical constants that aren't in the official guide: ECLAIR_AI_ENDPOINTS (a replacement URL for an AI service, for a gateway or for tests) and ECLAIR_FONTS_URL (the font source, Fontsource via cdn.jsdelivr.net by default). Only use them if you know why. ECLAIR_VERSION and ECLAIR_ROOT are set by index.php.

The .htaccess rules explained

Éclair's .htaccess file works at the root of a domain as well as in a subfolder. It only uses directives allowed on shared hosting: no Options, no php_flag. Here is its rewriting section:

RewriteEngine On
# RewriteBase /
RewriteCond %{HTTP:Authorization} .
RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteRule ^(app|data|cache)(/|$) - [R=404,L]
RewriteRule (^|/)\.(?!well-known/) - [R=404,L]
RewriteRule ^(?!index\.php$).*\.(php\d?|phtml|phar|inc)$ - [R=404,NC,L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^ index.php [L,QSA]

1. RewriteBase / stays commented out: uncomment it only if your host requires it, which is rare.
2. The two Authorization lines pass PHP the authorization header that some hosts strip. The MCP connector needs it.
3. app/, data/ and cache/ return a 404 from the web.
4. Hidden files (.git, .env…) return a 404, except for the .well-known folder.
5. No PHP script runs except index.php.
6. Everything that isn't an existing file goes through index.php, even a folder: no file listing is ever shown.

The rest of the file turns on Brotli or Gzip compression for HTML pages, CSS stylesheets, JavaScript, JSON and XML data, RSS feeds, SVG images and Markdown, sets one-year browser caching for images, CSS, scripts and fonts (Cache-Control: public, max-age=31536000, immutable), and declares the WebP, AVIF and WOFF2 types. The app/, data/ and cache/ folders also have their own .htaccess that denies all access, so the protection is doubled.

The Nginx configuration

Nginx ignores .htaccess files: reproduce these rules in your site's server block. This is the configuration given in the official guide.

location ~ ^/(app|data|cache)(/|$) { return 404; }
location ~ /\.(?!well-known/) { return 404; }
location ^~ /media/ {
    location ~* \.(php\d?|phtml|phar|s?html?|svgz?|xml|js)$ { return 404; }
    add_header X-Content-Type-Options nosniff;
    expires 1y;
}
location ~* \.(webp|avif|jpe?g|png|gif|ico|css|js|woff2)$ { expires 1y; add_header Cache-Control "public, immutable"; }
location / { try_files $uri /index.php$is_args$args; }
location = /index.php {
    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $document_root/index.php;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}
location ~ \.php$ { return 404; }

• The first two rules close off the internal folders and hidden files, except .well-known.
• The /media/ block refuses scripts, HTML pages, SVG and XML, and caches files for a year.
• try_files sends everything that isn't an existing file to index.php.
• Only index.php is handed to PHP-FPM: adapt fastcgi_pass to your server's socket.
• For the AI assistant to stream its answers as they're written, add fastcgi_buffering off; to the PHP block.

HTTPS, proxies and CDNs are covered in Nginx, VPS, proxy and CDN.

What permissions should files and folders have?

• PHP must be able to write to data/, cache/ and media/. The setup wizard checks each of them (Folder “data” is writable) and, if a check fails, advises giving write permission (755) via FTP.
• Éclair then creates its data files with 0600 permissions (readable only by the account that runs PHP), its subfolders of data/ and cache/ with 0700, and those of media/ with 0755.
• Avoid 777 permissions, which let any account on the server write. If 755 isn't enough, ask your host which account PHP runs under.

Which files and folders should you back up?

The ZIP backup contains neither the API keys, nor the conversations and MCP connections, nor the sessions. After restoring to another server, paste your API keys again and reconnect Claude or ChatGPT. To restore, replace data/ and media/ with the ones from the backup (via FTP), then clear the cache from the admin.

The complete update procedure is in Advanced security and maintenance.

The URLs generated by Éclair

Content URLs

The words in URLs follow the site's language: page in French and English, pagina in Spanish, Italian and Portuguese, seite in German; auteur, autor, author or autore; recherche, buscar, search, suche, cerca or pesquisa; boutique, tienda, shop, negozio or loja.

One URL per piece of content: Éclair 301-redirects variants with capital letters, a trailing slash, double slashes or index.php, as well as http to https when HTTPS is forced, and www or non-www once the official URL is verified.

Some words are reserved and can't be used as a page URL: app, data, cache, assets, media, index, admin, _eclair, __eclair, sitemap, robots, feed, llms, llms-full, favicon, wp-admin, wp-login, plus your admin URL, the blog URL, the search word and the shop URL once it's set up. The SEO side of these URLs is covered in SEO with Éclair.