Question

Which is the question my partner said I’d not need answering, so to prove my point I removed php and simulated a server problem. And hey presto, the webserver serves up the PHP source as a download.

So, the question, is there a way to stop source being served up in the event of a server glitch, bug, or temporary loss of connection to the relevant modules etc?

Answer 1

The only way source is revealed is if you change the server configuration by error – for instance, you’re using a mod_php for Apache and accidentally remove the module.

For that particular case, you can do this:

<IfModule php5_module>
   AddHandler php5-script .php
   PHPIniDir "/etc"
</IfModule>
<IfModule !php5_module>
  <FilesMatch "\.php$">
      Order allow,deny
      Deny from all
      Satisfy All
  </FilesMatch>
</IfModule>