security - PHP script protection -
i had terrifying issue few days ago. installing updates on ubuntu server, hosts 10 websites. during update, went wrong, , apaches mod_php
became disabled. result, php support gone, , few minutes (until figured what's wrong) users got invitation download php scripts, instead of seeing website. needless say, there nothing worse exposing script sources whole world, when database credentials kept inside.
the question: how can configure apache, situation not possible in future? lines should add apache2.conf, php files not downloaded, if mod_php disabled?
just add following .htaccess in root directory
php_admin_flag engine on
in case user http 500 error trying read file dir , below because no module defines php_admin_flag directive in case mod_php off.
Comments
Post a Comment