If Apache is configured to parse PHP and not allow to index files, are there other ways users can see PHP source code, either with or without intention?

  • Assuming your website doesn't have any command execution vulnerabilities, no.
    – Chris
    Commented Dec 20, 2013 at 23:17

2 Answers 2


If Apache is properly configured with the php module loaded and correct mime types, you should expect to not have any code disclosed to the client.


AddModule mod_php.c
LoadModule php_module         modules/mod_php.so
LoadModule php5_module        modules/libphp5.so

AddType application/x-httpd-php .php

There don't seem to be any attacks against mime types in apache that would break this behavior that I know of. You should be more worried about poor coding practices, and disclosing the source code through other means such as file inclusion attack.

PHP does have a .phps extension that beautifies source code for sharing. If you use these files, make sure you strip them of any usernames and passwords before sharing them. It might be possible for a file to be incorrectly named .phps insteaf of .php -- unlikely, but possible.

  • Note: PHP doesn't need to be an Apache module, but it does need to be configured. This was just an example, so another example would be a correctly configured php-fpm install instead of an apache module. Commented Dec 22, 2013 at 15:30

Here's an example of case that how hackers use file inclusion vulnerability to disclosure PHP source code. If not not properly configured, it can even lead to remote code execution vulnerability.

PHP security exploit - list content of remote PHP file?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .