Let's say I would like to protect my PHP files that are on the public server and are used as a part of the website. Does anyone can easily access these files just like HTML/JS/CSS files through developers tool in the browsers or extensions such as FireBug?

I am guessing that it is not possible through these tools, but what about if someone's trolling the URL and just randomly tries to guess the name of the php files, which would be easy for something like results.php or similar. Is the file displayed just like that if they guess it?

What if someone's gonna write a script to troll the URL?

  • It depends on the specific code in your website/pages.
    – Xander
    Mar 1, 2015 at 0:02
  • Have you tried to simply download those files that you are concerned about? If the client browser is supposed to process it, then the client can download it.
    – schroeder
    Mar 1, 2015 at 0:22
  • What do you mean by "troll the URL"? If you mean trying to brute-force guess file names, then there are many website scanners that do exactly that. There are also crawlers that inventory the files on your server by reading the source code of the web pages and parsing the links and includes.
    – schroeder
    Mar 1, 2015 at 0:24

1 Answer 1


Under normal circumstances, assuming that the server is configured correctly and that there are no security vulnerabilities in either your server or your PHP code, there should be no way for any normal visitors to see your PHP source.

The reason you cannot hide HTML/CSS/JS from users is because HTML/CSS/JS are all client-side code, meaning they are interpreted and executed by the user's browser. Obviously, you must send the code to the user before the user's browser can execute it, so users can easily make their browsers show them this code.

PHP, on the other hand, is server-side code. This means that your server runs it, and only sends back the results to the user. ("Results", for the most part, means anything you put in echo() statements). Thus, there should be no way for users to look at the original source. They are limited to stuff that you explicitly 'echo' (plus maybe PHP error messages, if you have them enabled).

If someone guesses the URL of a php script and tries to access the URL directly, the server will still just go through and run the script, and send only the output back to the user. The server runs the script each time it is requested. What the user will see depends on the specific script and your server configuration. If the script requires user input and none is provided, then it is likely the user will just see an error message.

read/write rights are required for the user to actually make the php work, or is it fine to take user's r/w access to the php files and the website will behave the same accessing the php when user sorts of request it using the website?

I have no idea what you mean by this, could you elaborate?


Not the answer you're looking for? Browse other questions tagged .