How to secure PHP files from being downloaded?

Question

I have a doubt about PHP, Apache, server interpretation... I know that when a PHP file is loaded by the browser from an Apache+PHP server it is interpreted and only the HTML and plain text is showed but is there a way to download this files instead of interpreting them? In this case it would be very unsecure because MySQL passwords would be unsafe.

Is it any security measure to prevent this or it's impossible to download this files?

Answer 1

As long as your server is setup properly it isn't going to happen.

A good step though is to put all of your actual passwords and whatnot in a config.php and including it. That way you can use htacces too block that file so that should your server ever start serving the raw pages that file won't be accessible anyway.

To clarify if you create a .htaccess file and place it in the same folder as the config.php with the below information that file will not be served, even if requested directly. Simply define your config stuff (db name, user name, password, hashes, etc) in this file and include_once it at the top of each page that needs it and you will be good to go.

<files config.php>
    order allow,deny
    deny from all
</files>

Answer 2

无法“下载” PHP文件，但是为了提高安全性，您可以将“核心” PHP文件放在public_html文件夹之外

Answer 3

Unless the PHP interpreter stops working for some reason, it's not something to worry about. Most servers are designed to interpret the PHP files every time they are requested and serve only the interpreted HTML text. It's possible to secure your sensitive PHP settings files just in case - often by placing them outside of the root directory with modified permissions.

Answer 4

The only way someone could download the files is to have a server set up that serves the raw files. As long as you don't have such a server set up, they're inaccessible. If the only server software on your system is Apache and it's configured correctly, people cannot see your source code.

However, if somebody seeing your source would render your app vulnerable, you might want to give some thought as to how you can fix that problem. Lots of secure open-source software exists — why would yours being open-source cause problems?

Answer 5

With proper configuration apache guarantees that files will always get interpreted and won't be offered for download.

You always may install fault update or make wrong configuration, but with skilled admin and stable release those cases just don't happen.