How to check in .htaccess if PHP is enabled?

Question

How can I let Apache's .htaccess file check if PHP is enabled? I tried things like <IfModule !mod_php7.0.c> and <IfModule !mod_php7.c> but it doesn not seem to do anything when I enable/disable the module.

I would like to have a fallback in my .htaccess that denies acces from all when PHP is disabled. In order to prevent leakage of plain text PHP code.

I want to do something like this:

# If PHP is not installed, deny all access to .php files to prevent PHP code leakage
<IfModule !mod_php7.c>
    <FilesMatch \.php$>
        order deny,allow
        deny from all
    </FilesMatch>
</IfModule>

Ultimately it will check something like if php7 AND php5 AND php4 are disabled, deny access. Any ideas?

Also, when AllowOverride is None and so the .htaccess file is not doing anything. What are the options in order to prevent the PHP code from leaking in plaintext?

Answer 1

<IfModule !mod_php5.c>
    <FilesMatch ".+\.php$">
        Order Deny,Allow
        Deny from all
    </FilesMatch>
</IfModule>

In Apache 2.4

<IfModule !mod_php5.c>
    <FilesMatch ".+\.php$">
        Require all denied
    </FilesMatch>
</IfModule>

In Apache 2.4 there are several new useful features: define, ifdefine, and if, else, ifelse.

In the following we can deny by default and only enable if PHP_IS_ENABLED is defined.

<IfModule mod_php5.c>
    Define PHP_IS_ENABLED
</IfModule>

<IfModule mod_php7.c>
    Define PHP_IS_ENABLED
</IfModule>

# php8
<IfModule mod_php.c>
    Define PHP_IS_ENABLED
</IfModule>

# ...

<IfDefine !PHP_IS_ENABLED>
    <FilesMatch ".+\.php$">
        Require all denied
    </FilesMatch>
</IfDefine>

Answer 2

Here is a solution to check against multiple versions of PHP (e.g. "if php 5 OR php 7 is enabled") that indeed works in .htaccess.

It requires Apache 2.4 with mod_env module (99% it is enabled on your host).

<IfModule mod_php5.c>
    SetEnv PHP_IS_ENABLED yes
</IfModule>

<IfModule mod_php7.c>
    SetEnv PHP_IS_ENABLED yes
</IfModule>

<If "reqenv('PHP_IS_ENABLED') == 'yes' || reqenv('REDIRECT_PHP_IS_ENABLED') == 'yes'">
    ... your directives
</If>

REDIRECT_PHP_IS_ENABLED is required to make this work for requests internally redirected with mod_rewrite.