PHP script protection

Question

I had a terrifying issue a few days ago. I was installing updates on my ubuntu server, which is a hosts for about 10 websites. During the update, something went wrong, and apaches mod_php became disabled. As a result, PHP support was gone, and for a few minutes (until I figured what's wrong) users got an invitation to download PHP scripts, instead of seeing a website. Needless to say, there is nothing worse then exposing your script sources to the whole world, especially when database credentials are kept inside.

The question: How can I configure apache, so this situation would not be possible in the future? What lines should I add to apache2.conf, so that PHP files could not be downloaded, if mod_php is disabled?

Answer 1

Just add the following to the .htaccess in the root directory

php_admin_flag engine on

In this case user will get HTTP 500 error trying to read any file from this dir and below because no module defines php_admin_flag directive in case mod_php is off.

Answer 2

A more secure approach would be simply to not put things you don't want accessed in the document root in the first place. See my answer here which provides more detail; the basic idea is, if you don't ever want a file accessed via URL, don't put the damn file in a URL accessible place. 99% of your app code should not be under the document root; then it doesn't really matter what you do to your apache/php setup, you're still safe.