Apache :: serve php page without allowing them to be downloadable

completementgaga

Hello everybody,
I have a question:
how to let apache use a .php file to serve the corresponding http page and still prevent the same .php file from beeing downloadable with wget, by third parties ?

I guess this could involve file ownership, file permissions, php configuration and apache configuration.

Here is what I had before discovering that my php code was exposed:

I have Apache 2.4.37 installed on a centos 8 server, together with PHP 7.2.33

I have a hello world test.php php file in /var/www/html

glsmith

how about just

<Files "config.php>
Require all denied
</Files>

or for multiple php files

<Files ~ "(config|install|preferences)\.php$>
Require all denied
</Files>

php will still be able to import those files, Apache will just not serve them up to the visitors. Visitors will get the 403 Forbidden.

completementgaga

@glsmith Thank you for your answer.
Are you meaning there is no way to prevent all php source from beeing acessible to third parties?

Best,

completementgaga

Another answer to the same question has been provided
at https://stackoverflow.com/questions/67460525/how-to-serve-php-pages-without-allowing-them-to-be-downloadable/67460641#67460641

Best,

James Blond

There is a misunderstanding. When the Webserver is configured to interpret the php files they cannot be downloaded from the outside.