Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to enable SSI on a server (running apache), but only allow the include element (<!--#include -->) and not any other?

share|improve this question
up vote 2 down vote accepted

There isn't quite that level of granularity. The best you can do is use

Options IncludesNOEXEC

which will disable the #exec cgi and #exec cmd versions. You'll still get all the rest.

I'll add that SSI processing is kind of expensive, as it requires the webserver to actually parse the shtml files, regardless of if SSI is used in them. The "xbit hack" can help with this, but if you're really just looking to be able to include content, it might be better to use a CRM system. Some players in that field are Drupal, Joomla!, and (my favorite) Textpattern. There are a lot of them. There's also a fair number of good ways to do this with PHP, and only where it's needed. You might want to look at that if you only need this functionality on a limited number of pages.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.