Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How can I disable php scripts on a specific subdir of my website using IIS7?

I have a wordpress blog and I want to disable php on the "uploads" dir.

share|improve this question
add comment

1 Answer

You have quite a few options here. All code examples (one for each approach) need to be placed in web.config file in your "uploads" folder (in case if you do not know this).

1) Remove handler that is responsible for processing *.php files (in IIS Manager it is "Handler Mappings"):

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <handlers>
            <remove name="PHP 5" />
        </handlers>
    </system.webServer>
</configuration>

Cons:

  • You need to know the handler name
  • Handler name can be changed in a future (admin may change to handle PHP in a different way etc)

2) Using Request Filtering module disable all requests to files with .php extension -- server will send 404.7 error to the client. This module is bundled with IIS 7.5, but for IIS 7.0 you may need to download and install Administration Pack.

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <security>
            <requestFiltering>
                <fileExtensions>
                    <add fileExtension=".php" allowed="false" />
                </fileExtensions>
            </requestFiltering>
        </security>
    </system.webServer>
</configuration>

If you have more than one extension for PHP you will need to list them as well (e.g. .phtml, .php5 etc).

3) Using URL Rewrite module create a rule to Abort such request.

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <rewrite>
            <rules>
                <clear />
                <rule name="Abort PHP" stopProcessing="true">
                    <match url="^.*\.php$" />
                    <action type="AbortRequest" />
                </rule>
            </rules>
        </rewrite>
    </system.webServer>
</configuration>
  • IIS 7.0 has no URL Rewrite module bundled while IIS 7.5 has v1.1. Unfortunately I have no v1.1 of this extension installed -- only v2 and cannot check/guarantee that this will work in v1.1. In any case -- I recommend to download and install version 2 of URL Rewrite module.
  • You will need to extend this rule to also catch other file extensions that may be processed by PHP on your setup (e.g. .phtml, .php5 etc).

4) Using URL Rewrite module create a rule to respond with custom error instead of processing such request.

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <rewrite>
            <rules>
                <clear />
                <rule name="Disable PHP" stopProcessing="true">
                    <match url="^.*\.php$" />
                    <action type="CustomResponse" statusCode="404" statusReason="No PHP here" statusDescription="Sorry mate" />
                </rule>
            </rules>
        </rewrite>
    </system.webServer>
</configuration>

5) Using URL Rewrite module create a rule to redirect to your own error page for all of such requests.

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <rewrite>
            <rules>
                <clear />
                <rule name="Show Our Error Page for PPHP files" stopProcessing="true">
                    <match url="^.*\.php$" />
                    <action type="Rewrite" url="/404.php" />
                </rule>
            </rules>
        </rewrite>
    </system.webServer>
</configuration>

The above rule will internally redirect (rewrite) such requests to a 404.php file in the website root folder (e.g. http://www.example.com/404.php)


Use #2 if possible -- it will be executed before URL Rewrite step which will be beneficial on very busy server.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.