Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The aim here is a security catch-all to disallow php execution of files created by the apache user (i.e. uploaded to a php script). Also we'd change the .html/.htm/.xhtml etc to text/plain to help protect against JS based attacks on other users.

Something like:

<FileOwnerMatch apache>
    #Disable PHP execution
    #change mime types

Can it be done?

NB We do check file extensions on uploads, but we'd like somethng akin to the above for added peace of mind.

share|improve this question

You should make sure that Apache is only allowed to write into specific directories and disallow all execution for this directories (both CGI and PHP) with a <directory> statement.

Deactivating PHP can be done with a statement

php_flag engine off

in the <directory> part of your Apache configuration.

share|improve this answer
Yes, we already do something equivalent. But as mentioned in the original post this is a catch all safety net. Just in case there are 777 directories somewhere that we have missed, or that get created in the future. – DaedalusFall Aug 17 '11 at 17:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.