Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am coming from IIS and moving to Apache and recently found out that Apache by default serves up files of an unknown file extension as PURE TEXT.

This can be an issue if a user uses certain programs that back up .php files as .php~. Then the .php~ file becomes completely readable by simply navigating to it in a browser. To make matters worse these .php~ files are often considered 'hidden' in the linux environment from the user so some may not even know they exist. Bots have been created around this fact that scour the internet looking for popular file name backups and extracting potentially secure info from them.

I already know how to stop serving up .php~ files or any specific file extensions. I also know not to use any editors that would save backup files like this.

My question is, how can I stop this default Apache behavior of serving up ANY non-MIME file type at all? I just don't like the this behavior and would like to stop it. I don't want it serving up .aspx~, .html~, .bob, .carl, no extension or anything else that is not a real MIME type.

I know that I can probably go and use a directive to first Deny access to all file types. Then add the ones I want to serve out one by one. But I'm wondering if there's an easier/quicker way.

Thanks for any help.

share|improve this question
up vote 1 down vote accepted

Apache HTTPd by default uses the mime type application/octet-stream for unknown files. Therefore you should (in theory) be able to set an action using mod_actions on it like this:

Action application/octet-stream /cgi-bin/unknown-mime-type.cgi

Where the CGI script must of course be available and executable or you could add a rewrite for the given path to serve up a 404 page. I'm not sure this is wise though.

share|improve this answer
Thanks, I was hoping there as a recommended real way to do it through Apache that wasn't a 'trick' but I'll try this. – user223304 Jun 2 '14 at 14:50
I think it has to do with the design aspect of webservers. Normally you are in control what ends up in the folder the webserver tries to serve, so there is no need for such hacks. If you have an application over which you have control, you should really consider a proper deployment process. If you are running a hosting environment, this shouldn't be your problem anyway. – Janoszen Jun 3 '14 at 11:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.