Hide php script extension

Hiding the extension of PHP scripts for PHP Security is generally considered ineffective to improve security by means of hiding. But in some cases, it is worthwhile to add as much security as possible.

Some simple methods can help to hide PHP, which can make it more difficult for attackers to discover system vulnerabilities. Setting expose_php = off in the php. ini file can reduce the useful information they can obtain.

Another policy is to let the web server use PHP to parse different extensions. Whether using the. htaccess file or Apache configuration file, you can set a file extension that can mislead attackers:

Example #1 hide PHP as another language

# Make PHP look like other programming languages AddType application/x-httpd-php. asp. py. pl

Or simply hide it:

Example #2 use an unknown extension as the PHP extension

# Make PHP look like an unknown file type, AddType application/x-httpd-php. bop. foo. 133 t

You can also hide it as an HTML page, so that all HTML files will use the PHP engine, which will add some burden to the server:

Example #3 use HTML for PHP file suffix

# Make PHP code look like HTML page AddType application/x-httpd-php. htm. html

To make this method take effect, you must change the extension of the PHP file to the above extension. In this way, security is improved through Hiding, although the defense capability is low and there are some shortcomings.