Secure your PHP script by hiding extensions

In general, security by obscurity is one of the weakest form of security. Suppose If I were exploiting a site, I wouldn’t check what scripting language the site runs on, because all that would matter to me is exploiting it. Hiding the fact that you use x language isn’t going to prevent me from bypassing poor security. But in some cases, every little bit of extra security is desirable.

Also, read:

• 15+ regular expressions for PHP developers
• Convert Associative Array into XML in PHP
• Convert XML into Associative Array in PHP
• Converting an Array to JSON in PHP
• Converting JSON to Array or Object in PHP

A few simple techniques can help to hide PHP, possibly slowing down an attacker who is attempting to discover weaknesses in your system. By setting expose_php to off in your php.ini file, you reduce the amount of information available to them.

Another tactic is to configure web servers such as apache server to parse different filetypes through PHP, either with an .htaccess directive, or in the apache configuration file itself. You can then use misleading file extensions:

Hiding PHP as another language:

AddType application/x-httpd-php .asp .py .pl

Or obscure it completely.

Using unknown types for PHP extensions:

AddType application/x-httpd-php .bop .foo .133t

Or hide it as HTML code, which has a slight performance hit because all HTML will be parsed through the PHP engine:

Using HTML types for PHP extensions:

AddType application/x-httpd-php .htm .html

For this to work effectively, you must rename your PHP files with the above extensions. While it is a form of security through obscurity, it’s a minor preventative measure with few drawbacks.

You may also like:

• Working with php.ini file Configuration
• Control Statements in PHP
• Convert Associative Array into XML in PHP
• Convert XML into Associative Array in PHP
• Using Prepared Statement with PHP & MySQL
• How to Upload File in PHP
• Converting an Array to JSON in PHP
• Converting JSON to Array or Object in PHP
• Manipulating PHP arrays: push, pop, shift, unshift
• Remove Repeated Words From String in PHP
• Converting a PHP Array to a Query String
• 15+ regular expressions for PHP developers
• 10 Most Important Directory Functions in PHP
• 10 little known but useful PHP functions
• PHP Script to Download Large Files Reliably