Method and process of hiding suffix (.PHP) in php

Hide PHP
You can also hide the fact that you are using PHP to power your website, or at least make it less obvious. Use the expose_php directive to avoid appending php version information to the end of the web server signature. Disallowing access to phpinfo() prevents attackers from obtaining your software version number and other important information. By changing the document extension, it is less obvious that these pages map to PHP scripts.

1.expose_php=On|Off
Scope: PHP_INI_SYSTEM; Default value: On.
When enabled, the PHP directive expose_php appends details to the server signature. For example, if ServerSignature is enabled, ServerTokens is set to Full, and this directive is enabled, the relevant part of the server signature file is as follows:
Apache/2.0.44(Unix) DAV/2 PHP/5.0.0b3-dev Server at www. example.com Port 80
If expose_php is disabled, the server signature looks like this:
Apache/2.0.44(Unix) DAV/2 Server at www.example.com Port 80

2. Delete all instances of phpinfo() calls
The phpinfo() function provides a great tool for viewing a summary of the PHP configuration on a specified server. However, because they are unprotected on the server, these files are a gold mine for attackers. For example, this function can generate information about the operating system, PHP and web server versions, configuration flags, and a detailed report on all available extensions and their versions. If an attacker is allowed to access this information, potential attack vulnerabilities are more likely to be discovered and exploited.
Unfortunately, it seems that many developers are unaware of or don't care about these vulnerabilities, because just typing phpinfo.php into a search engine will get about 336,000 results, many of which lead directly to the execution of the phpinfo() command. file, thus providing a wealth of information about the server. For earlier fragile PHP versions. Just quickly modify the search terms and add other keywords, you can get a subset of the original results, and this will become the main target of attacks, because they use known insecure versions of PHP, Apache, IIS and various Supported extensions.
Allowing others to view the results of phpinfo() essentially provides the public with a roadmap that lists your server's many technical features and flaws. Don't fall victim to an attack just because you were lazy and failed to delete or protect this file.

3． Modify document extension
PHP-enabled documents can generally be identified by their unique extensions, the most common of which include. php, php3 and . phtml. Did you know this can be easily changed to another extension you wish? You can even change it to .html, .asp or. jsp?, for this, just modify the following line in the httpd.conf file:
Addtype application/x-httpd-php .php
Add any extension you want, for example:
AddType application/x- httpd-php .asp

Of course, make sure this does not cause conflicts with other installed server technologies.

For more PHP related technical articles, please visit the PHP Tutorial column to learn!

The above is the detailed content of Method and process of hiding suffix (.PHP) in php. For more information, please follow other related articles on the PHP Chinese website!