The conf.d/php.conf file attaches .php files to its handler like this: AddHandler php5-script .php however, that allows some hackery. for example, create three files, "test.php", "test.php." and "test.php.blahblah". in each, place "<?php phpinfo();" and load them in your browser - they are all rendered as PHP files. This means that a web application which allows people to upload files (images, for example), but not PHP scripts, can be circumvented by naming the script somescript.php.notphp and then uploading it. To solve this, it is probably better to change the handler attachment to this: |<FilesMatch \.php$> SetHandler php5-script </FilesMatch> | kae