A WordPress site suddenly displaying source code instead of a webpage is more than a rendering problem. It means the web server is reading If this happens to This guide covers how to identify the failure, contain it, restore PHP 8.3 on Ubuntu 24.04, rotate exposed secrets, harden the site, and verify the repair.<\/p>\n Important:<\/strong> If PHP source is publicly visible, treat the incident as a credential exposure. Take the site offline before investigating further.<\/p>\n<\/blockquote>\n The example setup used throughout this guide is:<\/p>\n Nginx terminates HTTPS and forwards requests to Apache over a private network. Apache executes WordPress through PHP.<\/p>\n Apache does not execute PHP by itself. It needs a PHP handler, commonly one of:<\/p>\n The problem occurs when the handler is missing, disabled, or disconnected from Apache. Common triggers include:<\/p>\n Apache may continue serving Instead of the website, a visitor may see:<\/p>\n Other warning signs include:<\/p>\n Command-line PHP and Apache PHP are separate. This command can succeed:<\/p>\n while Apache still serves source code.<\/p>\n Stop Apache immediately:<\/p>\n Alternatively, remove or disable the Nginx proxy route. Stopping Apache is usually the fastest option.<\/p>\n Confirm it is stopped:<\/p>\n Expected:<\/p>\n Do not restore public service until PHP execution and configuration-file protection have both been tested.<\/p>\n Do not assume WordPress is installed in Locate Inspect Apache's active virtual hosts:<\/p>\n Record the active WordPress document root for use in later commands:<\/p>\n Replace that example path if your installation differs.<\/p>\n Search Apache logs:<\/p>\n If Nginx is the public reverse proxy, search its logs as well:<\/p>\n Useful distinctions:<\/p>\n Compare the response size with the actual file:<\/p>\n If the logged response size exactly matches the file size, the complete configuration file was almost certainly downloaded.<\/p>\n Requests for variants such as these are typical automated scanning:<\/p>\n Do not trust user-agent strings that claim to be Googlebot, ChatGPT, Safari, or Chrome. Automated scanners routinely spoof them.<\/p>\n Ubuntu 24.04 provides PHP 8.3 through its supported repositories.<\/p>\n Update package metadata:<\/p>\n Install PHP and common WordPress extensions:<\/p>\n Disable obsolete PHP modules if they remain:<\/p>\n Validate the configuration:<\/p>\n Expected:<\/p>\n Confirm the modules:<\/p>\n Expected:<\/p>\n Confirm the PHP version:<\/p>\n The output should report PHP 8.3.<\/p>\n If Check the listener:<\/p>\n A safer result resembles:<\/p>\n Avoid putting the new password directly in shell history.<\/p>\n Generate a password:<\/p>\n Store it privately, then open MariaDB without recording SQL history:<\/p>\n Change the WordPress database user's password:<\/p>\n Edit Replace the Test the account:<\/p>\n Expected:<\/p>\n Exposed salts should be replaced to invalidate existing authentication cookies.<\/p>\n Download fresh values:<\/p>\n Review the new values:<\/p>\n Edit The definitions are:<\/p>\n Delete the temporary file securely:<\/p>\n Check PHP syntax:<\/p>\n Expected:<\/p>\n The protection must still work if PHP breaks again.<\/p>\n Create an Apache security configuration:<\/p>\n Enable and validate it:<\/p>\n Add an equivalent rule to the public Nginx HTTPS server block:<\/p>\n Validate and reload Nginx:<\/p>\n Blocking both layers provides defence in depth.<\/p>\n Set its ownership and permissions:<\/p>\n Verify:<\/p>\n Expected:<\/p>\n The Nginx proxy should forward the original request details:<\/p>\n WordPress must recognise HTTPS from the proxy. Add this to Replace Validate again:<\/p>\n Start Apache:<\/p>\n Test the configuration-file block:<\/p>\n Expected:<\/p>\n Test WordPress while simulating the proxy:<\/p>\n Expected:<\/p>\n A redirect is acceptable only when it points to the correct HTTPS hostname.<\/p>\n Test the public site:<\/p>\n Expected:<\/p>\n Test protected files:<\/p>\n Expected:<\/p>\n Verify that PHP source is not present:<\/p>\n The response should contain rendered HTML, not Search for PHP files modified after the exposure:<\/p>\n Investigate:<\/p>\n Reset administrator passwords and review all active WordPress sessions.<\/p>\n The key lesson is that PHP execution is part of the security boundary. A site can look merely broken while silently exposing its most sensitive configuration.<\/p>\n The most effective controls are layered:<\/p>\n A practical incident-response guide for detecting, containing, repairing, and testing PHP source exposure on Ubuntu 24.04 with Apache and PHP 8.3.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"saved_in_kubio":false,"footnotes":""},"categories":[10,14],"tags":[],"class_list":["post-117","post","type-post","status-publish","format-standard","hentry","category-server-builds","category-wordpress-web"],"_links":{"self":[{"href":"https:\/\/www.miniamju.com\/index.php\/wp-json\/wp\/v2\/posts\/117","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.miniamju.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.miniamju.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.miniamju.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.miniamju.com\/index.php\/wp-json\/wp\/v2\/comments?post=117"}],"version-history":[{"count":1,"href":"https:\/\/www.miniamju.com\/index.php\/wp-json\/wp\/v2\/posts\/117\/revisions"}],"predecessor-version":[{"id":123,"href":"https:\/\/www.miniamju.com\/index.php\/wp-json\/wp\/v2\/posts\/117\/revisions\/123"}],"wp:attachment":[{"href":"https:\/\/www.miniamju.com\/index.php\/wp-json\/wp\/v2\/media?parent=117"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.miniamju.com\/index.php\/wp-json\/wp\/v2\/categories?post=117"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.miniamju.com\/index.php\/wp-json\/wp\/v2\/tags?post=117"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}.php<\/code> files as ordinary text instead of passing them to PHP for execution.<\/p>\nindex.php<\/code>, visitors see WordPress bootstrap code. If it happens to wp-config.php<\/code>, visitors may be able to download:<\/p>\n\n
\n
The Typical Architecture<\/h2>\n
Internet\n |\n v\nNginx reverse proxy with HTTPS\n |\n v\nApache on Ubuntu 24.04\n |\n +-- PHP 8.3\n +-- WordPress\n +-- MariaDB bound to localhost\n<\/code><\/pre>\nWhat Causes the Problem?<\/h2>\n
\n
libapache2-mod-php8.3<\/code><\/li>\nproxy_fcgi<\/code><\/li>\n<\/ul>\n\n
.php<\/code> files, but without interpreting them.<\/p>\nRecognising the Symptoms<\/h2>\n
<?php\ndefine( 'WP_USE_THEMES', true );\nrequire __DIR__ . '\/wp-blog-header.php';\n<\/code><\/pre>\n\n
Content-Type<\/code><\/li>\nwp-config.php<\/code> returning a non-zero response body<\/li>\nphp -v\n<\/code><\/pre>\nStep 1: Contain the Exposure<\/h2>\n
sudo systemctl stop apache2\n<\/code><\/pre>\nsystemctl is-active apache2\n<\/code><\/pre>\ninactive\n<\/code><\/pre>\nStep 2: Find the Active WordPress Directory<\/h2>\n
\/var\/www\/html<\/code>.<\/p>\nwp-config.php<\/code>:<\/p>\nsudo find \/var\/www -type f -name 'wp-config.php' -print\n<\/code><\/pre>\nsudo apache2ctl -S\nsudo grep -R "DocumentRoot" \/etc\/apache2\/sites-enabled\n<\/code><\/pre>\n\/var\/www\/wordpress\n<\/code><\/pre>\nStep 3: Confirm Whether
wp-config.php<\/code> Was Downloaded<\/h2>\nsudo grep -R "wp-config.php" \/var\/log\/apache2\/access.log*\n<\/code><\/pre>\nsudo grep -H "wp-config.php" \/var\/log\/nginx\/access.log*\n<\/code><\/pre>\n\n
HEAD ... 200 0<\/code> may mean PHP executed normally and returned no body.<\/li>\nGET ... 403<\/code> means access was blocked.<\/li>\nGET ... 200<\/code> with a non-zero byte count is suspicious.<\/li>\n<\/ul>\nsudo stat -c '%s %n' \/var\/www\/wordpress\/wp-config.php\n<\/code><\/pre>\nwp-config.php.old\nwp-config.php.bak\nwp-config.php.save\nwp-config.php~\n.wp-config.php.swp\n<\/code><\/pre>\nStep 4: Restore PHP 8.3<\/h2>\n
sudo apt update\n<\/code><\/pre>\nsudo apt install \\\n php8.3 libapache2-mod-php8.3 php8.3-cli php8.3-common \\\n php8.3-mysql php8.3-curl php8.3-gd php8.3-mbstring \\\n php8.3-xml php8.3-zip php8.3-intl php8.3-opcache\n<\/code><\/pre>\nsudo a2dismod php8.0 2>\/dev\/null || true\nsudo a2dismod php8.1 2>\/dev\/null || true\nsudo a2dismod php8.2 2>\/dev\/null || true\n<\/code><\/pre>\nmod_php<\/code> requires Apache's prefork MPM:<\/p>\nsudo a2dismod mpm_event 2>\/dev\/null || true\nsudo a2enmod mpm_prefork\nsudo a2enmod php8.3\nsudo a2enmod rewrite\n<\/code><\/pre>\nsudo apache2ctl configtest\n<\/code><\/pre>\nSyntax OK\n<\/code><\/pre>\napache2ctl -M | grep -E 'php|mpm'\n<\/code><\/pre>\nmpm_prefork_module (shared)\nphp_module (shared)\n<\/code><\/pre>\nphp -v\n<\/code><\/pre>\nStep 5: Rotate the Database Password<\/h2>\n
wp-config.php<\/code> was exposed, its database password must be replaced even when MariaDB listens only on localhost.<\/p>\nsudo ss -lntp | grep ':3306'\n<\/code><\/pre>\n127.0.0.1:3306\n<\/code><\/pre>\nopenssl rand -base64 36\n<\/code><\/pre>\nsudo env MYSQL_HISTFILE=\/dev\/null mariadb\n<\/code><\/pre>\nALTER USER 'wordpress_user'@'localhost'\n IDENTIFIED BY 'your-generated-password';\nFLUSH PRIVILEGES;\nEXIT;\n<\/code><\/pre>\nwp-config.php<\/code>:<\/p>\nsudo nano \/var\/www\/wordpress\/wp-config.php\n<\/code><\/pre>\nDB_PASSWORD<\/code> value with the identical password.<\/p>\nmariadb -u wordpress_user -p -h localhost wordpress_database \\\n -e 'SELECT 1;'\n<\/code><\/pre>\n+---+\n| 1 |\n+---+\n| 1 |\n+---+\n<\/code><\/pre>\nStep 6: Replace WordPress Keys and Salts<\/h2>\n
sudo curl -fsS https:\/\/api.wordpress.org\/secret-key\/1.1\/salt\/ \\\n -o \/root\/new-wordpress-salts.txt\n\nsudo chmod 600 \/root\/new-wordpress-salts.txt\n<\/code><\/pre>\nsudo nano \/root\/new-wordpress-salts.txt\n<\/code><\/pre>\nwp-config.php<\/code> and replace all eight definitions:<\/p>\nsudo nano \/var\/www\/wordpress\/wp-config.php\n<\/code><\/pre>\nAUTH_KEY\nSECURE_AUTH_KEY\nLOGGED_IN_KEY\nNONCE_KEY\nAUTH_SALT\nSECURE_AUTH_SALT\nLOGGED_IN_SALT\nNONCE_SALT\n<\/code><\/pre>\nsudo shred -u \/root\/new-wordpress-salts.txt\n<\/code><\/pre>\nphp -l \/var\/www\/wordpress\/wp-config.php\n<\/code><\/pre>\nNo syntax errors detected\n<\/code><\/pre>\nStep 7: Protect
wp-config.php<\/code> Independently of PHP<\/h2>\nsudo tee \/etc\/apache2\/conf-available\/wordpress-security.conf >\/dev\/null <<'EOF'\n<FilesMatch "^wp-config\\.php(?:\\..*)?$">\n Require all denied\n<\/FilesMatch>\nEOF\n<\/code><\/pre>\nsudo a2enconf wordpress-security\nsudo apache2ctl configtest\n<\/code><\/pre>\nlocation ~* ^\/wp-config\\.php(?:\\..*)?$ {\n deny all;\n}\n<\/code><\/pre>\nsudo nginx -t\nsudo systemctl reload nginx\n<\/code><\/pre>\nStep 8: Correct File Permissions<\/h2>\n
wp-config.php<\/code> should not be writable by the web-server account or other users.<\/p>\nsudo chown root:www-data \/var\/www\/wordpress\/wp-config.php\nsudo chmod 640 \/var\/www\/wordpress\/wp-config.php\n<\/code><\/pre>\nsudo stat -c '%U:%G %a %n' \/var\/www\/wordpress\/wp-config.php\n<\/code><\/pre>\nroot:www-data 640 \/var\/www\/wordpress\/wp-config.php\n<\/code><\/pre>\nStep 9: Handle HTTPS Behind Nginx<\/h2>\n
proxy_set_header Host $http_host;\nproxy_set_header X-Real-IP $remote_addr;\nproxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\nproxy_set_header X-Forwarded-Proto $scheme;\n<\/code><\/pre>\nwp-config.php<\/code> if it is not already present:<\/p>\nif (\n ! empty($_SERVER['HTTP_X_FORWARDED_PROTO']) &&\n $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https'\n) {\n $_SERVER['HTTPS'] = 'on';\n}\n\ndefine('FORCE_SSL_ADMIN', true);\ndefine('WP_HOME', 'https:\/\/www.example.com');\ndefine('WP_SITEURL', 'https:\/\/www.example.com');\n<\/code><\/pre>\nwww.example.com<\/code> with the real hostname.<\/p>\nphp -l \/var\/www\/wordpress\/wp-config.php\n<\/code><\/pre>\nStep 10: Start Apache and Test Locally<\/h2>\n
sudo systemctl start apache2\nsudo systemctl is-active apache2\n<\/code><\/pre>\ncurl -sS -o \/dev\/null -w '%{http_code}\\n' \\\n -H 'Host: www.example.com' \\\n http:\/\/127.0.0.1\/wp-config.php\n<\/code><\/pre>\n403\n<\/code><\/pre>\ncurl -sS -D - -o \/dev\/null \\\n -H 'Host: www.example.com' \\\n -H 'X-Forwarded-Proto: https' \\\n http:\/\/127.0.0.1\/\n<\/code><\/pre>\nHTTP\/1.1 200 OK\n<\/code><\/pre>\nStep 11: Test from Outside the Origin Server<\/h2>\n
curl -I https:\/\/www.example.com\/\n<\/code><\/pre>\nHTTP\/1.1 200 OK\n<\/code><\/pre>\ncurl -sS -o \/dev\/null -w '%{http_code}\\n' \\\n https:\/\/www.example.com\/wp-config.php\n\ncurl -sS -o \/dev\/null -w '%{http_code}\\n' \\\n https:\/\/www.example.com\/wp-config.php.old\n<\/code><\/pre>\n403\n403\n<\/code><\/pre>\ncurl -sS https:\/\/www.example.com\/ | head\n<\/code><\/pre>\n<?php<\/code>.<\/p>\nStep 12: Check for Follow-On Changes<\/h2>\n
sudo find \/var\/www\/wordpress -type f -name '*.php' \\\n -newermt 'YYYY-MM-DD HH:MM:SS UTC' \\\n -printf '%TY-%Tm-%Td %TH:%TM:%TS %u:%g %m %p\\n'\n<\/code><\/pre>\n\n
wp-content\/uploads<\/code><\/li>\nVerification Checklist<\/h2>\n
\n
php_module<\/code>.<\/li>\nmpm_prefork<\/code>.<\/li>\napache2ctl configtest<\/code> reports Syntax OK<\/code>.<\/li>\nwp-config.php<\/code> is root:www-data<\/code> with mode 640<\/code>.<\/li>\nwp-config.php<\/code>.<\/li>\nwp-config.php<\/code> and common backup suffixes.<\/li>\nwp-config.php<\/code> requests return 403<\/code>.<\/li>\nLessons Learned<\/h2>\n
\n
References<\/h2>\n
\n
https:\/\/ubuntu.com\/server\/docs\/how-to\/web-services\/install-php\/<\/a><\/li>\nlibapache2-mod-php8.3<\/code>
https:\/\/packages.ubuntu.com\/noble\/libapache2-mod-php8.3<\/a><\/li>\n
https:\/\/developer.wordpress.org\/advanced-administration\/security\/hardening\/<\/a><\/li>\nwp-config.php<\/code> guidance
https:\/\/developer.wordpress.org\/advanced-administration\/wordpress\/wp-config\/<\/a><\/li>\n
https:\/\/developer.wordpress.org\/cli\/commands\/config\/shuffle-salts\/<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"