Take the 2-minute tour ×

My site's main file(index.php) code is here:

include 'header.php';
include 'sidebar.php';
include 'content.php';
include 'footer.php';

But I don't want any user to see these include files by writing "www.domain.com/header.php". Should i insert a php code in these files or is that possible?

share|improve this question
add comment

3 Answers

You have several options.

  1. Keep the files outside the webroot (so they don't automatically get URIs of their own)
  2. Configure your webserver so it refuses to serve them
  3. Test if a variable/constant is set, and then set it in every one of the files that is allowed to include them. exit if it is not set.
share|improve this answer
+1 for putting all those files out of the webroot. –  Arkh May 14 '12 at 8:57
add comment

Here's a PHP for you.


In short, this quits execution if the calling file is itself.

Source: http://thephpcode.blogspot.se/2009/07/creating-include-only-php-files.html

share|improve this answer
add comment

You can define a constant in your main file, and use it in your included files to detec wether they were really included or not:


define('REALLY_INCLUDED', true);


share|improve this answer
... and then you forget the constant somewhere and expose the file. "oops". if you want something kept private, don't put it into the document root in the first place. –  Marc B May 14 '12 at 8:55
This will throw some unnecessary warnings. Add quotes during definition: define('REALLY_INCLUDED', true); and use the correct function to check if the constant is defined: if(!defined('REALLY_INCLUDED') || !REALLY_INCLUDED) { ... –  Bart S. May 14 '12 at 8:58
add comment

Your Answer


