PHP Apache Handler MIME Type

What does application/x-httpd-php mean?

application/x-httpd-php is a long-standing Apache handler name used to tell the web server that a matching file should be processed by PHP. The PHP manual demonstrates it with a FilesMatch rule for .php files.¹ Despite its MIME-shaped spelling, it is not a registered Internet media type. It does not appear in IANA's application media type registry.²

That distinction matters. Apache defines a handler as the action performed when a file is requested, separate from the file's content type. Its current documentation even recommends handler names without slashes so they do not occupy media-type syntax.³ application/x-httpd-php predates that cleaner convention and remains in deployed configuration.

How are PHP files identified?

The usual filename extension is .php. A PHP-aware Apache configuration can associate other extensions with the same handler, but the mapping is controlled by the server. The PHP manual shows both a narrow .php rule and a broader example covering historical names such as .php3, .php4, .php5, and .phtml.¹

PHP source has no dependable magic number. A file can begin with <?php, but PHP can also be embedded after ordinary HTML or other text. The PHP parser uses <?php and ?> to enter and leave PHP mode, and content outside those tags can pass through as output.⁴ A fixed signature would therefore miss valid files.

Desktop file classifiers often use a different unregistered label, application/x-php. The freedesktop.org shared MIME database describes that type as a text-based PHP script, associates it with several PHP extensions, and uses a nearby <?php tag only as supporting detection evidence.⁵ Neither label is an IANA standard.

Where did the label come from?

Rasmus Lerdorf created the first PHP tools in 1994 and released their source publicly in June 1995. PHP then evolved from CGI utilities into a programming language, with PHP 3 released by the PHP Development Team in 1998.⁶

The application/x-httpd-php spelling grew out of the Apache module integration around that ecosystem. There is no IANA registration that assigns it an author, creation date, parameters, or official extensions. The x- prefix reflects an older custom for private or experimental names. RFC 6648 later discouraged creating new X- names because widely deployed private conventions tend to become permanent and create interoperability problems.⁷

The label is still meaningful when reading an existing Apache configuration or metadata record. It should not, however, be treated as a portable description of a PHP source file across every web server, desktop, and API.

How to open a .php file

A PHP file is source text, so any text editor can open it. A language-aware editor is more useful for navigation, formatting, diagnostics, and completion.

• Visual Studio Code includes PHP syntax highlighting, bracket matching, completion, snippets, and integration with the PHP linter.⁸
• PhpStorm recognizes file types by filename patterns and provides PHP-focused editing and project tools.⁹
• The PHP command-line interface can execute a trusted file with php my_script.php or php -f my_script.php. The CLI does not require the file to end in .php.¹⁰

Opening source and executing it are different actions. Use an editor when you only need to inspect or change a file. Run it only in an environment where its dependencies, configuration, permissions, and inputs are understood.

What do browsers do with application/x-httpd-php?

Chrome, Edge, Firefox, Opera, and Safari can display the result of a PHP-backed URL, but they do not execute PHP. The web server runs PHP and sends the generated response to the browser. The PHP tutorial demonstrates a .php request producing an ordinary HTML document.¹¹

If a server sends raw PHP source instead, browser behavior depends on headers and local settings. It may show the text or download the file. That is normally a server configuration failure, not useful PHP support. PHP's installation FAQ specifically identifies visible source as evidence that the server did not pass the script to PHP for interpretation.¹²

The output media type should match the generated content. An HTML page normally uses text/html; a JSON endpoint normally uses application/json. Sending application/x-httpd-php to the browser confuses an internal handler name with the representation delivered over HTTP.

Support in Poly

Poly recognizes the application/x-httpd-php label and the .php extension. You can store, sync, share, version, and find these files by name. Poly does not currently provide an in-app PHP source preview, source-content indexing, or direct agent reading for this label.

Download the file and open it in a trusted code editor when you need to inspect its contents. If you want the Poly agent to analyze a script, provide a separate readable text copy and include any related configuration or source files needed to understand it. Poly does not execute PHP code.

Is application/x-httpd-php the same as application/x-php?

No, although both are commonly associated with PHP.

These labels are metadata, not conversions. Renaming index.php to index.txt does not remove executable PHP statements, and changing an HTTP header does not run the source. Server configuration determines whether a requested file is executed.

Converting or publishing PHP source

PHP source usually does not need conversion. Choose an operation based on the actual goal:

• Share source for review. Keep the .php file, or make a clearly labeled plain-text copy when a system cannot read PHP-specific metadata.
• Publish generated HTML. Run trusted code in a controlled environment, capture its output, and save that output as .html. This creates a snapshot and does not preserve server-side behavior.
• Show code on a website. Escape the source as text and serve the page as HTML. Do not place a live script in a public web root merely to display it.
• Move to another language. Rewrite and test the behavior. A filename or MIME-type change cannot translate program logic.

Security and privacy considerations

PHP source is executable code. It can access files, databases, credentials, networks, and other services available to its process. Inspect unfamiliar code and dependencies before running them, and use an isolated environment with the minimum necessary permissions.

Extension matching also deserves care. PHP's Apache installation guide recommends an end-anchored match so a filename such as exploit.php.jpg is not accidentally executed as PHP.¹ Treat the MIME label and extension as hints, not proof that a file is safe or that its contents match its name.