SiteWorx’s allowed PHP file-extension control determines which filename suffixes are treated as executable PHP. It is different from installing PHP libraries such as mbstring or imagick.
IN THIS ARTICLE
01 What you need before you begin
Confirm the application genuinely uses a nonstandard suffix such as phtml. Review upload directories and public files so enabling a suffix cannot accidentally make user-uploaded content executable.
02 Control which file extensions SiteWorx treats as PHP
- Open Hosting Features > Domains > Manage and locate the intended domain.
- Open the three-dot action menu and choose PHP Extensions.
- Review the current allowed suffixes. Enter only the needed filename extensions, one per line, without a leading period, following the form’s instructions.
- Save and test a controlled trusted application file with the intended suffix. Confirm that ordinary static files still have their expected handling.
- Document the reason for the exception and remove obsolete suffixes after migrating the application to its supported file layout.
03 Confirm the expected result
The intended trusted PHP files should execute through the configured runtime, while unrelated extensions remain static or protected as designed.
04 Troubleshoot unexpected results
If an application reports a missing PHP function or library, this screen is probably not the solution. Ask the provider about runtime modules. Do not enable PHP execution for broad image, text or upload suffixes to bypass an application error.
05 Example: distinguish a filename problem from a missing module
A legacy application has a trusted template called account.phtml. If the server downloads or displays its PHP source instead of executing it, stop exposing that endpoint and check its handler configuration. Source output can reveal implementation details or secrets, so do not leave it public while experimenting.
A different failure, such as a message about an unavailable database driver, usually concerns the running PHP environment rather than the filename suffix. Enabling more executable suffixes will not install a database module.
How should I test an extension change?
Use a harmless file in a controlled location that contains no credentials. Verify the response through the intended hostname and remove the test file afterwards. Also check an ordinary static file to make sure it is still delivered normally. Do not use a public phpinfo() page as a permanent diagnostic tool.
Tell us the domain, required suffix and application documentation when you need help. Keep the exception as narrow as possible. User upload directories must not become a place where uploaded files execute merely because their suffix matches the new rule. Review the application's upload validation and server access controls as part of the same change.
Can this fix a missing database extension?
No. A filename-handler setting and a runtime library are separate. Verify the actual PHP module requirement and use the provider’s supported runtime configuration.