Prevention of PHP backdoor URL_PHP tutorial

For example, the following WEB application may display sensitive information to logged-in users:

Since sensitive.php is located in the main directory of the website, the browser can skip the verification mechanism and access the file directly. This is because all files in the main directory of the website have a corresponding URL address. In some cases, these scripts may perform an important operation, which increases the risk.
To prevent backdoor URLs, you need to make sure to save all included files outside of the website's main directory. All files saved in the home directory of the website must be directly accessed through URL.