Hacker News Reader

The previous presence of PHP and its oftentimes ridiculous common practices might mandate a maintenance mode that is a little more involved than just serving HTML.

e.g. if your site usually responds blank for https://site.example/database-passwords-and-other-goodies.ph... but under maintenance mode publishes the configuration verbatim, that would be quickly picked up the usual scanner bots.

Depends on how it is set up.

Many modern hosts run php in fcgi mode, where your app is a process that listens on some http port. And where the webserver is "just" a proxy and ssl termination. Shutting down the process is enough.

But traditionally, php was a module loaded into apache. Where apache not only handled ssl, http etc, but also compiled and ran php for you. With that setup, adding an html file, will keep the php runtime and app online.

It was suggested to only allow GET/HEAD requests. Works if you don't have login forms.

you need to block requests from being routed to your PHP interpreter