Websites built with server-side code (PHP especially) often include files based on user input — a language parameter, a page name, a theme choice. When that input isn't checked, attackers can reach files they should never touch. That is a file inclusion vulnerability, and it comes in two flavors: Local File Inclusion (LFI) and Remote File Inclusion (RFI).
With LFI, an attacker tricks the site into reading files already on the server — configuration files, credentials, or sensitive system files on a misconfigured host. The request might hide something like page=../../../../etc/passwd inside an otherwise normal-looking URL.
With RFI, the attacker goes further: they point the include at a malicious file hosted on their own server, and the website downloads and executes it. That is a direct path to full server takeover.
Why should this matter to you? File inclusion is not a theoretical bug. It is one of the oldest web vulnerabilities, and it still shows up in real attacks — especially against sites running outdated CMS themes and plugins that include files dynamically.
The fixes are straightforward:
- Never include files based directly on user input. Use a whitelist of allowed values instead.
- Turn off
allow_url_includein PHP — RFI should be impossible by default. - Keep your CMS, themes, and plugins updated; file inclusion patches are common in security releases.
- Harden your server with proper file permissions, so even a successful LFI reads as little as possible.
- Scan your site regularly — a quick scan catches inclusion patterns before attackers find them.
You can run a free check at https://vulnerabilitytools.com/ to spot risky patterns on your own website before someone else does.
