when I create a file ".user.ini" owned by root inside a /web folder, this file can be read by the browser. Even when this file has 0644 permissions. I create a file "test.php" Code: <?php echo shell_exec('whoami'); > and it returns "web10". Then, if the browser has the user web10, Why is there access to files owned by root, and with 0644 permissions? I can create one ".ini" files restriction inside htaccess to avoid access. Although I don't know if this is a behaviour of the php-fpm, or perhaps there is a permission problems to be fixed Sorry, I don't want to flood this subforum with too many questions. It is the first time I use php-fpm. My previous ISPC were always cgi with only one php, I'm not sure of the cause of some errors. Hope this wil be the last one!