The combination of Wheezy's version 5.4 PHP reaching the end of life and the hack means I have been looking at having a new Jessie server. The release notes for Jessie acknowledge that "We do not allow access to the file system outside /var/www and /usr/share. If you are running virtual hosts or scripts outside these directories, you need to whitelist them in your configuration to grant access through HTTP." Now, I have had virtual hosts in user's directories, /home/*/public_html so that's me. And... "You must allow access to your served directory explicity in the corresponding virtual host, or by allowing access in apache2.conf as proposed." I think I have, in both, but everything is still getting served by the default server. (As opposed to getting permission denied.) In /etc/apache2.conf: <Directory /home/username/public_html/> Options FollowSymLinks AllowOverride None Require all granted </Directory> In /etc/apache2/sites-enabled (symlinked from sites-available) <VirtualHost *> DocumentRoot "/home/username/public_html/test" ServerName example.co.uk ServerAlias *.example.co.uk ErrorLog /home/username/logs/test.example.co.uk.error.log logFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %T" commontime CustomLog /home/username/logs/test.example.co.uk.access.log commontime <Directory "/home/username/public_html/test"> Options FollowSymlinks Require all granted </Directory> </VirtualHost> What stupid thing am I (not) doing? Ian