在虚拟主机的配置文件里面，给html directory直接include，另外一个是files文件的保护，如下：
<Directory "/var/www/html">
Options Indexes FollowSymLinks
AllowOverride none
Order allow,deny
Allow from all
# For Drupal, the rules in .htaccess are included here.
RewriteEngine on
RewriteBase /
Include /var/www/html/.htaccess
</Directory>
# Enforce new security rules from SA-CORE-2013-003.
<Directory "/var/www/html/sites/*/files">
# Turn off all options we don't need.
Options None
Options +FollowSymLinks
# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
# Override the handler again if we're run later in the evaluation list.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>
# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
php_flag engine off
</IfModule>
</Directory>
