Question: I realize there are similar posts to this out there, but rest assured, this isn't a duplicate post!

I have a site on a godaddy server. I DO NOT have access to the outside of the root of my server (everything is public).

I have a file delete.php that needs to run on CRON, and only by CRON. The file should not execute manually at all by anyone for any reason.

Given the above, I am trying to secure my file as much as possible so let'smake this an experiment in security.

So far, I have the following with the goal of making the file as secure as possible:

```
<?php
$isCLI = ( php_sapi_name() == 'cli' );

if (!$isCLI) {
    die("cannot run!");
} else {
    if(!isset($_SERVER['REQUEST_METHOD'])){
        // Do the task here
    }else{
        die("cannot run!");
    }
}
?>

```

So, is this logically secure? How can it be made even more secure? godaddy can only allow me to set a date/time to run a file, nothing more.

Answer: 
Checking for the `cli` SAPI is sufficient; a user executing it via apache (be it mod\_php or fastcgi or cgi) will never cause PHP to be called through the CLI sapi. You can get rid of the ugly `else {}` around your real code though; if you `exit;` at the end of the *then* block there is no need for an *else* block.

However, not putting that kind of script in the document root at all would be much cleaner. If that's not possible, also consider using `.htaccess`:

```
Order deny,allow
Deny from all

```

If the files are in a folder which shouldn't be locked down completely, wrap those lines in `<Files whatever.php>...</Files>`
Of course, placing those files outside the webroot would be the preferred way of doing it.
On the other hand, you could create `.htaccess` which defines `Deny all` rule for all access. This way `Deny all` prevents direct server access but PHP CLI would still be able to access it.