No, look at the associated unit test: https://github.com/caddyserver/caddy/blob/c6eb186064091c79f46d03fd0fc5c233c686566f/modules/caddyhttp/matchers_test.go#L432

No, look at the associated unit test: https://github.com/caddyserver/caddy/blob/c6eb186064091c79f46d03fd0fc5c233c686566f/modules/caddyhttp/matchers_test.go#L432-L449 https://github.com/caddyserver/caddy/blob/c6eb186064091c79f4... If that test fails we could serve PHP source code instead of having it be evaluated, a potential security flaw.