Securing Virtualmin: http://servernetworktech.com/2012/11/securing-php-when-using-virtualmin/

http://stackoverflow.com/questions/8875453/how-to-allow-people-to-download-php-files-without-the-code-being-interpreted

• Make your site more secure
• Block execution of PHP in a folder
• Allow the download or display of .php files
• Uses simple .htaccess file

Depending on the server configuration you need a .htaccess with:

# for mod_php
php_value engine off

Or:

# for CGI setups
Options -ExecCGI

Or:

# for FastCGI this depends on the name of the handler script
RemoveHandler .php
#RemoveHandler php5-fastcgi .php

And sometimes even a brute-force method:

<FilesMatch "[.]php\d?$">
   ForceType text/php
   SetHandler default-handler
</FilesMatch>

Search for PHP handlers in the web server configuration:

grep -ri handler /etc/httpd | grep php