WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture...
If your browser downloads a PHP file, the server may be delivering source code instead of executing it. Treat this as a potential security incident: temporarily restrict public access using a method that does not depend on PHP, and notify your server administrator or hosting provider.
Check whether the issue started after a PHP version change, a server configuration change or the deployment of new rules. The administrator should check how PHP files are assigned to a handler and whether the PHP service is working. Avoid applying configuration changes copied from elsewhere without checking them.
If files containing passwords or keys could have been downloaded, replace the affected credentials and review available logs. Restore public access after the issue has been fixed and tested.