phhttpd relies on the very simple, bordering on brain-dead, Unix permission system for deciding whether or not the server will serve a page to a client. If the server, running as whatever user started its process, can open and read a file that is under a virtual's docroot, it will serve that file.
This means extreme care should be taken when exporting document trees with phhttpd that used to be served by another web server. If the previous web server stored access information in the file-system, that will almost certainly be ignored by phhttpd. It could, in fact, be served to the client if they know to ask for it.
As an example, phhttpd will pay no attention whatsoever to .htaccess files, and will happily serve .htpasswd files if they are in the docroot and the client asks for them. Please do be careful to make sure that all the files under a docroot really are intended to be served.