Is this because of security settings?

[cd34]

either mod_include isn't enabled and you have ssi parsing enabled (and an older version of apache), or, you are passing that page through a parser that isn't resetting the content type correctly (i.e. some other error preventing parsing, like permissions that prevent SSI parsing, etc)