Why is Securing php.ini Important?

PHP is a widely used scripting language for web development. Its flexibility and ease of use also make it a frequent target for attackers. By configuring the php.ini file correctly, you can:

  • Prevent unauthorized access.
  • Minimize the risk of data breaches.
  • Enhance application stability and performance.

Key Security Enhancements for php.ini

1. Disable Dangerous Functions

PHP includes several functions that can be exploited for malicious purposes, such as executing system commands. Disabling these functions reduces attack surfaces.

disable_functions = exec, passthru, shell_exec, system, proc_open, popen, curl_exec, curl_multi_exec, parse_ini_file, show_source

2. Hide PHP Version Information

Revealing your PHP version through HTTP headers makes it easier for attackers to identify and exploit known vulnerabilities. To prevent this:

expose_php = Off

3. Disable Error Display in Production

Displaying errors in a production environment can reveal sensitive information to attackers. Instead, log errors for debugging purposes.

display_errors = Off
log_errors = On
error_log = /var/log/php_errors.log

SEO Tip: Include phrases like "PHP error logging best practices" and "secure PHP error handling."

4. Restrict File Uploads

File uploads can be a significant attack vector. Limit file upload sizes and designate a safe directory for temporary files.

file_uploads = On
upload_max_filesize = 2M
upload_tmp_dir = /var/www/uploads

5. Limit Resource Usage

Prevent denial-of-service (DoS) attacks by setting limits on memory usage, execution time, and input size.

memory_limit = 128M
max_execution_time = 30
max_input_time = 60
post_max_size = 8M
max_input_vars = 1000

6. Restrict Script Access with open_basedir

Prevent PHP scripts from accessing unauthorized directories by setting open_basedir.

open_basedir = /var/www/:/tmp/

7. Enhance Session Security

Sessions often contain sensitive user data. Protect them with secure configurations:

session.cookie_httponly = 1
session.cookie_secure = 1
session.use_strict_mode = 1
session.save_path = "/var/lib/php/sessions"
session.gc_maxlifetime = 1440
session.gc_probability = 1
session.gc_divisor = 100

8. Disable Remote Code Execution

Disabling allow_url_fopen and allow_url_include prevents attackers from executing remote code.

allow_url_fopen = Off
allow_url_include = Off

9. Restrict MIME Type Handling

Avoid improper handling of file uploads and executions by setting:

cgi.fix_pathinfo = 0

10. Disable Dynamic Loading of Extensions

Prevent dynamic extension loading to reduce the risk of exploitation.

enable_dl = Off

Additional Security Best Practices

Apply Principle of Least Privilege

Ensure the PHP process runs under a user with minimal permissions to limit the impact of potential exploits.

Keep PHP Updated

Regularly update PHP to patch known vulnerabilities.

Use a Web Application Firewall (WAF)

Deploy a WAF like ModSecurity to block common attack patterns.

Monitor PHP Logs

Regularly review PHP error and access logs to detect suspicious activity.

Separate Development and Production Configurations

Use distinct php.ini files for development and production environments to ensure security and performance.