PHP.INI Security Settings

The main PHP configuration file, php.ini, contains editable directives that can be adjusted to improve the basic security of PHP applications hosted on Apache or NGINX PHP servers.

In this article

Open php.ini
Disable insecure functions
Limit resource usage
Restrict optional PHP features
Enable security-related logging
Safe-mode settings
Expected result

Review application compatibility first

The values below are recommendations from the source documentation. Test them against the application requirements before applying them because restrictive settings can break application features or reduce performance.

Open php.ini

Open Configuration Manager

Click Config beside the Apache or NGINX PHP application server.

Open the PHP configuration file

Navigate to the etc directory and open php.ini.

Open the php.ini configuration file — Open php.ini from the application-server Configuration Manager.

Disable Insecure Functions

The source documentation first recommends disabling a small group of functions:

disable_functions = phpinfo, system, mail, exec

For stricter protection, it provides this extended list:

disable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source

Disable insecure PHP functions — Add the required disable_functions directive to php.ini.

Do not combine blindly

Choose the function list appropriate for the application. For example, disabling mail, cURL functions, process functions, or configuration-file parsing can prevent legitimate application operations.

Limit Resource Usage

When acceptable for the application, use limits to reduce the impact of long-running scripts, oversized requests, and excessive memory consumption.

Directive	Source Recommendation	Purpose
`max_execution_time`	`30`	Maximum script execution time in seconds.
`max_input_time`	`60`	Maximum time allowed for parsing request data.
`upload_max_filesize`	`2M`	Maximum permitted uploaded-file size.
`memory_limit`	`8M`	Maximum memory available to one script. The source notes a default value of 128M and recommends lowering it only when application performance is not affected.
`post_max_size`	`8M`	Maximum size of POST data accepted by PHP.

max_execution_time = 30
max_input_time = 60
upload_max_filesize = 2M
memory_limit = 8M
post_max_size = 8M

Restrict Optional PHP Features

The following features can be disabled when the application does not require them:

Directive	Recommended Value	Effect
`file_uploads`	`Off`	Disables HTTP file uploads.
`display_errors`	`Off`	Prevents PHP error details from being shown to end users.
`safe_mode_allowed_env_vars`	`PHP_`	Limits external access to environment variables according to the documented safe-mode configuration.
`expose_php`	`Off`	Prevents PHP version information from being exposed in responses.
`register_globals`	`Off`	Disables automatic registration of input data as global variables.
`allow_url_fopen`	`Off`	Disables opening remote files through URL-aware file functions.

file_uploads = Off
display_errors = Off
safe_mode_allowed_env_vars = PHP_
expose_php = Off
register_globals = Off
allow_url_fopen = Off

Legacy directives

The source page includes safe_mode_allowed_env_vars and register_globals, which belong to older PHP configurations. Preserve them only when working with a compatible legacy PHP stack.

Enable Security-Related Logging

The source documentation recommends the following settings to improve visibility into PHP errors and redirect behaviour:

cgi.force_redirect = 0
log_errors = On

cgi.force_redirect controls PHP CGI redirect checks.
log_errors records PHP errors instead of relying only on browser output.

Safe-Mode Settings

The source page also lists these safe-mode options:

safe_mode = On
sql.safe_mode = On

Applicable only to legacy PHP

These directives reflect historical PHP versions and may not exist in a modern PHP runtime. Use them only when the installed PHP version supports them.

Expected Result

The PHP application server uses stricter function access, request and resource limits, reduced information exposure, controlled optional features, and enabled error logging according to the selected application-compatible directives.

Important Notes

Back up php.ini before applying security changes.
Test every directive against the application’s required functions and workloads.
Do not display PHP errors to production users; review them through logs.
Keep post_max_size large enough for the configured upload limit and application forms.
Some source directives are legacy and may be ignored or rejected by modern PHP versions.
Restart or reload the PHP application server when required after saving the configuration.

Common Issues and Solutions

Issue	Solution
Application feature stops working	Review `disable_functions` and re-enable the function required by the application.
File uploads fail	Check `file_uploads`, `upload_max_filesize`, and `post_max_size`.
Long-running request is terminated	Increase `max_execution_time` or `max_input_time` only as required.
Script runs out of memory	Increase `memory_limit` to a value suitable for the application workload.
Directive is reported as unknown	Confirm whether it is a legacy setting removed from the installed PHP version.
Errors are not visible	Keep `display_errors` disabled in production and inspect the configured PHP error log.

What’s Next?

PHP Application Server Configuration