Ravindra BagaleCourses & study guides

9. PHP, LAMP and LEMP Step by Step

9.8 Secure PHP Settings

By Last updated:

PHP chalu zala – aata php.ini madhe kahi mahatvache badal. File cha path php --ini ne kalto (Amazon Linux: /etc/php.ini, Ubuntu: /etc/php/8.x/fpm/php.ini kiwa /etc/php/8.x/apache2/php.ini).

Setting Secure value Why
expose_php Off Hides the X-​Powered-​By: PHP/​8.​x header
display_errors Off Errors with paths and SQL must not reach visitors
log_errors On Errors go to the log instead
allow_url_include Off Blocks remote file inclusion
upload_​max_​filesize / post_max_size As small as the app needs Limits abuse of uploads
session.​cookie_​httponly 1 JavaScript cannot read the session cookie (limits XSS damage)
session.​cookie_​secure 1 (with HTTPS) Cookie only sent over HTTPS 
php --ini | grep "Loaded Configuration"
sudo sed -i 's/^expose_php = On/expose_php = Off/' /etc/php.ini              # Amazon Linux
sudo sed -i 's/^display_errors = On/display_errors = Off/' /etc/php.ini
sudo service php-fpm restart                                                 # Ubuntu: php8.3-fpm
curl -I http://localhost/index.php | grep -i x-powered-by                    # should print nothing

Why this matters for security

Verbose PHP errors are a gift for attackers: a single SQL error message can reveal the table name and query structure, making SQL injection much easier (error-based SQLi). Production servers log errors; they never display them.

Ravindra Bagale's Tip

display_errors = On was left on in development and went to production as it was – this happens in many projects. Keep this line in your deploy checklist: "display_errors Off, expose_php Off, info.php deleted". Very simple, but very important.

Practice task

Apply the settings from the table on one server, restart PHP-FPM, and confirm with curl -I that the X-Powered-By header is gone.

Thodkyaat sangaycha tar

  • Dynamic = server runs code (PHP) and queries a database for each request.
  • Apache runs PHP via mod_php or PHP-FPM; Nginx always via PHP-FPM (FastCGI socket).
  • LAMP = Linux + Apache + MySQL/MariaDB + PHP; LEMP = same with Nginx.
  • Amazon Linux: yum, httpd, mariadb105-server, php-fpm. Ubuntu: apt, apache2, mysql-server, libapache2-mod-php or php-fpm.
  • 502 = PHP-FPM not running or wrong socket. Delete info.php after testing.
  • Prepared statements stop SQL injection; htmlspecialchars() stops XSS; display_errors Off in production.

Samjla ka? Stack tayar – aata database khol shikuya. Aata pudhe jaauya MySQL kade!