DEV Community

Cover image for Basic PHP Settings for Secure, High-Performance Applications
Senthil Kumar MS
Senthil Kumar MS

Posted on Originally published at phpscientist.com on

Basic PHP Settings for Secure, High-Performance Applications

#phpini #phpsecurity #phpperformance #opcache

The most important PHP settings for a secure, fast production application are: display_errors off with logging on, expose_php off, OPcache enabled and tuned, secure session cookies (Secure, HttpOnly, SameSite and strict mode), realistic upload and runtime limits, a carefully tested list of disabled functions, and security headers set at the web server.

A secure PHP setup should reduce information leakage, protect session cookies, limit risky runtime behavior, and prevent avoidable exposure. A performance-focused setup should enable OPcache, reduce filesystem overhead, tune memory carefully, and avoid unnecessary runtime checks in production.

The settings below are practical production defaults for modern PHP applications. They should be adjusted based on your framework, hosting environment, workload, and deployment process.

Key takeaways

  • Never display errors in production; log them instead.
  • Enable OPcache, and reset it on every deployment if validate_timestamps is off.
  • Make session cookies Secure, HttpOnly and SameSite, with strict mode on.
  • Keep separate development and production configurations and manage them in your deployment pipeline.

Production PHP Configuration Checklist

AreaRecommended SettingPurposeError Displaydisplay\_errors = OffPrevents sensitive errors from appearing to usersError Logginglog\_errors = OnKeeps errors visible to developers through logsPHP Exposureexpose\_php = OffRemoves PHP version exposure from headersOPcacheopcache.enable = 1Improves performance by caching compiled bytecodeSession Securitysession.cookie\_secure = 1Sends session cookies only over HTTPSCookie Protectionsession.cookie\_httponly = 1Blocks JavaScript access to session cookiesSameSite Cookiessession.cookie\_samesite = Lax or StrictReduces CSRF exposureUpload Limitsupload\_max\_filesize, post\_max\_sizePrevents oversized request abuseExecution Timemax\_execution\_timeLimits long-running requestsMemory Limitmemory\_limitPrevents runaway memory usage

PHP documents the available php.ini directives and their changeability levels in its official ini directive list, while OWASP provides specific hardening recommendations for PHP configuration and session cookies.

1. Disable Error Display in Production

In production, PHP errors should never be shown directly in the browser. Error messages can reveal file paths, database details, environment information, framework internals, and application logic.

SettingProduction Valuedisplay\_errorsOffdisplay\_startup\_errorsOfflog\_errorsOnerror\_reportingE\_ALL

Recommended configuration:

display_errors = Off
display_startup_errors = Off
log_errors = On
error_reporting = E_ALL
Enter fullscreen mode Exit fullscreen mode

This keeps errors hidden from users while still sending them to logs for debugging and monitoring.

2. Hide PHP Version Information

By default, PHP can expose version information through HTTP headers. This is unnecessary in production and gives attackers extra fingerprinting information.

SettingRecommended Valueexpose\_phpOff

expose_php = Off
Enter fullscreen mode Exit fullscreen mode

This does not secure the application by itself, but it reduces avoidable information disclosure. OWASP’s PHP configuration guidance also recommends hardening PHP settings to reduce unnecessary exposure.

3. Enable and Tune OPcache

OPcache is one of the most important PHP performance settings. It stores compiled PHP bytecode in memory so PHP does not need to parse and compile scripts on every request. PHP’s OPcache documentation states that opcache.enable enables opcode caching and optimization.

Recommended production baseline:

opcache.enable = 1
opcache.memory_consumption = 256
opcache.interned_strings_buffer = 16
opcache.max_accelerated_files = 20000
opcache.validate_timestamps = 0
opcache.save_comments = 1
Enter fullscreen mode Exit fullscreen mode

OPcache SettingWhy It Mattersopcache.enableEnables bytecode cachingopcache.memory\_consumptionControls memory available for cached scriptsopcache.max\_accelerated\_filesSupports larger codebasesopcache.validate\_timestampsAvoids repeated file timestamp checks in controlled deploymentsopcache.save\_commentsKeeps annotations/doc comments required by many frameworks

For deployment workflows where code changes are released through CI/CD, opcache.validate\_timestamps = 0 can improve performance, but you must reset OPcache during deployment.

4. Secure PHP Session Cookies

Session cookies are a common attack target. A secure PHP application should make session cookies HTTPS-only, inaccessible to JavaScript, and protected with an appropriate SameSite policy.

Recommended session settings:

session.cookie_secure = 1
session.cookie_httponly = 1
session.cookie_samesite = Lax
session.use_strict_mode = 1
Enter fullscreen mode Exit fullscreen mode

SettingSecurity Benefitsession.cookie\_secure = 1Sends cookies only over HTTPSsession.cookie\_httponly = 1Prevents JavaScript from reading session cookiessession.cookie\_samesite = LaxHelps reduce CSRF risksession.use\_strict\_mode = 1Rejects uninitialized session IDs

OWASP explains that the Secure cookie attribute ensures browsers only send cookies over encrypted HTTPS connections, helping protect session IDs from network interception.

5. Control File Upload Limits

Unrestricted uploads can create security and performance issues. Keep file limits realistic for the application.

Example:

file_uploads = On
upload_max_filesize = 10M
post_max_size = 12M
max_file_uploads = 10
Enter fullscreen mode Exit fullscreen mode

SettingPurposeupload\_max\_filesizeLimits individual file sizepost\_max\_sizeLimits total request body sizemax\_file\_uploadsPrevents excessive file upload attemptsfile\_uploadsShould only be enabled if the application needs uploads

For applications that do not support uploads, disable them:

file_uploads = Off
Enter fullscreen mode Exit fullscreen mode

6. Set Safe Runtime Limits

Runtime limits protect the server from runaway scripts, heavy requests, and memory exhaustion.

Recommended baseline:

max_execution_time = 30
max_input_time = 60
memory_limit = 256M
max_input_vars = 3000
Enter fullscreen mode Exit fullscreen mode

SettingRecommended Starting Pointmax\_execution\_time30 secondsmax\_input\_time60 secondsmemory\_limit256Mmax\_input\_vars3000

These values should be tuned for your application. For example, ecommerce platforms, import tools, and admin dashboards may need higher limits, but public-facing endpoints should stay conservative.

7. Restrict Dangerous Functions Carefully

Some teams disable risky PHP functions to reduce attack impact. This must be handled carefully because some frameworks, queues, deployment tools, and image libraries may rely on specific functions.

Example:

disable_functions = exec,passthru,shell_exec,system,proc_open,popen
Enter fullscreen mode Exit fullscreen mode

Function TypeRiskShell execution functionsMay enable command execution if exploitedProcess control functionsCan create system-level riskUnused filesystem functionsCan increase impact of file-based attacks

Do not blindly copy a large disable\_functions list. Test the application first.

8. Use Secure HTTP Headers

Some security protections are configured at the web server or application layer rather than only inside PHP.

Recommended headers:

HeaderPurposeContent-Security-PolicyReduces XSS impactX-Frame-OptionsHelps prevent clickjackingX-Content-Type-OptionsPrevents MIME sniffingReferrer-PolicyControls referrer leakageStrict-Transport-SecurityEnforces HTTPS after first visit

OWASP’s HTTP Headers Cheat Sheet explains that proper security response headers can help reduce risks such as XSS, clickjacking, and information disclosure.

9. Production vs Development Settings

Use separate PHP configurations for development and production.

SettingDevelopmentProductiondisplay\_errorsOnOfflog\_errorsOnOnopcache.validate\_timestamps10 with deployment resetexpose\_phpOffOffsession.cookie\_secureDepends on local HTTPS1error\_reportingE\_ALLE\_ALL

Development should prioritize visibility. Production should prioritize security, stability, and performance.

10. Recommended Production php.ini Baseline 

; Error handling
display_errors = Off
display_startup_errors = Off
log_errors = On
error_reporting = E_ALL

; Information disclosure
expose_php = Off

; Resource limits
max_execution_time = 30
max_input_time = 60
memory_limit = 256M
max_input_vars = 3000

; Upload controls
file_uploads = On
upload_max_filesize = 10M
post_max_size = 12M
max_file_uploads = 10

; Session security
session.cookie_secure = 1
session.cookie_httponly = 1
session.cookie_samesite = Lax
session.use_strict_mode = 1

; OPcache performance
opcache.enable = 1
opcache.memory_consumption = 256
opcache.interned_strings_buffer = 16
opcache.max_accelerated_files = 20000
opcache.validate_timestamps = 0
opcache.save_comments = 1
Enter fullscreen mode Exit fullscreen mode

Final Thoughts

A secure and high-performing PHP application is not created only by writing clean code. It also depends on a well-tuned runtime environment.

At a minimum, production PHP applications should disable public error display, enable error logging, hide PHP version exposure, secure session cookies, enable OPcache, control uploads, set resource limits, and apply security headers.

The best results come from treating PHP configuration as part of the deployment pipeline, not a one-time server setup.

Originally published at phpscientist.com.

Top comments (0)