Skip to content

PHP Configuration Cheat Sheet / PHP 配置速查表

Introduction / 介绍

This page is meant to help those configuring PHP and the web server it is running on to be very secure.

本页面旨在帮助配置 PHP 及其运行在上的 Web 服务器的人员确保极高的安全性。

Below you will find information on the proper settings for the php.ini file and instructions on configuring Apache, Nginx, and Caddy web servers.

以下将提供关于 php.ini 文件正确设置的详细信息以及配置 Apache、Nginx 和 Caddy Web 服务器的说明。

For general PHP codebase security please refer to the two following great guides:

有关一般 PHP 代码库的安全性，请参考以下两个优秀的指南：

PHP Configuration and Deployment / PHP 配置和部署

php.ini

Some of following settings need to be adapted to your system, in particular session.save_path, session.cookie_path (e.g. /var/www/mysite), and session.cookie_domain (e.g. ExampleSite.com).

以下一些设置需要根据您的系统进行调整，特别是 session.save_path、session.cookie_path（例如 /var/www/mysite）和 session.cookie_domain（例如 ExampleSite.com）

Run a PHP branch that is listed on the official Supported Versions page and plan upgrades before its security-support end date. Distribution vendors may provide separate extended support, but that does not make the upstream PHP branch supported. Review the core php.ini directives in the PHP Manual for a complete reference on every value in the php.ini configuration file.

运行官方 支持版本 页面上列出的 PHP 分支，并在其安全支持结束日期之前规划升级。发行商可能提供单独的扩展支持，但这并不意味着上游 PHP 分支受到支持。在 PHP 手册中查看 核心 php.ini 指令，以获取 php.ini 配置文件中每个值的完整参考。

You can find a copy of the following values in a ready-to-go php.ini file here.

您可以在以下 现成的 php.ini 文件中找到这些值的副本。

PHP error handling / PHP 错误处理

expose_php              = Off
error_reporting         = E_ALL
display_errors          = Off
display_startup_errors  = Off
log_errors              = On
error_log               = /valid_path/PHP-logs/php_error.log
ignore_repeated_errors  = Off

Keep in mind that you need to have display_errors to Off on a production server and it's a good idea to frequently notice the logs.

请注意，在生产服务器上您需要将 display_errors 设置为 Off，并且经常查看日志是个好主意。

PHP general settings / PHP 通用设置

doc_root                = /path/DocumentRoot/PHP-scripts/
open_basedir            = /path/DocumentRoot/PHP-scripts/
include_path            = /path/PHP-pear/
extension_dir           = /path/PHP-extensions/
mime_magic.magicfile    = /path/PHP-magic.mime
allow_url_fopen         = Off
allow_url_include       = Off
variables_order         = "GPCS"
allow_webdav_methods    = Off
session.gc_maxlifetime  = 600

allow_url_* prevents LFIs to be easily escalated to RFIs.

allow_url_* 阻止 LFI 被轻易升级为 RFI。

PHP file upload handling / PHP 文件上传处理

file_uploads            = On
upload_tmp_dir          = /path/PHP-uploads/
upload_max_filesize     = 2M
max_file_uploads        = 2

If your application is not using file uploads, and say the only data the user will enter / upload is forms that do not require any document attachments, file_uploads should be turned Off.

如果您的应用程序不使用文件上传，并且用户仅输入/上传不需要任何文档附件的表单，则应将file_uploads设置为关闭。

PHP executable handling / PHP可执行文件处理

enable_dl               = Off
disable_functions       = system, exec, shell_exec, passthru, phpinfo, show_source, highlight_file, popen, proc_open, fopen_with_path, dbmopen, dbase_open, putenv, move_uploaded_file, chdir, mkdir, rmdir, chmod, rename, filepro, filepro_rowcount, filepro_retrieve, posix_mkfifo
disable_classes         =

These are dangerous PHP functions. You should disable all that you don't use.

这些是危险的PHP函数。您应该禁用所有未使用的函数。

PHP session handling / PHP会话处理

Session settings are some of the MOST important values to concentrate on in configuring. It is a good practice to change session.name to something new.

会话设置是在配置中需要重点关注的最重要的值之一。将session.name更改为新名称是一种良好的做法。

 session.save_path                = /path/PHP-session/
 session.name                     = myPHPSESSID
 session.auto_start               = Off
 session.use_trans_sid            = 0
 session.cookie_domain            = full.qualified.domain.name
 #session.cookie_path             = /application/path/
 session.use_strict_mode          = 1
 session.use_cookies              = 1
 session.use_only_cookies         = 1
 session.cookie_lifetime          = 14400 # 4 hours
 session.cookie_secure            = 1
 session.cookie_httponly          = 1
 session.cookie_samesite          = Strict
 session.cache_expire             = 30
 session.sid_length               = 256
 session.sid_bits_per_character   = 6

Some more security paranoid checks / 一些额外的安全偏执检查

session.referer_check   = /application/path
memory_limit            = 50M
post_max_size           = 20M
max_execution_time      = 60
report_memleaks         = On
html_errors             = Off
zend.exception_ignore_args = On

Snuffleupagus

Snuffleupagus is the spiritual descendent of Suhosin for PHP 7 and onwards, with modern features. It's considered stable, and is usable in production.

Suhosin的PHP 7及以后版本的后代，具有现代功能。它被认为是稳定的，并且可以在生产中使用。

References / 参考