phpinfo.php Security Guide: Risks, Best Practices, and Server Hardening

The phpinfo.php file is one of the most widely recognized diagnostic tools used by PHP developers and system administrators. Executing the phpinfo() function generates a comprehensive HTML status page disclosing internal PHP configuration directives, active modules, system paths, memory limits, and server environment variables. However, while phpinfo() is invaluable during local development and server troubleshooting, leaving this diagnostic file publicly accessible on a live production server presents a severe security risk classified as Information Disclosure (CWE-200).

In cybersecurity, reconnaissance and information gathering represent the initial phase of any targeted attack. A publicly exposed phpinfo.php file provides malicious actors with an exact technical blueprint (fingerprint) of your server environment without requiring them to launch active exploitation attempts. This guide explores the critical security risks associated with phpinfo.php, details the sensitive data leaked by the file, and provides actionable steps to safely remove, disable, and harden your PHP server environment.

Comprehensive Breakdown of 15 Sensitive Security Directives Disclosed by phpinfo.php

When executed, phpinfo() outputs hundreds of environment parameters. Among the most dangerous directives exposed to attackers are:

• Exact PHP and Web Server Versions: Discloses precise version numbers (e.g., PHP 7.4.12, Apache 2.4.41), allowing attackers to search CVE databases for known public exploits.
• Absolute System File Paths: Reveals full server file paths (e.g., /home/user/public_html), providing exact targets required for Local File Inclusion (LFI) and path traversal attacks.
• Disabled Functions Configuration (disable_functions): Displays disabled functions, informing attackers whether high-risk functions such as exec, system, or shell_exec are available for remote code execution.
• File Upload Directives & Temporary Paths: Discloses upload_tmp_dir, file_uploads, and upload_max_filesize, essential for executing race-condition file upload exploits.
• Remote File Inclusion Directives: Discloses the status of allow_url_fopen and allow_url_include, indicating RFI vulnerability potential.
• Environment Variables & Unencrypted Credentials: Displays $_ENV and $_SERVER arrays, which often contain database passwords, API tokens, and secret keys.
• Session Storage Settings: Exposes session.save_path, enabling attackers to target session fixation and hijack flaws.
• Error Logging & Display Directives: Shows whether display_errors is active, revealing whether debug stack traces are output to site visitors.
• Memory Limits & Max Execution Time: Exposes memory_limit and max_execution_time, assisting attackers in crafting targeted Denial of Service (DoS) payloads.
• Open Basedir Restrictions: Discloses open_basedir settings, revealing filesystem isolation boundaries.
• Loaded Extension Modules: Lists installed extensions such as OpenSSL, cURL, Imagick, IonCube, and OPcache.

Real-World Attack Scenarios Leveraging phpinfo.php

Attacker groups frequently automate the discovery of exposed diagnostic files using automated scanning scripts and specialized search engine queries known as Google Dorks (e.g., inurl:phpinfo.php or filetype:php "PHP Version"). Once identified, attackers utilize the disclosed information to craft tailored exploit payloads.

For instance, in complex Local File Inclusion (LFI) exploitation chains, attackers upload temporary files while simultaneously querying phpinfo() to extract temporary file names and memory addresses, successfully converting a minor file inclusion flaw into full Remote Code Execution (RCE) on the underlying server.

Step-by-Step Guide to Disabling and Hardening phpinfo.php

To eliminate the security risks posed by phpinfo.php, follow these essential hardening steps:

1. Deleting Diagnostic Files via File Manager or SSH CLI

Access your hosting control panel (cPanel) File Manager, navigate to the public_html directory, and permanently delete any files named phpinfo.php, info.php, or test.php. If you have SSH access to your server, execute the following command to find and remove all exposed info files across user accounts:

find /home/*/public_html -type f -name "*info*.php" -delete

2. Disabling the phpinfo Function in php.ini

Deleting individual files does not prevent developers from re-uploading them in the future. The most effective defense is disabling the function server-wide in your primary php.ini configuration file or via cPanel MultiPHP INI Editor by updating the disable_functions directive:

disable_functions = phpinfo, exec, system, shell_exec, passthru, popen, proc_open

3. Blocking Access via .htaccess or Nginx Configuration

Add rewrite rules in your root .htaccess file to deny public HTTP access to any diagnostic script matching info patterns:

<FilesMatch "(phpinfo|info|test)\.php$">
Order Allow,Deny
Deny from all
</FilesMatch>

4. Web Application Firewall (WAF) & Cron Automation

Configure ModSecurity rules or Cloudflare WAF custom rules to block HTTP requests targeting phpinfo.php. Additionally, schedule an automated daily Cron job to scan customer directories and automatically purge newly created diagnostic scripts.

Securing Your PHP Hosting Environment and Server Infrastructure

Remediating diagnostic files is part of a larger server hardening strategy. Discover VavaHost managed cloud hosting solutions featuring isolated CloudLinux LVE environments, LiteSpeed web server technology, and automated malware scanning to protect your web applications.

For comprehensive instructions on securing administration dashboards, read our guide to securing WordPress admin login and dashboard access.

Separating Development and Production Server Configurations

Enforce a strict separation between local development environments (where phpinfo() is safe for debugging) and production servers. In production, ensure display_errors = Off and expose_php = Off are configured in php.ini to prevent PHP version headers from being broadcast in HTTP response headers.

Enforcing Encrypted SSL Connections

Protect server traffic and administrator credentials by enforcing HTTPS encryption across all web traffic. Read our complete guide to SSL certificates and web encryption from VavaHost.

In summary, removing and disabling phpinfo.php is a fundamental security requirement that deprives attackers of server intelligence, significantly hardening your web application against automated attacks.

Deep Dive into Critical Security Directives and Exploitation Vectors

Understanding how specific PHP directives interact is essential for comprehensive server hardening. For example, the open_basedir directive restricts the file paths PHP scripts are permitted to access. If phpinfo() reveals that open_basedir is unconfigured, attackers exploiting a Local File Inclusion (LFI) flaw can freely read system files such as /etc/passwd or database configuration files containing unencrypted master passwords.

Similarly, exposing session.save_path allows malicious users on shared hosting servers to inspect session storage directories, hijack administrator session cookies, and bypass login authentication mechanisms altogether.

Configuring ModSecurity Rules and Web Application Firewall (WAF) Protections

Deploying Web Application Firewall (WAF) rules serves as a robust perimeter defense against automated reconnaissance scanners. Custom ModSecurity directives analyze incoming HTTP request URIs and query parameters, instantly blocking attempts targeting diagnostic files like phpinfo.php with a HTTP 403 Forbidden response.

Additionally, enforcing IP rate-limiting rules within Nginx or LiteSpeed web servers prevents automated botnets from brute-forcing file paths or consuming server memory during vulnerability discovery scans.