Question

Just wanted to know what could be the security cautions I should know about PHP Hosting?

Thanks

Answer 1

Here are some of the things:

• Disable functions like eval, passthru, shell_exec,etc
• Remote url injection, disable allow_url_fopen
• Disable register_globals

And don’t forget:

• You are responsible too. Write secure code, read security tutorials out there.

PHP Security Guide

Finally as suggested by Rook, you should run:

PHPSecInfo script to see security settings of your host.

http://phpsec.org/projects/phpsecinfo/

For webhosts and Development Teams

In development environments make sure you have appropriate coding standards. If you feel you are hosting insecure code which you did not write, consider installing a Web Application Firewall. Also consider steps to prevent bruteforce attacks (for example if you are hosting popular CMS tools), an Intrusion Prevention System like Fail2Ban can help you do this. A lot of these issues are covered in this talk Practical Web Security – Junade Ali, the video of the talk is here.

For PHP you can also consider using Suhosin which adds a number of security features to the PHP core. Be careful installing it first and test your sites afterwards to ensure it doesn’t break anything.