A lightweight PHP script that checks your PHP configuration for potential security vulnerabilities to help secure your PHP environment.
PHP Secure Configuration Checker
This tool is designed for PHP developers, system administrators, and security professionals who want to quickly assess the security posture of their PHP configuration (php.ini). It is useful for identifying insecure PHP settings and ensuring best practices are followed to reduce attack surfaces in web applications.
This tool only assesses PHP configuration security and does not guarantee overall application security. It is recommended to restrict web access to the script using IP whitelisting or SSH port forwarding. The script disables itself in web mode after two days by default to reduce exposure, which can be overridden if needed. Some PHP functions must be enabled for accurate checks, so ensure ini_get() and stat() are not disabled. The tool is designed to be simple and transparent, making it suitable even for novices.
Copy the phpconfigcheck.php script to any directory accessible by your webserver (e.g., document root)
Alternatively, run the script directly via CLI using your PHP interpreterphp phpconfigcheck.php
Run the configuration check from the command line with default output
php phpconfigcheck.php -a
Run the check and show hidden results as well
php phpconfigcheck.php -h
Output results in HTML format from CLI
php phpconfigcheck.php -j
Output results in JSON format from CLI
Access phpconfigcheck.php via web browser
Run the check through a webserver with HTML output by default
phpconfigcheck.php?showall=1
Show all test results including skipped, ok, and unknown in web mode
phpconfigcheck.php?format=text|html|json
Specify output format explicitly in web mode (text, HTML, or JSON)
Set environment variable PCC_OUTPUT_TYPE=text|json
Change default output format in web mode via environment variable
Set environment variable PCC_DISABLE_MTIME=1
Disable the built-in two-day expiry safeguard for web mode
Set environment variable PCC_ALLOW_IP=<IP or pattern>
Allow non-localhost IP addresses to access the web interface