Server Management > Security > PHP Settings

This page allows you to configure security and performance related settings of PHP. These changes are applied to your php.ini config file of PHP. Please keep in mind that PHP is very powerful and can often be used to exploit a server. Hence we configure it in a very restrictive and secure fashion. You can loosen these restrictions on a per site basis in the Site Management PHP settings of an individual virtual site.

Settings that are controlled here will modify the server-wide PHP settings, as reflected in the server's php.ini file, which can be reviewed by clicking on the Review php.ini tab.

• PHP Version: Shows the version of PHP of the public web server.
• PHP versions available for virtual sites: If extra PHP versions are installed (BlueOnyx Shop packages under /home/solarspeed/php-x.y/), this dual list selects which versions Vsites may use. Move a version to the right to disable it. Vsites still using a disabled version are reverted to the OS PHP, and the version is no longer offered when creating sites.
• Default PHP Version: If extra PHP versions are installed, you can make one of them the default for Apache DSO / mod_ruid2 instead of the OS PHP.
• Location: This shows where your php.ini file is located.
• Enable IonCube Loader: Dual list of PHP versions that have a matching ionCube NTS loader (/home/solarspeed/ioncube/ioncube_loader_lin_x.y.so). Versions without a loader (for example PHP 8.0) are not listed. Left = loader enabled, right = disabled. Default is enabled whenever a loader exists. This is per PHP version (OS PHP and extra PHP), not per Vsite: every site using that PHP version shares the same loader. Saving writes ioncube.ini (or /etc/php.d/00-ioncube.ini for OS PHP) and restarts the corresponding PHP-FPM. Disabled INIs keep a comment plus a commented zend_extension line so the file can be turned back on. Only disable ionCube if no encoded plugins (older Shopware 5, WHMCS, etc.) run on that PHP version. Shopware 6 typically does not need ionCube.
• Register Globals: For maximum security you must set “register_globals” to “Off”. Otherwise it is easily possible that unsecurely programmed PHP scripts can be used to hack your server.
• Open Basedir (Server): The open_basedir directive limits the file access of PHP scripts to certain directories. Global (ie: all virtual sites) have access to the directories specified here. If you wish to grant the PHP scripts of virtual sites access to additional directories, then you can specify those here. When the file is outside the specified directory-tree, PHP will refuse to open it. Note that individual vsites can be granted additional access in their site-specific PHP settings.
• Disable Functions: This directive allows you to disable certain functions for security reasons. It takes on a comma-delimited list of function names. disable_functions is not affected by Safe Mode.
• Disable Classes: This directive allows you to disable certain classes for security reasons. It takes on a comma-delimited list of class names. disable_classes is not affected by Safe Mode.
• Allow URL fopen: Off by default. If enabled, allow_url_fopen allows PHP's file functions - such as file_get_contents() and the include and require statements - can retrieve data from remote locations, like an FTP or web site. Programmers frequently forget this and don't do proper input filtering when passing user-provided data to these functions, opening them up to code injection vulnerabilities. A large number of code injection vulnerabilities and hacks reported in PHP-based web applications are caused by the combination of enabling allow_url_fopen and bad input filtering.
• Allow URL include: If disabled, allow_url_include bars remote file access via the include and require statements, but leaves it available for other file functions like fopen() and file_get_contents. Please note: include and require are the most common attack points for code injection attempts, so this setting plugs that particular hole without affecting the remote file access capabilities of the standard file functions. By default, allow_url_include is disabled.
• Upload Max Filesize: upload_max_filesize limits the maximum size of files that PHP will accept through uploads. Attackers may attempt to send grossly oversized files to exhaust your system resources; by setting a realistic value here you can mitigate some of the damage by those attacks. By default, PHP sets this value to 2MB.
• Post Max Size: This protection allows you to limit the maximum size POST request that PHP will process. Attackers may attempt to send grossly oversized POST requests to exhaust your system resources; by setting a realistic value here you can mitigate some of the damage by those attacks.
• Max execution time: Maximum amount of time each script may run.
• Max input time: Maximum amount of time each script may spend parsing request data.
• Memory limit: Defines how much memory a script may use. Settings this to a high value leaves the server vulnerable to attacks that attempt to exhaust resources and creates an environment where poor programming practices can propagate unchecked.