> ## Documentation Index
> Fetch the complete documentation index at: https://kb.hosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Hardening PHP 7 and below using cPanel

> Learn how to harden PHP 7 and earlier versions to have better security. This article shows how to configure PHP 7 settings to help improve security.

PHP is the most widely used backend for most applications. If your application is still on PHP 7.0 or an earlier version, there are a few steps you can take to help harden your PHP to achieve better security. This article shows you steps to configure PHP settings to decrease security issues with PHP 7 and below.

## Checking the PHP version

To check the PHP version, follow these steps:

1. Log in to cPanel.
   > 📘 Note
   >
   > If you do not know how to log in to your cPanel account, please see [this article](/docs/accessing-cpanel).

2. On the **Tools** page, in the **Software** section, click **Select PHP Version**:\
   ![cPanel - Select PHP Version icon](https://static.hosting.com/kb/kb-cpanel-110-software-select-php-version.png)

   > 📘 Note
   >
   > If you do not see the **Select PHP Version** icon, your server does not support this feature.

3. cPanel displays the current PHP version.  Hosting.com supports several PHP versions, starting at 4.4 to 8.4:\
   ![](https://static.hosting.com/kb/kb-PHPhardening-15.png)

   > 👍 Tip
   >
   > To change the PHP version, in the **Current PHP Version** list box, select the version that you want to use. The new PHP version takes effect immediately.

## Configuring PHP settings to harden PHP

To help harden PHP for better security, follow the steps below to update the recommended PHP settings:

1. Click the **Options** tab to configure the PHP settings:\
   ![](https://static.hosting.com/kb/kb-PHPhardening-12.png)

2. cPanel displays the available options with default values. Any changes you make to the default values are automatically updated.

## Setting individual PHP options

### Remote connection settings

1. Remote content can be harmful at times, and it's best to set the configuration to allow fopen wrappers to only load local content. To allow fopen wrappers to only load local content and not open remote URLs, clear the **allow\_url\_fopen** and **allow\_url\_include** check boxes:\
   ![](https://static.hosting.com/kb/kb-PHPhardening-6.png)

### Script processing time

1. A well written PHP script should only take about a maximum of 30 seconds to run. We recommend setting both **max\_input\_time** and **max\_execution\_time** parameters to 30 seconds. Change both the default **max\_input\_time** from -1 second and **max\_execution\_time** from 300 seconds to 30 seconds: **Default setting**:\
   ![](https://static.hosting.com/kb/kb-PHPhardening-17.png)![](https://static.hosting.com/kb/kb-PHPhardening-9.png)

**Recommended setting**:\
![](https://static.hosting.com/kb/kb-PHPhardening-18.png)![](https://static.hosting.com/kb/kb-PHPhardening-13.png)

### Memory settings

1. In the **memory\_limit** list box, change the default memory limit from 768M to a lower memory limit. This limits the memory usage by any running scripts:\
   ![](https://static.hosting.com/kb/kb-PHPhardening-19.png)

### PHP exposure

1. To change the default PHP version exposure clear the **expose\_php** check box:

**Default setting**:\
![](https://static.hosting.com/kb/kb-PHPhardening-5.png)

**Recommended setting**:\
![](https://static.hosting.com/kb/kb-PHPhardening-1.png)

### Error handling

1. Error messages often contain information about the server and application, which is helpful for debugging, but also to hackers. We recommend not displaying any errors to end users in production code, and instead logging them for further troubleshooting. To harden error handling settings, do the following:

* Clear the **display\_errors** check box.

* Set a path for the **error\_log** setting and select the log\_errors check box.

* (Optional) Change the **error\_reporting** level.![](https://static.hosting.com/kb/kb-PHPhardening-16.png)

### File uploads

1. If your application does not use file uploads, clear the **file\_uploads** check box. Otherwise, to allow file uploads, select the **file\_uploads** check box:\
   ![](https://static.hosting.com/kb/kb-PHPhardening-4.png)

2. To set the maximum upload file size, in the **upload\_max\_filesize** list box select the maximum allowed size:\
   ![](https://static.hosting.com/kb/kb-PHPhardening-2.png)

## Related articles

* [‘Allowed memory size exhausted’ error message in PHP](/docs/allowed-memory-size-exhausted-error-message-in-php)

* [Changing PHP settings and versions](/docs/changing-php-settings-and-versions)

* [Changing PHP versions and settings using PHP Selector](/docs/changing-php-versions-and-settings-in-cpanel)

* [Common issues after PHP upgrade](/docs/common-issues-after-php-upgrade)