🛡️ cPanel + CloudLinux 9.5: PHP Hardening & Optimization Guide

A secure and optimized PHP environment is crucial for performance, stability, and protection in shared hosting. This guide provides a structured reference for hardening and tuning PHP on CloudLinux 9.5 with cPanel, leveraging PHP Selector and CageFS.

---

📁 File Path

Global PHP settings and hardening configurations can be controlled via:

/etc/cl.selector/php.conf

---

⚙️ Important Commands

Run these after modifying PHP settings to ensure changes are propagated:

cagefsctl --rebuild-alt-php-ini
cagefsctl --force-update
cagefsctl -M

---

🔐 Security-Related Directives

Directive	Default	Recommended	Notes
allow_url_fopen	Off	✅ Off	Prevents remote file inclusion.
allow_url_include	Off	✅ Off	Major security risk if enabled.
register_globals	Off	✅ Off	Deprecated—ensure it’s off.
magic_quotes_gpc	On	❌ Off	Deprecated since PHP 5.4.
safe_mode	Off	✅ Off	Removed as of PHP 5.4—keep disabled.
expose_php	Off	✅ Off	Hides PHP version in HTTP headers.
open_basedir	–	✅ Set path	Restrict file access per domain/account.

---

📊 Performance & Error Handling

Directive	Default	Recommended	Notes
display_errors	On	❌ Off in production	Prevents error output leakage to users.
error_reporting	E_ALL & ~E_NOTICE	✅	Avoid notices, log warnings & criticals.
log_errors	Off	✅ On	Always log errors instead of showing.
output_buffering	On	✅ On	Enhances performance, especially for CMS.
zlib.output_compression	Off	✅ On (optional)	Compress output; monitor compatibility.

---

📬 Uploads & Mail

Directive	Default	Recommended	Notes
file_uploads	On	✅ On	Required by most PHP applications.
upload_max_filesize	1G	✅ As needed	Set per-app; don’t set too high unnecessarily.
post_max_size	1G	> upload size	Must exceed upload_max_filesize.
memory_limit	256M	512M–1G	Depends on workload: WordPress, Magento, etc.
mail.force_extra_parameters	–	Optional	Use for customized sendmail paths or envelopes.

---

🕒 Timezone & Sessions

Directive	Default	Recommended	Notes
date.timezone	Europe/London	Match region	Use regional zone (e.g., Europe/London) for consistency.
session.save_path	/tmp	Set per account	Use CageFS paths for isolation and security.

---

🛠️ Path & Compatibility Settings

Directive	Default	Recommended	Notes
include_path	.;/path/to/php/pear	Customize	Required for PEAR or PHP Composer environments.
short_open_tag	On	❌ Off (if possible)	Encouraged to use full <?php tag in modern code.
mysql.allow_persistent	On	⚠️ With care	Monitor memory and performance with persistent connections.

---

🧼 Clean-Up Notes

• Remove or ignore deprecated settings if running PHP 5.4 or higher.
• Ensure your configuration supports all enabled applications.
• Always test on a staging environment before production deployment.

---

✅ Final Recommendations

• Use WHM → MultiPHP INI Editor or CloudLinux PHP Selector for per-version/per-user PHP settings.
• After making changes: cagefsctl --rebuild-alt-php-ini cagefsctl --force-update cagefsctl -M
• Audit PHP runtime behavior and module usage with: php -i php -m php -v