Secure a PHP web app by keeping its runtime and dependencies supported, enforcing access controls on the server, separating untrusted data from code, and protecting sessions and operational data. These eight practices synthesize current PHP and OWASP guidance; adapt them to your PHP version, framework, deployment, and threat model.
1. Keep PHP and its dependencies supported
A PHP branch that has passed its upstream security-support period no longer receives upstream security fixes. Plan upgrades before that date, and check the PHP supported versions page because branch status changes. The PHP Group’s table, checked September 30, 2026, listed these branches and security-support end dates:
| PHP branch | Upstream security support ends |
|---|---|
| 8.2 | December 31, 2026 |
| 8.3 | December 31, 2027 |
| 8.4 | December 31, 2028 |
| 8.5 | December 31, 2029 |
These dates describe upstream security support, not a guarantee that a hosting provider or framework supports every branch for the same period. Check compatibility across the app, extensions, framework, and deployment before upgrading. Track third-party dependencies as well: an unsupported library can leave a vulnerability in place even when PHP itself is current.
2. Harden production configuration and error handling
Production settings should avoid exposing diagnostic details to visitors while retaining information for operators. OWASP’s PHP Configuration guidance recommends turning off displayed errors and enabling error logging:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
#1 Best Overall
- Set
display_errors=Offin production so stack traces, file paths, and other internals are not sent in responses. - Set
log_errors=Onand ensure logs are stored where authorized operators can access them. - Review deployment-specific PHP settings, including upload limits, filesystem paths, and other values that affect the application’s exposure.
These are starting points, not a complete drop-in php.ini. Choose paths, limits, and other settings for the actual deployment, and verify the production configuration rather than assuming development defaults are safe.
3. Protect authentication and password handling
Use a maintained framework or authentication implementation rather than building login and account recovery from scratch. Require reauthentication before sensitive account changes, and send credentials only over TLS. OWASP’s TLS guidance emphasizes protecting the full login and authenticated experience, not just the initial sign-in request.
Never store plaintext passwords or write them to logs. Use PHP’s current password-hashing API to store password hashes and verify them during login; consult current password-storage guidance for algorithm and parameter choices rather than copying fixed values from an old example. Treat password reset, recovery, and account-change flows as part of authentication security, not as secondary features.
Rank #2
4. Check authorization on every resource and action
Authentication establishes who a user is; authorization determines whether that user may perform a particular action on a particular resource. Check permissions on the server for each request. A hidden button or client-side route restriction can improve interface behavior, but it does not prevent a user from calling an endpoint directly.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsFor records tied to an account, verify ownership or another explicit access rule when loading or changing the record. Do not assume that an authenticated user may access an object simply because its identifier is known. OWASP’s Authorization guidance stresses that a logged-in user may still lack permission for a specific action or resource.
5. Validate untrusted input early and encode output for its context
OWASP recommends validating input as early as possible, preferably when it enters the system. Apply checks to every untrusted source, including API requests, imported data, and browser forms. Check both:
- Syntax: whether a value has the expected form, such as a properly formatted date or number.
- Semantics: whether it makes sense in the application, such as a date within an allowed range or a quantity consistent with business rules.
Validation reduces malformed input and can limit the effect of some attacks, but it is not a substitute for defenses against SQL injection or cross-site scripting. Use parameterized queries for database values, and encode output for the context where it is rendered, such as HTML text or an HTML attribute. A single “sanitize everything” filter cannot safely handle every output context.
6. Use parameterized SQL instead of building queries from input
Define SQL separately from user-supplied values, then pass values as bound parameters through prepared statements. OWASP identifies parameterized queries as a primary SQL injection defense. Do not concatenate request data into a query or rely on generic escaping as the main protection.
Bound parameters represent values, not SQL syntax. If the query must vary by a sort column or other identifier, choose from a fixed allowlist of permitted identifiers rather than accepting an arbitrary string. Give the application’s database account only the privileges it needs; least privilege limits damage if another layer fails.
Rank #4
7. Defend state-changing requests against CSRF and manage sessions securely
Use your framework’s built-in cross-site request forgery (CSRF) protection, or require a server-validated token on every state-changing request. SameSite cookies provide defense in depth, but SameSite alone is not a general replacement for CSRF-token validation.
Protect session identifiers throughout their lifecycle:
- Keep authenticated sessions on HTTPS for their full lifetime.
- Set session cookies with
SecureandHttpOnly; chooseSameSitedeliberately for the application’s cross-site needs. - Use cookie-only session exchange and strict session mode where appropriate, following the framework and deployment’s configuration guidance.
- Regenerate the session identifier after authentication or a privilege change, and invalidate the server-side session on logout.
- Never put session identifiers in URLs.
Cookie scope, lifetime, and related settings depend on the deployment; example settings should not be copied without checking their effect on the application.
Free tools Windows power users keep installed
One-click scans. No signup required.
8. Log security events and deploy response headers carefully
Record events that help operators detect and investigate problems, such as authentication outcomes, authorization failures, and session-management failures. Restrict access to logs and avoid recording passwords, raw session IDs, or other secrets; logs can otherwise become a second source of credential exposure.
Use security headers with a deployment plan. Enable HTTP Strict Transport Security (HSTS) only after HTTPS works across the intended domain and subdomains. A long HSTS policy can make a misconfigured site unreachable until that policy expires. A Content Security Policy (CSP) can reduce the impact of some cross-site scripting and data-injection attacks, but it must fit the scripts and other resources each page needs. Test a policy against the application before relying on it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
