Alyce Chronicle

phpinfophp

📅 October 29, 2026📖 Verified Publication
```html phpinfo.php – The Complete Playbook for Creating, Using & Securing It

phpinfo.php: The Complete Playbook for Creation, Interpretation & Secure Removal

Key Takeaways

  • phpinfo.php is a simple PHP script that outputs the full PHP configuration of your server, including version, compiled modules, environment variables, and server diagnostics.
  • The script requires only phpinfo(); — but understanding its output is what turns a beginner into a confident PHP administrator.
  • Never leave phpinfo.php on a production server. It exposes sensitive server details that attackers exploit for targeted exploits.
  • Always replace phpinfo.php with version-specific diagnostic constants or a self-destructing script once debugging is complete.
  • Use phpinfo.php responsibly: create it on staging first, verify settings, then remove it immediately from production.

What Is phpinfo.php and Why Does It Matter?

phpinfo.php is a PHP script that calls the built-in phpinfo() function, producing a detailed report of the active PHP configuration. It is one of the most widely used diagnostic tools in the PHP ecosystem — from developers troubleshooting extensions to sysadmins verifying server settings before deploying an application.

The output is organized into color-coded sections covering:

  • PHP version and build information
  • Server API and SAPI name
  • Loaded extensions and their versions
  • Configuration directives (both runtime and compiled-in)
  • Environment variables and paths
  • HTTP headers and mail configuration
  • License and copyright information

Whether you are setting up a local development environment, migrating a WordPress site, or auditing a compromised server, phpinfo.php is your first-stop diagnostic dashboard.

How to Create a phpinfo.php File

Step-by-Step Checklist

  • Create a new file named phpinfo.php using any plain-text editor.
  • Insert the following three lines:
<?php
// Diagnostic info — remove immediately after use
phpinfo();
?>
  • Upload the file to the document root of your web server (e.g., /var/www/html/ or public_html/).
  • Navigate to https://yourdomain.com/phpinfo.php in a browser.
  • Verify that PHP is processing the file (you should see a formatted HTML table, not raw source code).
  • If you see raw source code, PHP is not enabled for that directory — contact your hosting provider or configure the server handler.
  • Document any configuration values you need to reference later.
  • Remove the file immediately after you are done (see the Security section below).

Quick Verification Checklist

  • ☐ The page renders as styled HTML, not plain text
  • ☐ The PHP version displayed matches your expectations
  • ☐ All expected extensions (mysqli, gd, curl, etc.) appear under "Modules"
  • ☐ upload_max_filesize and post_max_size reflect your application requirements
  • ☐ display_errors is Off on production (or the value is noted for adjustment)
  • ☐ The file is deleted from the server

How to Interpret the phpinfo() Output

Understanding phpinfo output separates informed decisions from guesswork. Below is a breakdown of the most critical sections every developer and administrator should inspect.

Core Configuration Section

  • PHP Version: Confirms which PHP release is running. Versions below 8.1 no longer receive security patches — plan an upgrade.
  • System: Operating system and architecture (Linux x86_64, Windows, macOS, etc.).
  • Build Date: When the PHP binary was compiled — useful for identifying custom builds.
  • Server API: How PHP is connected to the web server (Apache handler, FPM/FastCGI, CLI, Nginx via PHP-FPM, etc.). This determines which configuration file governs your settings.

Loaded Extensions Section

This is where you verify whether required modules are installed. Common extensions to confirm:

  • mysqli or pdo_mysql — database connectivity
  • curl — HTTP requests and API calls
  • gd or imagick — image processing
  • mbstring — multibyte string handling
  • zip — archive operations
  • openssl — encryption and HTTPS support
  • xml — XML parsing
  • json — JSON encoding/decoding
  • bcmath — arbitrary precision math
  • redis or memcached — caching backends

Directory and Path Settings

  • Documentation Root: The web-accessible directory for your site.
  • include_path: Where PHP looks for included files.
  • extension_dir: Location of compiled PHP extensions — critical when troubleshooting missing modules.
  • upload_tmp_dir: Temporary directory for file uploads.

Security-Relevant Directives

  • display_errors: Must be Off on production.
  • expose_php: Must be Off to hide the PHP version header.
  • allow_url_fopen / allow_url_include: Both should be Off on production to prevent remote file inclusion attacks.
  • disable_functions: Confirms which dangerous functions (e.g., exec, system, passthru) are disabled.
  • open_basedir: Verifies filesystem access restrictions are in place.

phpinfo vs. Alternative Diagnostic Methods

Method Output Detail Security Risk Best Use Case
phpinfo() Comprehensive — every directive, extension, and environment variable High — exposes full server topology One-time debugging, migration verification, extension audits
phpversion() Single value — current PHP version string None Quick version checks embedded in applications
get_cfg_var() Individual configuration directive Low — reveals only what you specify Targeted checks (e.g., verifying upload_max_filesize)
ini_get() Individual runtime configuration value Low — selective output only Application-level configuration validation
php -i (CLI) Full configuration dump in terminal format None — CLI-only, not web-accessible Server administration, SSH-based diagnostics
php --ri (CLI) Extension-specific information

© 2026 Alyce Chronicle. All rights reserved.