phpinfo.php: The Complete Playbook for Diagnosis, Security & Best Practices

The phpinfo.php file is one of the most widely used tools in the PHP developer's arsenal—and one of the most dangerous when left exposed. This playbook covers everything you need to know: how to create it, what every section means, how to secure it, and when to retire it.

Key Takeaways

• phpinfo() outputs a full snapshot of PHP configuration, server environment, and extension status in a single call.
• Leaving phpinfo.php on a production server is a critical security risk—it exposes passwords, paths, and module details to attackers.
• Use it only in local or staging environments; remove it from production immediately after debugging.
• Targeted diagnostics functions (e.g., ini_get(), phpversion()) are safer alternatives for live sites.
• A 301 redirect or firewall rule should be enforced to block any accidental exposure.

What Is phpinfo.php?

Definition and Purpose

phpinfo() is a built-in PHP function that prints detailed configuration information about the active PHP installation. A file named phpinfo.php typically contains a single line:

<?php
phpinfo();
?>

When loaded in a browser, it renders a formatted page showing:

• PHP version and build details
• Server API and hostname
• All compiled-in modules and extensions
• Environment variables
• PHP constants, predefined variables, andINI directive values
• HTTP headers sent by the server

Why Developers Rely on It

It is the fastest way to verify that PHP is correctly installed, that extensions like gd, mysqli, or curl are loaded, and that configuration directives match expectations. Support teams frequently request a phpinfo output when troubleshooting hosting issues.

How to Create a phpinfo.php File

1. Navigate to your web root (e.g., /var/www/html or public_html).
2. Create a file named phpinfo.php.
3. Add the following code:

<?php
// Display full PHP info
phpinfo();
?>

• Upload the file via FTP, SCP, or your deployment pipeline.
• Access it at https://yourdomain.com/phpinfo.php.
• Delete the file immediately after gathering the information you need.

Safe-Use Checklist

• Create the file only on a local or staging server, never on production.
• Verify the file is accessible and renders expected output.
• Download or screenshot the output before deleting.
• Remove phpinfo.php from the server after use.
• Audit your document root with find /var/www -name "phpinfo.php" to ensure none remain.
• Add a .htaccess or Nginx rule to deny direct access as a safety net.

Reading the phpinfo() Output: A Section-by-Section Guide

1. PHP Version

Located at the top. Confirms your PHP version, architecture (x64/TS/NTS), and build date. Critical for checking compatibility with frameworks and extensions.

2. Server Information

Shows the server software (Apache, Nginx, PHP-FPM), server API mode, and OS. Use this to confirm whether you're running CGI, FPM, or a module.

3. PHP Info

Lists local and master values for every php.ini directive. Compare the two columns to see which settings are overridden at runtime.

4. Module Extensions

Each loaded extension (MySQLi, cURL, GD, XML, etc.) gets its own subsection with version and configuration details. Use this to verify extension availability.

5. Environment

Displays server and execution environment variables. Sensitive data such as database credentials stored in $_ENV may appear here—another reason to restrict access.

6. PHP Variables

Covers $GLOBALS, $_SERVER, $_GET, $_POST, $_COOKIE, $_FILES, $_SESSION, $_REQUEST$_HTTP_ENV_VARS. Useful for debugging request data.

7. PHP License

Displays the PHP license text. Generally informational only.

phpinfo() vs. Targeted Diagnostic Functions

Function	Output	Security Risk	Best Use Case
phpinfo()	Full configuration dump	High — exposes paths, modules, env vars	Local debugging, initial setup verification
phpversion()	PHP version string only	Low	Version checks in scripts
ini_get()	Single directive value	Low	Checking specific settings (memory_limit, max_execution_time)
get_loaded_extensions()	List of loaded extension names	Medium	Verifying extension availability without exposing configs
php_uname()	OS and kernel information	Medium	Platform detection
get_cfg_var()	Value of a php.ini option	Low	Reading compiled-in defaults

Security Risks of phpinfo.php on Production

An exposed phpinfo.php page is a reconnaissance goldmine. Attackers use it to gather:

• Full file paths — enables path traversal and local file inclusion attacks.
• PHP version — reveals known vulnerabilities for your exact build.
• Loaded extensions — identifies attack surfaces (e.g., unsafe allow_url_include).
• Environment variables — may leak API keys, database passwords, and cloud credentials.
• Server architecture — aids in crafting targeted exploits.

Security Hardening Checklist

• Delete phpinfo.php from all production servers immediately.
• Add a .htaccess rule to deny access:

# Apache: block phpinfo.php
<Files "phpinfo.php">
    Require all denied
</Files>

• Add an Nginx rule:

location ~* ^/phpinfo\.php$ {
    deny all;
    return 404;
}

• Set expose_php = Off in php.ini.