Key Takeaways

• Creating a phpinfo file requires only 3 lines of PHP code saved as phpinfo.php in your web root.
• Use phpinfo() for diagnostics: checking PHP version, installed extensions, server configuration, and environment variables.
• Security risk: Leaving a phpinfo file publicly accessible exposes sensitive server details to attackers — remove or restrict it immediately after use.
• Alternative methods: Some hosting panels include built-in phpinfo viewers; CLI php -i outputs server info without creating a web-accessible file.
• Best practice: After saving and viewing phpinfo output, delete the file or move it outside the web root, and block access via .htaccess if retention is necessary.

What Is phpinfo.php and Why Do You Need It?

The phpinfo.php file is a lightweight PHP diagnostic script that calls the built-in phpinfo() function. When executed by a web server, it outputs a comprehensive page displaying your PHP configuration, loaded modules, server environment variables, and extension details.

Developers and sysadmins rely on phpinfo files to answer questions like:

• Which PHP version is my server running?
• Is the mysqli or PDO extension installed?
• What are the current upload_max_filesize and post_max_size limits?
• Which server variables (headers, paths, environment) are available?

How to Save a phpinfo.php File (Step-by-Step)

Step 1: Create the File

Open any plain-text editor and create a new file with the following content:

<?php
phpinfo();
?>

Step 2: Save with the Correct Extension

Save the file as phpinfo.php. Do not save it as phpinfo.txt or phpinfo.phtml unless your server is explicitly configured to parse those extensions as PHP.

Step 3: Upload to the Web Root

Transfer the file to your server's document root (e.g., /var/www/html/, public_html/, or htdocs/) using FTP, SFTP, or your hosting control panel's file manager.

Step 4: Access and View Output

Navigate to https://yourdomain.com/phpinfo.php in a browser. The page will render a full diagnostic report.

Step 5: Remove or Restrict After Use

Delete the file immediately after gathering the information you need, or restrict access as described in the Security section below.

phpinfo.php vs. Built-in Alternatives: Quick Comparison

Security Risks of a Saved phpinfo.php File

A publicly accessible phpinfo.php file is one of the most commonly exploited diagnostic tools. Attackers use it to enumerate:

• PHP version and patches — identify known vulnerabilities
• Full filesystem paths — enable local file inclusion (LFI) attacks
• Loaded extensions and modules — find weak or vulnerable libraries
• Server environment variables — extract database credentials, API keys, and session data
• Open_basedir and disable_functions — determine if execution restrictions are properly configured

Immediate Remediation Checklist

• [ ] Delete the file from the web root after viewing output
• [ ] Check for duplicates in subdirectories and backup locations
• [ ] Block access via .htaccess if the file must remain on the server
• [ ] Audit error logs for unauthorized access attempts to the file
• [ ] Restrict by IP using Require ip directives in Apache or allow/deny in Nginx
• [ ] Scan your site with a security tool (e.g., Wordfence, ClamAV) for other exposed diagnostic files

How to Restrict Access Instead of Deleting

Apache (.htaccess)

# Block all access except specific IPs
Order deny,allow
Deny from all
Allow from 192.168.1.0/24

Nginx (nginx.conf)

location ~* ^/phpinfo\.php$ {
    allow 192.168.1.0/24;
    deny all;
}

PHP-Level Check

<?php
if (!in_array($_SERVER['REMOTE_ADDR'], ['192.168.1.10', '10.0.0.5'])) {
    http_response_code(403);
    exit('Access denied.');
}
phpinfo();
?>

Troubleshooting: Common phpinfo.php Problems

Problem: Page Shows Raw Code Instead of Rendered Output

Your server is not processing PHP for that file. Ensure the server has the PHP module enabled and that the file extension is recognized. Check php.conf or apache2/mod-php configuration.

Problem: Blank White Page

PHP errors may be suppressed by display_errors = Off in php.ini. Enable error reporting temporarily or check the server error log.

Problem: File Shows Source Code in Browser

The web server is not configured to parse PHP. Verify that the PHP handler (e.g., mod_php, php-fpm) is loaded and active.

Problem: 403 Forbidden

Directory permissions or an .htaccess rule is blocking access. Check file ownership and directory read permissions.

Frequently Asked Questions

FAQ 1: Should I keep phpinfo.php on my production