1. Home
  2. phpinfo() Analyzer

phpinfo() Analyzer

Paste the output of phpinfo() or php -i. Get the PHP version status, a list of risky settings with fixes, and every directive in a searchable table.

phpinfo() output

Parsed in your browser. Nothing is uploaded. Remove passwords and keys before sharing phpinfo output with anyone.

What the analyzer checks

The analyzer reads the PHP version and every directive from your report, then compares them with the release data on this site and with widely used hardening advice for production servers. Each finding explains the risk and the php.ini line that fixes it.

  • PHP version. Whether the branch is still supported, when it reaches end of life, and whether the patch release is older than the October 21, 2026 security fixes.
  • Error output. display_errors and display_startup_errors should be off in production, with log_errors on, so visitors never see paths, queries or stack traces.
  • Information leaks. expose_php adds an X-Powered-By header with your exact version to every response.
  • Remote code inclusion. allow_url_include lets include load code from a URL. It should always be off.
  • Session cookies. session.cookie_httponly, session.cookie_secure, session.cookie_samesite and session.use_strict_mode protect logins against theft and fixation.
  • Performance. Whether OPcache is loaded and enabled, the single biggest speed setting for PHP websites.

How to get phpinfo output

From the web server, which shows the configuration your site actually uses: upload a file with <?php phpinfo();, open it, select all and copy, then delete the file. From the command line: run php -i, or php -i | grep -i opcache to filter. The command line often loads a different php.ini than PHP-FPM or Apache, so for web settings prefer the browser version. In WordPress, Tools → Site Health → Info shows the most important values without creating any file.

Recommended production settings

A sensible starting point for a public website. Put these in php.ini, or in the pool file of PHP-FPM, then reload the service:

display_errors = Off
display_startup_errors = Off
log_errors = On
expose_php = Off
allow_url_include = Off
session.cookie_httponly = 1
session.cookie_secure = 1
session.cookie_samesite = Lax
session.use_strict_mode = 1
opcache.enable = 1

On shared hosting without access to php.ini, most of these can be changed in the control panel (cPanel's MultiPHP INI Editor or Plesk's PHP Settings) or in a .user.ini file. After changing them, run phpinfo again and paste the result here to confirm the new local values.

Things the report cannot tell you

phpinfo shows configuration, not vulnerabilities in your code or plugins. A clean report does not mean a site is secure, and some warnings are fine in context: display_errors is useful on a development machine, and allow_url_fopen is needed by many applications. Treat the findings as a checklist to review, not as a score. To check the PHP version a public site exposes without access to the server, use the PHP Version Checker.

More PHP tools

PHP Version Checker

Find the PHP version of any website, or which versions your code runs on.

PHP Sandbox

Write and run PHP 7.4 to 8.5 in your browser. Nothing to install.

PHP Syntax Checker

Find parse errors with the exact line, checked by the real PHP parser.

PHP EOL Dates

Support and end-of-life dates for every PHP version, with countdowns.

Bcrypt Generator

Hash and verify passwords in the format PHP's password_hash() uses.

PHP Date Format

Every date() format character with a live preview of your format string.

PHP Formatter

Beautify PHP code to the PSR-12 style in one click.

PHP Regex Tester

Test preg_match, preg_replace and preg_split with real PHP PCRE.

PHP Unserialize

Turn serialized PHP data into a readable tree, JSON or print_r.

JSON to PHP Array

Convert JSON to a PHP array and PHP arrays back to JSON.

Frequently asked questions

What is phpinfo()?

phpinfo() is a built-in PHP function that prints a full report of the PHP installation: version, build options, loaded extensions, every php.ini directive with its local and master value, and environment variables. Developers use it to answer “which PHP and which settings is my site really using?”

How do I create a phpinfo page?

Create a file such as info.php in your web root containing <?php phpinfo();, open it in the browser, copy the page, and delete the file immediately. On the command line, php -i prints the same report as plain text, but for the CLI configuration, which can differ from the web server's.

Is it dangerous to leave phpinfo() online?

Yes. The report reveals exact versions, file paths, enabled functions and sometimes environment variables with database passwords or API keys. Attackers scan for info.php and phpinfo.php all the time. Remove the file as soon as you have the information.

Is my phpinfo output uploaded?

No. The analyzer parses the text in your browser with JavaScript. Nothing you paste is sent to our server. Still, remove secrets such as passwords and keys before you share phpinfo output with anyone else.

What is the difference between local value and master value?

The master value comes from php.ini. The local value is what applies to the current script, after overrides from .htaccess, .user.ini, the FPM pool configuration or ini_set(). When they differ, the local value is the one in effect. The analyzer checks local values.

Does it work with php -i output?

Yes. Paste either the HTML page (select all and copy, or save the page source) or the text from php -i. The analyzer recognises both formats.