24 pages

Guides: PHP and server security

Expert articles for admins and developers: recognising webshells, hardening php.ini, analysing logs, programming securely.

WhatsApp emergency

PHP2Shell timeline: chronology from 17 to 25 October 2026

All confirmed dates for PHP2Shell in one overview, from the first observed attack attempt to the status of 25 October 2026, and what follows from them for your checks.

Hosting provider PHP update confirmation: how to ask about patch status

After PHP2Shell, a displayed PHP version proves little. With this template you request a confirmation from your hosting provider that you can document.

Detecting and removing webshells

How to track down backdoors on PHP web servers without destroying evidence, and why deleting alone is rarely enough.

Finding a WordPress backdoor: tracking down backdoors systematically

Where backdoors typically hide in WordPress and how admins track them down systematically with WP-CLI and a few commands.

Configuring php.ini securely

Which php.ini settings reduce the attack surface, how to protect them against being overridden, and what additionally applies after PHP2Shell.

Using PHP disable_functions correctly

With disable_functions you block risky PHP functions. How to define the list to suit your application without taking the website down.

open_basedir and isolation per website

How to use open_basedir, separate system users and separate PHP-FPM pools to stop a break-in on one website from hitting all the others on the server.

File permissions on the web server

Why the web server must not change its own code, which permissions for files and folders make sense, and how to check the current state quickly.

composer audit: checking dependencies for vulnerabilities

How developers use composer audit to find known security vulnerabilities in libraries, automate the check and avoid typical deployment mistakes.

PHP end of life: risks of outdated versions

What the end of support for a PHP version means, which branches still receive official patches after PHP2Shell, and how to make the migration plannable.

Preventing SQL injection in PHP

How developers reliably rule out SQL injection in PHP applications with prepared statements, whitelists and minimal database permissions.

Preventing XSS in PHP: defending against cross-site scripting

How developers prevent cross-site scripting in PHP applications: context-appropriate encoding, auto-escaping in templates, HTML sanitising and a Content Security Policy.

Implementing file uploads in PHP safely: PHP upload security

Upload forms are a frequent route for webshells. How to check file types properly, store files safely and stop the server from executing uploaded scripts.

Securing sessions in PHP: PHP session security in practice

Sessions keep users logged in and are therefore a worthwhile target. How to configure cookies, session IDs and storage locations securely and apply the PHP2Shell note on upload progress.

Insecure deserialization in PHP: unserialize and security

unserialize() with foreign data can, in the worst case, lead to code execution. How to replace it with JSON, restrict it where it has to stay, and find risky places in the code.

Preventing local file inclusion in PHP: LFI and RFI

When include or require take paths from the request, attackers can load foreign files. How to build page selection and templates safely and secure the server additionally.

Protecting admin logins against brute force: brute-force protection for every login

Automated password attempts hit every reachable login page. How to slow attackers down with rate limiting and Fail2ban, protect accounts with a second factor and store passwords correctly.

DDoS or hack? Classifying attacks correctly

Slow website, high load, strange files: whether a DDoS or a break-in is behind it determines the right response. How to classify the situation with a few checks.

Analysing web server logs after an attack: reading the access log properly

After an attack, log files are often the most important trace. How to secure access, error and PHP logs properly, find conspicuous requests and avoid typical mistakes in the analysis.

Setting up two-factor authentication for admin access

A stolen password must not be enough to take over your server or shop. How to choose the right method, secure all admin access points and plan emergency access.

Server backup strategy: backups using the 3-2-1 rule

A backup helps only if it survives an attack and can be restored. How to apply the 3-2-1 rule to web servers and plan retention and tests correctly.

Security headers for websites: setting them correctly

Security headers instruct the browser to protect your visitors better. How to set the most important headers in Nginx and Apache, introduce a Content Security Policy step by step and check the result.

Removing the Google warning “This site may be hacked”

A hack warning in search results costs visitors and trust. How to clean the website thoroughly, find hidden spam pages and request the review in Search Console.

Checklist after a hack: 20 steps for the follow-up

After an attack, the right order counts. This checklist leads in 20 steps through containment, evidence preservation, cleanup, new credentials, duties and the documented close-out.

Immediate contact

Every hour counts. Write to us now.

Briefly describe your system, PHP version and observation. We will get back to you, clarify the situation and work remotely until the incident is closed and documented.

WhatsApp emergency Call