PHP configuration audit

The PHP Configuration card (Pro, Settings → Analysis) grades the PHP settings that decide how far a bug or a dropped file can go. It is read-only: change the values in php.ini, a .user.ini file or your hosting panel, then reload the page.

What it grades

• allow_url_include, display_errors and expose_php
• disable_functions (whether dangerous functions are blocked) and open_basedir
• The session cookie settings (HttpOnly, Secure and SameSite, strict mode, cookies only)

Each row shows the current value, the recommended one and a status. Some settings depend on how your site is served, such as the Secure cookie flag on a site without HTTPS, and are shown as Verify rather than as a failure.