How to Protect Your phpinfo and Other Sensitive Files with Htaccess

Whenever I find myself working with PHP or messing around with server settings, I nearly always create a phpinfo.php file and place it in the root directory of whatever domain I happen to be working on. These types of informational files employ PHP’s handy phpinfo() function to display a concise summary of all of your server’s variables, which may then be referenced for debugging purposes, bragging rights, and so on.
While this sort of thing is normally okay, I frequently forget to remove the file and just leave it sitting there for the entire world to look at. This of course is a big “no-no” for site security, because the phpinfo.php file contains a hefty amount of information about my server, including stuff like:

• The web server version
• The IP address of the host
• The version of the operating system
• The root directory of the web server
• Configuration information about the remote PHP installation
• The username of the user who installed php and if they are a SUDO user

That, and tons more may be easily accessed quite easily by just about anyone looking for it. Of course, nefarious scum could then use this information to detect a vulnerability, exploit it, and feel better about their pathetic, wasted lives.

Remember to protect or remove any phpinfo.php or other sensitive files that you may have sitting around on your server.

So, wise readers, it is my advice to you (as well to myself) to remember to protect or remove anyphpinfo.php or other sensitive files that you may have sitting around on your server. An information-disclosure attack may seem like a low priority affair, but if the attacker locates a vulnerability, you’re screwed.

How to protect your phpinfo and other sensitive files with htaccess

If you are constantly referring to the file and would rather not delete it, consider adding the following slice of HTAccess to keep it private for your IP only:

# protect phpinfo
<Files php-info.php>
 Order Deny,Allow
 Deny from all
 Allow from 123.456.789
</Files>

Edit this snippet to include your specific IP address, along with any other IPs that may require access. Just use additional Allow from 123.456.789 lines to do so.
Likewise, to protect other files, you can replace “php-info.php” with the name of the file, or use regular expressions to pattern-match specific file sets.
Remember, when it comes to sensitive data, take an old wizard’s advice:

Keep it secret. Keep it safe.