How to Turn Off expose_php for Plesk

The expose_php directive in PHP reveals your server’s PHP version to anyone who inspects HTTP response headers. While this information seems harmless, it can provide attackers with valuable intelligence about potential vulnerabilities specific to your PHP version. If you are using Plesk as your hosting control panel, disabling expose_php is a simple but effective security measure that helps protect your WordPress site from targeted attacks.

What is expose_php?

expose_php is a PHP configuration directive that controls whether PHP adds a header containing the PHP version number to HTTP responses. When enabled (which is the default), PHP sends an X-Powered-By header like:

X-Powered-By: PHP/8.1.12

This header reveals your exact PHP version to anyone who makes a request to your server. While PHP version information is not a direct vulnerability, it helps attackers identify specific exploits that target your version.

Why Disable expose_php?

Disabling expose_php provides several security benefits:

• Reduces Information Disclosure: Prevents attackers from easily identifying your PHP version
• Security Through Obscurity: While not a complete security solution, it adds an extra layer of defense
• Best Practice Compliance: Many security guidelines recommend disabling expose_php
• Reduces Attack Surface: Makes it harder for automated scanners to identify vulnerable servers

Method 1: Using Plesk Panel

Plesk provides a user-friendly interface for managing PHP settings. Here is how to disable expose_php through the Plesk panel:

1. Log in to Plesk: Access your Plesk control panel using your admin credentials
2. Select Your Domain: Navigate to the Websites & Domains section and select the domain you want to configure
3. Open PHP Settings: Click on “PHP Settings” or “PHP Selector” depending on your Plesk version
4. Find expose_php: Look for the expose_php directive in the PHP options
5. Disable It: Uncheck the box or set the value to Off
6. Save Changes: Click Apply or Save to apply the changes

Method 2: Editing php.ini File

You can also disable expose_php by directly editing the php.ini file:

1. Access Server: Connect to your server via SSH or use the Plesk File Manager
2. Locate php.ini: Find the php.ini file (usually in /etc/php/ or the PHP configuration directory)
3. Edit the File: Open the file in a text editor and find the expose_php directive
4. Change the Value: Set expose_php to Off
5. Save and Restart: Save the file and restart PHP or your web server

; Find this line
expose_php = On

; Change it to
expose_php = Off

Method 3: Using .htaccess (Apache)

If you are using Apache, you can disable expose_php through the .htaccess file:

# Add this line to your .htaccess file
php_flag expose_php off

Method 4: Using PHP-FPM Configuration

For servers using PHP-FPM, you can configure expose_php through the PHP-FPM pool configuration:

1. Locate your PHP-FPM pool configuration file (usually in /etc/php/fpm/pool.d/)
2. Add or modify the following line:

php_flag[expose_php] = off

3. Restart PHP-FPM: sudo systemctl restart php-fpm

How to Verify expose_php is Disabled

After disabling expose_php, verify that it is working correctly:

1. Check HTTP Headers: Use curl or your browser developer tools to check the response headers
2. Use Online Tools: Visit security headers checking tools to verify the header is removed
3. Check PHP Info: Create a phpinfo() page to verify the setting

# Check headers using curl
curl -I https://yourdomain.com

# Look for the X-Powered-By header - it should NOT be present

Additional Security Headers to Consider

While disabling expose_php is a good first step, consider adding these additional security headers:

• X-Content-Type-Options: Prevents MIME type sniffing
• X-Frame-Options: Prevents clickjacking attacks
• X-XSS-Protection: Enables browser XSS filtering
• Strict-Transport-Security: Enforces HTTPS connections
• Content-Security-Policy: Controls resource loading

Conclusion

Disabling expose_php in Plesk is a quick and effective security measure that reduces information disclosure about your server. While it is not a complete security solution on its own, it is an important part of a layered security approach. Combine this with other security best practices like keeping your software updated, using strong passwords, and implementing a web application firewall to provide comprehensive protection for your WordPress site.