PCC (PHP Secure Configuration Checker) 是一個開源命令列工具，掃描 php.ini 設定，依據安全最佳實踐（如 OWASP、CIS Benchmarks）輸出風險項目與修復建議，幫助開發者/運維快速強化 PHP 運行環境。
# 專案地址：https://github.com/sektioneins/pcc # 需 PHP 7.1+ # 下載單一檔案版本（無需 Composer） wget https://raw.githubusercontent.com/sektioneins/pcc/master/pcc.php chmod +x pcc.php # 掃描預設 php.ini php pcc.php # 指定路徑 php pcc.php /etc/php/8.2/fpm/php.ini # 輸出 JSON 供自動化整合 php pcc.php --format=json
| 類別 | 檢測重點 |
|---|---|
| 資訊洩露 | expose_php、display_errors、display_startup_errors、html_errors |
| 檔案系統 | open_basedir、file_uploads、upload_tmp_dir、max_file_uploads |
| 執行控制 | disable_functions、disable_classes、allow_url_fopen、allow_url_include |
| Session 安全 | session.cookie_httponly、session.cookie_secure、session.use_strict_mode、session.gc_maxlifetime |
| 資源限制 | memory_limit、max_execution_time、max_input_time、post_max_size、upload_max_filesize |
| 錯誤處理 | log_errors、error_log、error_reporting |
| 模組/擴展 | 危險擴展檢查（如 xdebug 在生產環境） |
$ php pcc.php
PHP Secure Configuration Checker
================================
Scanning /etc/php/8.2/fpm/php.ini
[FAIL] expose_php = On
Information disclosure: PHP version exposed in X-Powered-By header.
Recommendation: Set expose_php = Off
[FAIL] display_errors = On
Error messages displayed to users may leak sensitive data.
Recommendation: Set display_errors = Off, log_errors = On
[WARN] disable_functions =
Dangerous functions available: exec, shell_exec, system, passthru, proc_open, ...
Recommendation: disable_functions = exec,shell_exec,system,passthru,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source
[OK] session.cookie_httponly = 1
Session cookie protected from JavaScript access.
[OK] open_basedir = /var/www:/tmp
File system access restricted.
Summary: 12 checks, 3 FAIL, 2 WARN, 7 OK
