Hosting environment
What the server underneath the site is actually running.
25 checks in this group.
What you inherited, not what you configured
Every other group in this reference is about settings inside the CMS, things a person chose at some point and could in principle have chosen differently. This one is about the layer underneath, and the same reasoning drives our end-of-life version tracking: the PHP version the server is actually running, whether error output is being sent straight to the page, whether a handful of settings from an era of PHP that ended years ago (safe mode, register globals, magic quotes) have somehow survived on a legacy box, whether the session path is even writable. Most of these are not decisions anyone on the agency side made. They are inherited from whichever hosting account the site landed on, and on shared or budget hosting in particular, changing them is not always within your control at all.
That is exactly why this group belongs in an audit rather than a build checklist. You cannot promise a client an uptime figure, a load-time budget, or a security posture without first knowing what the server underneath is actually doing, and on a portfolio spanning multiple hosts and resellers, that answer is different for every site whether or not anyone chose it to be. A site on an end-of-life PHP series is not running slower on purpose; it is running on whatever the hosting provider still has installed, and it stays that way until someone notices and either pushes the host to upgrade or migrates the site. These are quick configuration reads rather than file scans, so the whole group runs on the twice-daily snapshot.
The PHP version check in particular is worth treating as a portfolio-wide signal rather than a per-site one: a cluster of sites stuck on the same old PHP series usually means a hosting provider or a reseller plan that has fallen behind, not twenty unrelated coincidences, and it is often cheaper to fix at the hosting level once than to chase one client at a time.
Generic
PHP Version Should Be Latest Supported Series
Compares the live PHP version against the currently supported series: an outdated release means known vulnerabilities in PHP itself go unpatched.
PHP Safe Mode Should Be Off
Safe mode was removed from PHP in version 5.4 (2012): finding it enabled today means the server is stuck on a release with no security support at all.
PHP Display Errors Configuration Should Be Off
Checks whether PHP is set to print errors on the page, which can leak file paths, database details and other internals to any visitor who triggers one.
PHP Register Globals Should Be Off
Register globals was removed from PHP in version 5.4 (2012): finding it on means the host is running a release with no security patches in over a decade.
PHP File Uploads Should Be Enabled
Checks that the PHP file_uploads setting is on: with it disabled, uploading media, installing extensions and applying updates all silently fail.
PHP Magic Quotes Should Be Off
Magic quotes was removed from PHP entirely in PHP 5.4 (2012), so finding it reported as enabled means the site is running an ancient, unsupported PHP build.
PHP Session Path Should Be Writable
Checks that PHP can write to its configured session save path, because without it the site cannot keep any visitor, including you, logged in.
PHP Disabled Functions Should Be Minimised
Reports any core PHP functions your host has disabled: blocking functions like this is not real hardening and often just breaks site features.
Joomla
PHP Version Should Be Latest Supported Series
Running a PHP release below the latest supported minor version means missing bug fixes and security patches that the newer release already has.
PHP Safe Mode Should Be Off
Safe Mode never gave the isolation it promised and was removed from PHP in 5.4 (2012), so finding it on means a decade or more without a single security fix.
PHP Display Errors Configuration Should Be Off
A production site with display_errors on will print file paths and stack traces straight onto the page, handing an attacker a map of your server.
PHP Register Globals Should Be Off
Register Globals let request data overwrite script variables and was removed from PHP in 5.4 (2012), so finding it on means a decade of missed security fixes.
PHP File Uploads Should Be Enabled
Some hosts disable file_uploads to look secure, but Joomla needs it for Media Manager and extensions, so turning it off breaks the site, not secures it.
PHP Magic Quotes Should Be Off
Magic Quotes was removed from PHP in version 5.4 (2012), so finding it enabled means the server runs an unsupported PHP release with no security fixes since.
PHP Session Path Should Be Writable
PHP writes session files to keep visitors logged in between requests, so an unwritable session path silently breaks login and admin sessions across the site.
PHP Disabled Functions Should Be Minimised
Disabling PHP functions in php.ini gives a false sense of security and breaks legitimate code without stopping an attacker who can already run PHP.
PHP Extension fileinfo Must Be Installed For Media Manager
Joomla 4.3 and later require the fileinfo PHP extension for Media Manager to work at all, and some cPanel hosts disable or omit it by default.
WordPress
PHP Version Should Be Latest Supported Series
Checks your PHP version against the currently supported release series, since an outdated PHP version stops receiving security patches from php.net.
PHP Safe Mode Should Be Off
Checks for PHP's safe_mode setting, removed from PHP itself in 2012, so finding it enabled means the server runs a long-unsupported PHP version.
PHP Display Errors Configuration Should Be Off
Checks whether PHP's display_errors setting is switched on, which can leak file paths and other internal details to anyone who triggers an error.
PHP Register Globals Should Be Off
Checks for PHP's register_globals setting, removed from PHP itself in 2012, so finding it switched on means the server runs a long-unsupported PHP version.
PHP File Uploads Should Be Enabled
Checks whether PHP's file_uploads setting is enabled, since WordPress needs it for media uploads, plugin installs and theme updates to work at all.
PHP Magic Quotes Should Be Off
Checks for PHP's magic_quotes settings, removed from PHP itself in 2012, so finding either active means the server runs a long-unsupported PHP version.
PHP Session Path Should Be Writable
Checks whether PHP's configured session save path is writable, since WordPress cannot keep users logged in or maintain any session state without it.
PHP Disabled Functions Should Be Minimised
Checks your host's PHP disable_functions setting and flags any entries, since disabling core PHP functions is not real security and just breaks features.
Find out which of these your sites fail
Connect a site and every check in this group runs against it automatically, with the result and the fix in one place. These run twice a day on every connected site.
Run a free audit