Hosting environment
What the server underneath the site is actually running.
26 checks in this group.
What you inherited, not what you configured
Every other group in this reference is about settings inside the CMS, things a person chose at some point and could in principle have chosen differently. This one is about the layer underneath, and the same reasoning drives our end-of-life version tracking: the PHP version the server is actually running, whether error output is being sent straight to the page, whether a handful of settings from an era of PHP that ended years ago (safe mode, register globals, magic quotes) have somehow was still there in on a legacy box, whether the session path is even writable. Most of these are not decisions anyone on the agency side made. They are inherited from whichever hosting account the site landed on, and on shared or budget hosting in particular, changing them is not always within your control at all.
That is exactly why this group belongs in an audit rather than a build checklist. You cannot promise a client an uptime figure, a load-time budget, or a security posture without first knowing what the server underneath is actually doing, and on a portfolio spanning multiple hosts and resellers, that answer is different for every site whether or not anyone chose it to be. A site on an end-of-life PHP series is not running slower on purpose; it is running on whatever the hosting provider still has installed, and it stays that way until someone notices and either pushes the host to upgrade or migrates the site. These are quick configuration reads rather than file scans, so the whole group runs on the twice-daily snapshot.
The PHP version check in particular is worth treating as a portfolio-wide signal rather than a per-site one: a cluster of sites stuck on the same old PHP series usually means a hosting provider or a reseller plan that has fallen behind, not twenty unrelated coincidences, and it is often cheaper to fix at the hosting level once than to chase one client at a time.
Generic
PHP Version Should Be Latest Supported Series
Compares the live PHP version against the currently supported series: an outdated release means known vulnerabilities in PHP itself go unpatched.
PHP Safe Mode Should Be Off
Safe mode was removed from PHP in version 5.4 (2012): finding it enabled today means the server is stuck on a release with no security support at all.
0% of the Generic sites we have this data for fail it
PHP Display Errors Configuration Should Be Off
Checks whether PHP is set to print errors on the page, which can leak file paths, database details and other internals to any visitor who triggers one.
100% of the Generic sites we have this data for fail it
PHP Register Globals Should Be Off
Register globals was removed from PHP in version 5.4 (2012): finding it on means the host is running a release with no security patches in over a decade.
0% of the Generic sites we have this data for fail it
PHP File Uploads Should Be Enabled
Checks that the PHP file_uploads setting is on: with it disabled, uploading media, installing extensions and applying updates all silently fail.
0% of the Generic sites we have this data for fail it
PHP Magic Quotes Should Be Off
Magic quotes was removed from PHP entirely in PHP 5.4 (2012), so finding it reported as enabled means the site is running an ancient, unsupported PHP build.
PHP Session Path Should Be Writable
Checks that PHP can write to its configured session save path, because without it the site cannot keep any visitor, including you, logged in.
0.7% of the Generic sites we have this data for fail it
PHP Disabled Functions Should Be Minimised
Reports any core PHP functions your host has disabled: blocking functions like this is not real hardening and often just breaks site features.
Site Time & Timezone Configuration
Shows the clock your site reports about itself: the timezone PHP runs in, how far your database sits from UTC, and whether the server clock has drifted away from real time.
Joomla
PHP Version Should Be Latest Supported Series
Running a PHP release below the latest supported minor version means missing bug fixes and security patches that the newer release already has.
PHP Safe Mode Should Be Off
Safe Mode never gave the isolation it promised and was removed from PHP in 5.4 (2012), so finding it on means a decade or more without a single security fix.
0% of the Joomla sites we have this data for fail it
PHP Display Errors Configuration Should Be Off
A production site with display_errors on will print file paths and stack traces straight onto the page, handing an attacker a map of your server.
2.4% of the Joomla sites we have this data for fail it
PHP Register Globals Should Be Off
Register Globals let request data overwrite script variables and was removed from PHP in 5.4 (2012), so finding it on means a decade of missed security fixes.
0% of the Joomla sites we have this data for fail it
PHP File Uploads Should Be Enabled
Some hosts disable file_uploads to look secure, but Joomla needs it for Media Manager and extensions, so turning it off breaks the site, not secures it.
1% of the Joomla sites we have this data for fail it
PHP Magic Quotes Should Be Off
Magic Quotes was removed from PHP in version 5.4 (2012), so finding it enabled means the server runs an unsupported PHP release with no security fixes since.
PHP Session Path Should Be Writable
PHP writes session files to keep visitors logged in between requests, so an unwritable session path silently breaks login and admin sessions across the site.
19.6% of the Joomla sites we have this data for fail it
PHP Disabled Functions Should Be Minimised
Disabling PHP functions in php.ini gives a false sense of security and breaks legitimate code without stopping an attacker who can already run PHP.
PHP Extension fileinfo Must Be Installed For Media Manager
Joomla 4.3 and later require the fileinfo PHP extension for Media Manager to work at all, and some cPanel hosts disable or omit it by default.
1.3% of the Joomla sites we have this data for fail it
WordPress
PHP Version Should Be Latest Supported Series
Checks your PHP version against the currently supported release series, since an outdated PHP version stops receiving security patches from php.net.
PHP Safe Mode Should Be Off
Checks for PHP's safe_mode setting, removed from PHP itself in 2012, so finding it enabled means the server runs a long-unsupported PHP version.
0% of the WordPress sites we have this data for fail it
PHP Display Errors Configuration Should Be Off
Checks whether PHP's display_errors setting is switched on, which can leak file paths and other internal details to anyone who triggers an error.
PHP Register Globals Should Be Off
Checks for PHP's register_globals setting, removed from PHP itself in 2012, so finding it switched on means the server runs a long-unsupported PHP version.
0% of the WordPress sites we have this data for fail it
PHP File Uploads Should Be Enabled
Checks whether PHP's file_uploads setting is enabled, since WordPress needs it for media uploads, plugin installs and theme updates to work at all.
1.3% of the WordPress sites we have this data for fail it
PHP Magic Quotes Should Be Off
Checks for PHP's magic_quotes settings, removed from PHP itself in 2012, so finding either active means the server runs a long-unsupported PHP version.
PHP Session Path Should Be Writable
Checks whether PHP's configured session save path is writable, since WordPress cannot keep users logged in or maintain any session state without it.
1.9% of the WordPress sites we have this data for fail it
PHP Disabled Functions Should Be Minimised
Checks your host's PHP disable_functions setting and flags any entries, since disabling core PHP functions is not real security and just breaks features.
Find out which of these your sites fail
Connect a site and every check in this group runs against it automatically, with the result and the fix in one place. These run twice a day on every connected site.
Run a free audit