php-production-security.ini

; Merge these settings into the php.ini used by IIS FastCGI or PHP-FPM.
; Keep platform-specific extension loading in the installed PHP configuration.
; Values are deployment examples and must be validated against workload sizing.

display_errors = Off
display_startup_errors = Off
html_errors = Off
log_errors = On
expose_php = Off
error_reporting = E_ALL
zend.exception_ignore_args = On

max_execution_time = 60
max_input_time = 60
memory_limit = 256M
post_max_size = 10M
upload_max_filesize = 10M
file_uploads = Off
date.timezone = UTC

session.use_cookies = 1
session.use_only_cookies = 1
session.use_strict_mode = 1
session.use_trans_sid = 0
session.cookie_secure = 1
session.cookie_httponly = 1
session.cookie_samesite = Lax
session.cookie_lifetime = 0
session.cookie_path = /
session.cookie_domain =
session.gc_maxlifetime = 28800

; Configure session.save_path on the target host to a dedicated directory
; outside every web root. Grant access only to the PHP worker identity and the
; operating-system cleanup mechanism. The application aligns gc_maxlifetime
; with its configured absolute session timeout at request startup.

; Production OPcache. With timestamp checks disabled, deployment must recycle
; the IIS application pool or reload/restart PHP-FPM after replacing code.
opcache.enable = 1
opcache.enable_cli = 0
opcache.memory_consumption = 128
opcache.interned_strings_buffer = 16
opcache.max_accelerated_files = 20000
opcache.validate_timestamps = 0
opcache.save_comments = 1