# Guides: PHP and server security > Guides on PHP security: webshells, back doors, php.ini, SQL injection, XSS, uploads, logs, backups and security headers. Source: https://phpsos.de/en/ratgeber/ As of: 25/10/2026 Provider: PHP SOS, PHP emergency help and server security. Immediate help via WhatsApp: https://wa.me/491736494914?text=Hello%20PHP%20SOS%2C%20we%20need%20help%20with%20our%20PHP%20server.%20Company%3A%20%E2%80%A6%20Website%3A%20%E2%80%A6 Expert articles for admins and developers: recognising webshells, hardening php.ini, analysing logs, programming securely. - [PHP2Shell timeline: chronology from 17 to 25 October 2026](https://phpsos.de/en/ratgeber/php2shell-chronologie/): All confirmed dates for PHP2Shell in one overview, from the first observed attack attempt to the status of 25 October 2026, and what follows from them for your checks. - [Hosting provider PHP update confirmation: how to ask about patch status](https://phpsos.de/en/ratgeber/hoster-patch-status-erfragen/): After PHP2Shell, a displayed PHP version proves little. With this template you request a confirmation from your hosting provider that you can document. - [Detecting and removing webshells](https://phpsos.de/en/ratgeber/webshell-erkennen/): How to track down backdoors on PHP web servers without destroying evidence, and why deleting alone is rarely enough. - [Finding a WordPress backdoor: tracking down backdoors systematically](https://phpsos.de/en/ratgeber/backdoor-wordpress-finden/): Where backdoors typically hide in WordPress and how admins track them down systematically with WP-CLI and a few commands. - [Configuring php.ini securely](https://phpsos.de/en/ratgeber/php-ini-sicher-konfigurieren/): Which php.ini settings reduce the attack surface, how to protect them against being overridden, and what additionally applies after PHP2Shell. - [Using PHP disable_functions correctly](https://phpsos.de/en/ratgeber/disable-functions/): With disable_functions you block risky PHP functions. How to define the list to suit your application without taking the website down. - [open_basedir and isolation per website](https://phpsos.de/en/ratgeber/open-basedir/): How to use open_basedir, separate system users and separate PHP-FPM pools to stop a break-in on one website from hitting all the others on the server. - [File permissions on the web server](https://phpsos.de/en/ratgeber/dateirechte-webserver/): Why the web server must not change its own code, which permissions for files and folders make sense, and how to check the current state quickly. - [composer audit: checking dependencies for vulnerabilities](https://phpsos.de/en/ratgeber/composer-abhaengigkeiten-pruefen/): How developers use composer audit to find known security vulnerabilities in libraries, automate the check and avoid typical deployment mistakes. - [PHP end of life: risks of outdated versions](https://phpsos.de/en/ratgeber/php-end-of-life-risiken/): What the end of support for a PHP version means, which branches still receive official patches after PHP2Shell, and how to make the migration plannable. - [Preventing SQL injection in PHP](https://phpsos.de/en/ratgeber/sql-injection-php/): How developers reliably rule out SQL injection in PHP applications with prepared statements, whitelists and minimal database permissions. - [Preventing XSS in PHP: defending against cross-site scripting](https://phpsos.de/en/ratgeber/xss-php/): How developers prevent cross-site scripting in PHP applications: context-appropriate encoding, auto-escaping in templates, HTML sanitising and a Content Security Policy. - [Implementing file uploads in PHP safely: PHP upload security](https://phpsos.de/en/ratgeber/datei-upload-sicher/): Upload forms are a frequent route for webshells. How to check file types properly, store files safely and stop the server from executing uploaded scripts. - [Securing sessions in PHP: PHP session security in practice](https://phpsos.de/en/ratgeber/session-sicherheit-php/): Sessions keep users logged in and are therefore a worthwhile target. How to configure cookies, session IDs and storage locations securely and apply the PHP2Shell note on upload progress. - [Insecure deserialization in PHP: unserialize and security](https://phpsos.de/en/ratgeber/deserialisierung-php/): unserialize() with foreign data can, in the worst case, lead to code execution. How to replace it with JSON, restrict it where it has to stay, and find risky places in the code. - [Preventing local file inclusion in PHP: LFI and RFI](https://phpsos.de/en/ratgeber/lfi-rfi/): When include or require take paths from the request, attackers can load foreign files. How to build page selection and templates safely and secure the server additionally. - [Protecting admin logins against brute force: brute-force protection for every login](https://phpsos.de/en/ratgeber/brute-force-login-schutz/): Automated password attempts hit every reachable login page. How to slow attackers down with rate limiting and Fail2ban, protect accounts with a second factor and store passwords correctly. - [DDoS or hack? Classifying attacks correctly](https://phpsos.de/en/ratgeber/ddos-oder-exploit/): Slow website, high load, strange files: whether a DDoS or a break-in is behind it determines the right response. How to classify the situation with a few checks. - [Analysing web server logs after an attack: reading the access log properly](https://phpsos.de/en/ratgeber/logfiles-auswerten/): After an attack, log files are often the most important trace. How to secure access, error and PHP logs properly, find conspicuous requests and avoid typical mistakes in the analysis. - [Setting up two-factor authentication for admin access](https://phpsos.de/en/ratgeber/zwei-faktor-admin/): A stolen password must not be enough to take over your server or shop. How to choose the right method, secure all admin access points and plan emergency access. - [Server backup strategy: backups using the 3-2-1 rule](https://phpsos.de/en/ratgeber/backups-3-2-1/): A backup helps only if it survives an attack and can be restored. How to apply the 3-2-1 rule to web servers and plan retention and tests correctly. - [Security headers for websites: setting them correctly](https://phpsos.de/en/ratgeber/sicherheits-header/): Security headers instruct the browser to protect your visitors better. How to set the most important headers in Nginx and Apache, introduce a Content Security Policy step by step and check the result. - [Removing the Google warning “This site may be hacked”](https://phpsos.de/en/ratgeber/google-warnung-entfernen/): A hack warning in search results costs visitors and trust. How to clean the website thoroughly, find hidden spam pages and request the review in Search Console. - [Checklist after a hack: 20 steps for the follow-up](https://phpsos.de/en/ratgeber/checkliste-nach-dem-hack/): After an attack, the right order counts. This checklist leads in 20 steps through containment, evidence preservation, cleanup, new credentials, duties and the documented close-out.