The Prioritised PHP Application Security Lifecycle Checklist

A PHP security checklist aligned with OWASP orders every control by risk severity, starting with injection and credential storage, not by how easy it is to tick a box. A checkmark on a spreadsheet is not security. This checklist is a starting point for verification, shaped around the OWASP Cheat Sheet Series and PHP manual specifics, with extra rigour for South Florida compliance demands in healthcare and real estate.

Every item below cites the specific OWASP Cheat Sheet or PHP manual section that justifies it. No item describes an exploit recipe. Walk through these verifiable PHP security checks before a single line of code reaches production. If you work on systems handling HIPAA-governed patient data or real estate transaction financials, treat every control here as mandatory and auditable.

Risk severity determines order. Start with the controls that prevent complete system compromise, then work down to defence-in-depth measures. Confirm all validation with a second party or automated test suite. The OWASP Cheat Sheet Series lists dozens of controls. Distil them into a lifecycle sequence: configuration, input handling, authentication, session handling, output encoding, file interactions, and dependency hygiene.

Healthcare organisations in South Florida must meet HIPAA technical safeguards, which demand encryption at rest and in transit, access auditing, and integrity controls. Real estate transaction platforms handling escrow or PII fall under state data-breach notification laws and often contractual PCI-like obligations. A missing open_basedir restriction or a default php.ini session setup can fail an audit even when application code is sound.

Begin with php.ini. Runtime configuration failures undermine every application-layer defence. The OWASP PHP Configuration Cheat Sheet calls out the following non-negotiable settings. Set expose_php to Off. Disable allow_url_fopen and allow_url_include unless a specific, reviewed use case requires them. Set display_errors to Off and log_errors to On, with error_reporting at E_ALL & ~E_DEPRECATED & ~E_STRICT for production. An error log verbosity that leaks stack traces to end users is a misconfiguration that satisfies an attacker's reconnaissance phase.

Use disable_functions to remove dangerous functions your application does not call. The OWASP-recommended starting list includes exec, passthru, shell_exec, system, proc_open, popen, curl_multi_exec, parse_ini_file, and show_source. Audit this list per application. Blocking a function the framework or a library legitimately uses breaks the application. Configure open_basedir to restrict file access to the application root and writable directories. This containment control limits the damage of a file-inclusion or path-traversal vulnerability. For healthcare compliance in South Florida, the open_basedir restriction is an auditable configuration item that demonstrates a least-privilege file-access posture.

OPcache Configuration Checks

Enable opcache in production. The OWASP guidance treats this as a performance control, but an opcache stampede triggered by a deploy without a cache warm-up becomes a denial-of-service condition. Set opcache.validate_timestamps to 0 in production and implement a cache-warm strategy after each deployment. Verify the opcache hit rate is above 90 percent with a cache size large enough to hold the entire compiled codebase. A high restart rate signals a misconfigured cache size and negates the protection.

SQL injection remains the highest-severity risk. Successful exploitation yields the database. The OWASP SQL Injection Prevention Cheat Sheet mandates parameterised queries with prepared statements for every database interaction. PDO and MySQLi both support this. Never concatenate user input into a SQL string. This rule applies even to ORM methods that accept raw expressions; every expression argument must be a bound parameter.

For stored procedures, validate that the procedure itself uses parameterised queries internally. Dynamic SQL inside a stored procedure that concatenates input is still vulnerable. The OWASP Cheat Sheet Series notes that escaping is a secondary defence, not a primary one. Use it only as an additional layer behind prepared statements, never as the sole control.

Cross-Site Scripting And Output Encoding

Cross-site scripting prevention requires output encoding, not input filtering. The OWASP XSS Prevention Cheat Sheet provides encoding rules per HTML context: HTML body, attribute, JavaScript, CSS, and URL. Use a library that implements these rules. Do not write custom escaping functions. Content-Security-Policy headers provide a defence-in-depth layer that limits script execution even when an XSS vector slips through. Deploy CSP in report-only mode first, collect violation reports, and refine the policy before enforcing it.

Command Injection Prevention

Command injection prevention follows the same principle: separate the command from the data. Use an API that accepts arguments as an array rather than building a command string. When no API exists, validate input against a strict allowlist of permitted characters and structures. The OWASP Command Injection Cheat Sheet classifies this as a high-severity control. For healthcare applications, a command injection vulnerability that exposes patient data triggers mandatory breach notification under HIPAA.

Password storage must use password_hash with the argon2id algorithm on PHP 7.3 and above. The OWASP Password Storage Cheat Sheet ranks argon2id as the preferred algorithm because it resists both side-channel and GPU-based attacks. The bcrypt cost factor, set at 12 or higher, is an acceptable fallback when argon2id is unavailable. Never use a custom hashing scheme.

Session fixation prevention requires regenerating the session ID after login, logout, and privilege-level changes. PHP's session_regenerate_id(true) deletes the old session file and issues a new identifier. The OWASP Session Management Cheat Sheet also mandates setting session cookie attributes: secure flag, httponly flag, and SameSite=Lax or Strict. South Florida compliance for healthcare demands httponly and secure flags on every authentication cookie. A missing httponly flag exposes the session ID to XSS exfiltration, and a missing secure flag transmits it over unencrypted channels.

Multi-Factor Authentication And Account Recovery

Implement multi-factor authentication for administrative and privileged accounts. The OWASP Authentication Cheat Sheet recommends TOTP or WebAuthn. For account recovery, avoid security questions whose answers are discoverable. Use a time-limited token sent to the verified email address. Rate-limit recovery attempts and log every request. Real estate transaction platforms handling financial data must treat account takeover as a material breach risk.

Beyond session fixation, the session storage mechanism itself matters. PHP's default file-based session handler serialises access to a session. AJAX-heavy applications that issue concurrent requests from the same browser session will queue and appear to hang unless the session is written and closed early with session_write_close(). For applications that need concurrent session access, switch to a database-backed session handler that does not lock the entire session on read.

Transport security requires TLS 1.2 or 1.3. The OWASP Transport Layer Protection Cheat Sheet lists secure cipher suites and mandates HSTS with a max-age of at least one year. Set the includeSubDomains and preload directives. For South Florida healthcare applications, TLS is a HIPAA technical safeguard, and the absence of HSTS is an audit finding. Clickjacking defence uses the X-Frame-Options header set to DENY or SAMEORIGIN. A Content-Security-Policy frame-ancestors directive provides finer-grained control and supersedes X-Frame-Options for modern browsers. Deploy both for backward compatibility.

CSRF defence requires a synchronizer token pattern. The OWASP CSRF Prevention Cheat Sheet specifies that every state-changing request must include an unpredictable token bound to the user session. Frameworks like Laravel and Symfony provide this out of the box. Verify that the token is validated on the server side and rejected if missing or mismatched. For AJAX endpoints, include the token in a custom request header. Do not accept tokens from query parameters.

Dependency vulnerability management is a lifecycle task. Run composer audit on every commit and in every CI pipeline. This command checks the lock file against the Packagist advisory database. A clean composer audit output does not guarantee safety. Abandoned packages receive no security updates even if no advisory exists yet. Review every direct dependency for maintenance status. A package with zero merged community pull requests in twelve months is effectively abandoned. The OWASP Dependency Checking Cheat Sheet provides additional guidance on integrating software composition analysis into the build pipeline. For South Florida compliance in healthcare and real estate, a documented dependency audit trail is an auditable control.

File upload functionality introduces multiple risks: remote code execution, path traversal, and denial of service through large files. The OWASP File Upload Cheat Sheet requires validating file type by MIME type and magic bytes, not by the file extension. Store uploaded files outside the web root and serve them through a script that sets the correct Content-Type header. Generate filenames with a random component to prevent overwriting.

Restrict the maximum file size in php.ini with upload_max_filesize and post_max_size, and enforce a stricter limit at the application level. Scan every uploaded file for malware using a dedicated service. For healthcare applications handling patient records, a file upload vulnerability that exposes protected health information is a notifiable breach. Real estate transaction platforms that accept contract documents must prevent an attacker from uploading executable content disguised as a PDF.

South Florida Healthcare And Real Estate Compliance Specifics

HIPAA technical safeguards map directly to the controls above: access controls (session management and authentication), audit controls (logging every access to patient data), integrity controls (file upload validation and dependency audit), and transmission security (TLS and HSTS). Real estate platforms handling escrow instructions or financial prequalification documents must meet similar contractual standards. A missing open_basedir restriction or a default session cookie configuration can fail a compliance audit even when application logic is otherwise sound. Document every configuration change in php.ini and retain the audit trail.

Priority	Control	OWASP Cheat Sheet Or PHP Manual Source	Verification Method
1	Parameterised queries for all SQL	SQL Injection Prevention Cheat Sheet	Code review: no concatenated SQL strings
2	Password hashing with argon2id	Password Storage Cheat Sheet, PHP password_hash	Verify password_verify() call path
3	Output encoding per XSS context	XSS Prevention Cheat Sheet	Template engine review, CSP report analysis
4	Session ID regeneration and secure cookie attributes	Session Management Cheat Sheet	Inspect Set-Cookie headers in browser dev tools
5	disable_functions and open_basedir in php.ini	PHP Configuration Cheat Sheet	phpinfo() output audit
6	CSRF tokens on all state-changing requests	CSRF Prevention Cheat Sheet	Automated test that submits without token
7	File upload validation by MIME type and magic bytes	File Upload Cheat Sheet	Upload crafted file with wrong extension
8	composer audit in CI pipeline	Dependency Checking Cheat Sheet	CI log review
9	TLS 1.2+ with HSTS	Transport Layer Protection Cheat Sheet	SSL Labs scan
10	X-Frame-Options and Content-Security-Policy	Clickjacking Defense Cheat Sheet	Response header inspection

A deploy pipeline must run a security gate. The following checks take under five minutes and catch the failures that compliance auditors look for. First, diff the production php.ini against a known-secure baseline. Any change to disable_functions, open_basedir, or session cookie parameters must be reviewed. Second, verify that display_errors is Off and log_errors is On. Trigger a deliberate 500 error and confirm no stack trace appears in the response body.

Third, run composer audit and confirm zero high-severity advisories. A non-zero exit code from composer audit must block the deploy. Fourth, test that session_regenerate_id is called after authentication. Log in, capture the pre-login session cookie, and confirm the post-login cookie value differs. Fifth, verify that CSP and HSTS headers appear on every response. A curl command against the staging environment shows header presence before production promotion. These five checks form a minimal deploy gate that catches the most common configuration regressions.

OWASP PHP configuration is not a one-time task. PHP minor versions change supported algorithms and deprecate functions. When PHP 8.x reaches end of life, any application still on it runs without security patches. The PHP release cycle provides three years of active support and one year of security fixes per minor version. Check php.net/supported-versions annually and schedule upgrades before the end-of-security-support date.

Framework upgrades follow the same pattern. A framework two major versions behind has accumulated breaking changes that make a single-step upgrade risky. Plan incremental upgrades, one major version at a time, with each step validated against a full test suite. The PHP application security lifecycle includes these upgrade windows as budgeted, recurring work items, not emergency responses to an end-of-life notice.