Question How can I hide php version in http headers?

[azz]

Good day! I go to "Tools & settings -> PHP Settings", find line expose_php and set it to "Off". Restart apache. But in headers i see "X-Powered-By: PHP/5.4.45-0+deb7u2, PleskLin". How i can hide that?

 

[IgorG]

Have you tried to do it in PHP settings of subscription?

 

[azz]

Have you tried to do it in PHP settings of subscription?

It work, thank you. But why the same directive does not work in global config?

 

[IgorG]

Because each subscription/domain/subdomain has own php handler with different php versions and own php.ini files.

 

[azz]

But where is global settings, for all subscription/domain/subdomain?

 

[IgorG]

But where is global settings, for all subscription/domain/subdomain?

For different php versions it is

/opt/plesk/php/5.6/etc/php.ini
/opt/plesk/php/5.4/etc/php.ini
/opt/plesk/php/7.0/etc/php.ini

etc.

 

[azz]

For different php versions it is

/opt/plesk/php/5.6/etc/php.ini
/opt/plesk/php/5.4/etc/php.ini
/opt/plesk/php/7.0/etc/php.ini

etc.

there are only two versions: 5.6 and 7.0. But on my vps ALL my sites use another version:

In screen above, i click "5.4.45 by OS vendor FastCGI application", than go to tab "php.ini". I setup timezone & expose_php, than click "ok", wait until applied:

But my settings does't use:

I don't understand, why it so? What are those settings doing?

PS. plesk version 12.5.30 Update #49, last updated at Oct 18, 2016 06:26 AM

 

[IgorG]

But my settings does't use:

I suppose it is phpinfo() from subscription link on "PHP Settings" page?

What is output of following commands:

# grep -E 'expose_php|timezone' /var/www/vhosts/system/yourdomain.com/etc/php.ini
# plesk db "select * from PhpSettingsParameters where name like '%expose_php%' or name like '%timezone%'"

?

 

[azz]

I suppose it is phpinfo() from subscription link on "PHP Settings" page?

yes, of course

# grep -E 'expose_php|timezone' /var/www/vhosts/system/yourdomain.com/etc/php.ini
# plesk db "select * from PhpSettingsParameters where name like '%expose_php%' or name like '%timezone%'"

first command, return nothing. Those files contain only this:

second command:
exec: "less": executable file not found in $PATH

I run "plesk db", enter to mysql and run query inside it. The result, empty too (nothing was found).

 

[UFHH01]

Hi azz,

I have to correct @IgorG here, I'm afraid. You use the php.ini from "OS Vendor" as we can see in the screenshot from => #7 . Your "global" php.ini (s) is/are then located at "/etc/php5" on Debian/Ubuntu - based operating systems.

Pls. use commands as for example:

For "OS Vendor" - PHP versions use:

find /etc/php5 -type f -name "*.ini" -exec grep --color -Hni "expose_php" {} \;
or
find /etc/php -type f -name "*.ini" -exec grep --color -Hni "expose_php" {} \;​

For "Plesk" - PHP - versions use:

find /opt/plesk -type f -name "*.ini" -exec grep --color -Hni "expose_php" {} \;​

... to list "expose_php" - settings in your corresponding php.ini (s).​

 

[azz]

I have to correct @IgorG here, I'm afraid. You use the php.ini from "OS Vendor" as we can see in the screenshot from => #7 . Your "global" php.ini (s) is/are then located at "/etc/php5" on Debian/Ubuntu - based operating systems.

i find those files before create forum thread

They are not working. I was find many php.ini, but no one have used in system work. I do not understand that.

 

[UFHH01]

Hi azz,

pls. make sure, that you don't have any other configuration file, which may overwrite your previous setting:

find /etc/apache2 -type f -name "*.conf" -exec grep --color -Hni "expose_php" {} \;
find /etc/nginx -type f -name "*.conf" -exec grep --color -Hni "expose_php" {} \;
find /var/www/vhosts -type f -name "*.conf" -exec grep --color -Hni "expose_php" {} \;

find /var/www/vhosts/system -type f -name "*.ini" -exec grep --color -Hni "expose_php" {} \;
​

... and pls. consider to restart not only your apache - webserver, but as well nginx and corresponding php-fpm - services.

service apache2 restart
service nginx restart
service php5-fpm restart
service plesk-phpXX-fpm restart​

 

[EugeneKazakov]

Just for clarification how PHP FastCGI works:
Apache uses FCGIWrapper directive to find the script for execution
The script /var/www/cgi-bin/cgi_wrapper/cgi_wrapper (it is shipped with Plesk) uses variable PP_CUSTOM_PHP_INI with a path to php.ini config file
This variable is set for the domain with FcgidInitialEnv Apache directive:
# grep PP_CUSTOM_PHP_INI /var/www/vhosts/system/yourdomain.com/conf/httpd.conf
FcgidInitialEnv PP_CUSTOM_PHP_INI /var/www/vhosts/system/yourdomain.com/etc/php.ini

And PHP does not know about any additional php.ini files (I mean check of other places is useless).
The file /var/www/vhosts/system/yourdomain.com/etc/php.ini is prepared by Plesk and contains merged settings from different sources, including /etc/php.ini (or corresponding global config that is displayed in Tools&Settings > PHP Settings), database values for the corresponding domain, service plan and etc.
Propose to set some settings in PHP Settings on the domain and check the config file content.

 

[azz]

pls. make sure, that you don't have any other configuration file, which may overwrite your previous setting:

no one file was find, and i restart server, to be sure

Just for clarification how PHP FastCGI works:
Apache uses FCGIWrapper directive to find the script for execution
The script /var/www/cgi-bin/cgi_wrapper/cgi_wrapper (it is shipped with Plesk) uses variable PP_CUSTOM_PHP_INI with a path to php.ini config file
This variable is set for the domain with FcgidInitialEnv Apache directive:
# grep PP_CUSTOM_PHP_INI /var/www/vhosts/system/yourdomain.com/conf/httpd.conf
FcgidInitialEnv PP_CUSTOM_PHP_INI /var/www/vhosts/system/yourdomain.com/etc/php.ini

And PHP does not know about any additional php.ini files (I mean check of other places is useless).
The file /var/www/vhosts/system/yourdomain.com/etc/php.ini is prepared by Plesk and contains merged settings from different sources, including /etc/php.ini (or corresponding global config that is displayed in Tools&Settings > PHP Settings), database values for the corresponding domain, service plan and etc.

Tnx for explanations. Conclusion: because an empty file /var/www/vhosts/system/yourdomain.com/etc/php.ini (in my situation, screenshot above), php uses his own default settings.

Propose to set some settings in PHP Settings on the domain and check the config file content.

Yes, it work, as i wrote. In Home->Service Plans, check of plan, which contains the target domain, than go to "PHP Settings" tab, and add "Additional configuration directives":

After sync those directive add to all /var/www/vhosts/system/.../etc/php.ini domens of this plan:

But, i still have two questions
1) Can i add those directives globaly? Not in every subscribe plan, but in in one place, centralize?
2) Where and what app use this file?

The plesk wrote, that those setting use all my sites:

but in fact, it is not