← All Articles
Hardening a PHP Portfolio on Shared Hosting
Practical security headers, upload validation, and JSON-store hardening tips for Apache shared hosting without a database server.
SecurityPHPHosting
Shared hosting remains a practical choice for personal portfolios and small CMS installs. The tradeoff is that you must own security hygiene yourself.
Security headers first
Start with X-Content-Type-Options, Referrer-Policy, frame-ancestors, and HSTS. Pair them with a locked-down /data directory that returns 403 for direct requests.
JSON storage safely
Use file locks, never trust uploaded filenames, and keep credentials hashed with password_hash. Session cookies should be HttpOnly and SameSite=Lax or Strict.
Uploads
Validate MIME type server-side, cap size, and store outside of executable contexts when possible. Never serve uploads through PHP eval paths.