Custom PHP Settings icon

Custom PHP Settings

Custom PHP Settings is a WordPress plugin with the following stats:

  • #3,695 Global Rank
  • 10K+ active installs
  • 4.4/5 15 ratings
  • Since 2019 7 years active

PF Score (About PF Scores)

PF Score is not a quality guarantee. It is a ranking based on available public signals.

Silver69.6
Platinum
Gold
Silver
Bronze
Low

Score Breakdown

66.7
Popularity 40% 10K+ active installs
72
Reputation 35% 4.4★ from 15 ratings
70.8
Freshness 25% Updated 9 months ago

No active penalty — 1 historical CVE, resolved — details

Download Trends

Loading download data…

Vulnerabilities

1 Total
1 Patched
0 Active
100% Resolved rate
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

6.1 Medium Affected All – 2.3.1 Patched in ✓ 2.3.2 Published 30 Apr 2026 CVE CVE-2024-13362

Vulnerability data provided by Wordfence Intelligence (opens in a new tab). CVE data: Copyright 1999–2026 The MITRE Corporation. CVE Terms of Use (opens in a new tab).

About Custom PHP Settings

This plugin makes it possible to override php settings.

This plugin can be used to customize php settings for you WordPress installation.

The plugin will modify either the .htaccess file or .user.ini file in order to change the current php settings directly from within the settings page.

Since the configuration file needs to be modified this file must be writable for this plugin to work as expected.

Apache module

When PHP is running as an Apache module the .htaccess file will be used to set customized settings; make sure so that this file exists and is writable by the webserver.

CGI/Fast-CGI

If instead PHP is running in CGI/Fast-CGI mode then a custom INI file will be used. The name of this file depends on the value of user_ini.filename in the php configuration, by default it is .user.ini.
You can check the name of you custom INI file in the PHP Information table. The custom INI file should be placed under the root folder and most be writable by the webserver.

Notice that there is also a User INI file cache TTL value in the information table, this value tells how long the custom INI file will be cached before it gets reloaded.
For instance, if this value is set to 300 then any changes to your custom INI file will not be reflected for up to 5 minutes. The name for this setting in the php configuration is user_ini.cache_ttl.

One important thing is to make sure that your .user.ini file is blocked by your webserver. If you are running NGINX this can be done by adding:

location ~ /\.user\.ini {
  deny all;
}

to your server configuration. The same thing using Apache is done by adding the following to the configuration if not already done:

<Files .user.ini>
order allow,deny
deny from all
</Files>

Available Settings

The settings table will display all non-system php settings that can be customized by the plugin. All modified settings will be displayed in red in this table.

Some settings might be displayed in red because they are changed somewhere else, perhaps through a customized php.ini file, by WordPress itself, a plugin or in some other way.
For instance if you have enabled WP_DEBUG in your wp-config.php file the error_reporting setting will turn red.

If you have questions or perhaps some idea on things that should be added you can also try slack.

Multiple Configurations

The premium version adds support for creating multiple named configurations which all can hold their own custom PHP settings.
You will then be able to easily switch between the different configurations entries applying them to you configuration file.

Environment Variables

In the premium version, when running PHP as an apache module and using an .htaccess file for configuration, you are able
to add custom environment variables. These will be accessible by using the super global $_SERVER array.
In order for this to work you will need to have the mod_env module enabled in your apache setup.

Resources

A complete list of settings that can be modified can be found here: List of php.ini directives
Notice that directives marked as PHP_INI_SYSTEM can not be modified.

Warning

Make sure you know how a value should be configured and what different settings do before changing anything.
This is important since some settings might render your page inaccessible, depending on what value you are using.
A good example of this is the variables_order configuration:

Sets the order of the EGPCS (Environment, Get, Post, Cookie, and Server) variable parsing. For example, if variables_order is set to “SP” then PHP will create the superglobals $_SERVER and $_POST, but not create $_ENV, $_GET, and $_COOKIE. Setting to “” means no superglobals will be set.

If this value would be configured to EPCS then no $_GET superglobal would be set which would make your page inaccessible.

Another example is setting the post_max_size to a very low value so that no form data is sent to the server, which in turn would result in that form data is never saved.

If you by mistake changed some value and your site is now inaccessible you could simply manually remove everything from between the plugin markers in your .htaccess file:

# BEGIN CUSTOM PHP SETTINGS PRO
php_value variables_order EPCS  <-- Remove
# END CUSTOM PHP SETTINGS PRO

If you are running PHP in CGI/Fast-CGI mode then instead remove everything between the plugins markers in your .user.ini file:

; BEGIN CUSTOM PHP SETTINGS
php_value variables_order EPCS  <-- Remove
; END CUSTOM PHP SETTINGS

Support

If you run into any trouble, don’t hesitate to add a new topic under the support section:
https://wordpress.org/support/plugin/custom-php-settings/

You can also try contacting me on slack.

Screenshots

Customize PHP settings from within WordPress administration.

Customize PHP settings from within WordPress administration.

A .htaccess file with customized PHP settings.

A .htaccess file with customized PHP settings.

A table with all php settings that can be customized.

A table with all php settings that can be customized.

Table displaying information about the current php environment.

Table displaying information about the current php environment.

Listing of all enabled PHP extensions.

Listing of all enabled PHP extensions.

All $_SERVER variables.

All $_SERVER variables.

All $_COOKIE variables.

All $_COOKIE variables.

An example of backed up configuration files.

An example of backed up configuration files.

Multiple settings are available in the premium version.

Multiple settings are available in the premium version.

The premium version supports setting environment variables.

The premium version supports setting environment variables.

Frequently Asked Questions

I have saved a setting in the editor but the PHP setting does not reflect this?

Make sure so you have checked the Update configuration file checkbox beneath the editor.

Ratings & Reviews

Recent Reviews

Loading reviews…

View all reviews on WordPress.org (opens in a new tab)

Changelog

= 2.4.1

  • Update: Freemius SDK to 2.13.0.
  • Update: Add more WordPress information.
  • Update: Add Server Software in status page.

Alternatives to Custom PHP Settings

Other WordPress plugins serving a similar purpose, ranked by relevance and PF Score.

Platinum94.5
Redirection icon

Redirection

Create 301 redirects and track 404 errors through a WordPress interface without server knowledge required.

★ 4.4/5·2.0M+ installs·Updated 11 Jul 2026
Silver57.2
Apache Status & Info icon

Apache Status & Info

Apache server-info and server-status monitoring right in your WordPress admin.

★ 5/5·100+ installs·Updated 20 Mar 2026
Platinum98.5
WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager icon

WPCode

Insert header and footer code snippets, PHP functions, and pixel tracking without file editing.

★ 4.9/5·3.0M+ installs·Updated 23 Jul 2026
Platinum96.4
Code Snippets icon

Code Snippets

Add custom code snippets to your site through a centralized library without editing files.

★ 4.7/5·1.0M+ installs·Updated 12 Jul 2026
Platinum91.8
CMB2 icon

CMB2

Build metaboxes, custom fields, and forms through a reusable library for WordPress development.

★ 5/5·300K+ installs·Updated 31 May 2026
Platinum90.0
One Click Demo Import icon

One Click Demo Import

Import demo content, widgets, and theme settings with a single click for immediate theme configuration.

★ 4.3/5·1.0M+ installs·Updated 22 Apr 2026
Platinum86.7
Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts icon

Woody Code Snippets

Insert code snippets into WordPress headers, footers, and pages without editing theme files.

★ 4.5/5·60K+ installs·Updated 22 Jul 2026
Platinum86.6
FluentSnippets – High-Performance Code Snippets, Header & Footer Code, Custom CSS & PHP Code Manager icon

FluentSnippets

File-based code snippet manager supporting PHP, CSS, JS, and HTML with conditional logic and zero database queries.

★ 4.7/5·50K+ installs·Updated 12 Aug 2026
Gold78.8
PHP Compatibility Checker icon

PHP Compatibility Checker

Make sure your plugins and themes are compatible with newer PHP versions.

★ 2.7/5·200K+ installs·Updated 20 Jul 2026
Gold78.3
WP-ServerInfo icon

WP-ServerInfo

Display your host's PHP, MYSQL, memcached & Redis information on your WordPress dashboard.

★ 4.8/5·10K+ installs·Updated 9 Aug 2026