skunkbad Posted November 26, 2010 Report Share Posted November 26, 2010 I'm in the process of helping one of my customers pass their PCI compliance scan. They are currently failing due to PHP revealing information about itself, and in order to pass we need to use ServerSignature Off and ServerTokens Prod php_value expose_php Off . Normally on an Apache server, I'd put this in the .htaccess file, but this doesn't work on Litespeed. Anybody know of a solution for Litespeed? Quote Link to comment Share on other sites More sharing options...
Michael D. Posted November 27, 2010 Report Share Posted November 27, 2010 PCI Compliance is near impossible to reach in a shared/reseller/semi-dedicated environment.For PCI Compliance we usually recommend at least a VPS but usually a Dedicated server.LiteSpeed runs the same PHP Binaries that Apache does, so the same commands should work. Open a ticket letting us know what you're trying and we can troubleshoot it. Quote Link to comment Share on other sites More sharing options...
skunkbad Posted November 27, 2010 Author Report Share Posted November 27, 2010 PCI Compliance is near impossible to reach in a shared/reseller/semi-dedicated environment.For PCI Compliance we usually recommend at least a VPS but usually a Dedicated server.LiteSpeed runs the same PHP Binaries that Apache does, so the same commands should work. Open a ticket letting us know what you're trying and we can troubleshoot it.I used header('X-Powered-By:') in an init type hook of the app, and the header is removed from all pages. Same effect as expose_php = Off (I think). The problem with VPS or dedicated is that it is expensive, and if a customer doesn't pass, the extra fee they have to pay is less than the cost of VPS/Dedicated. I've had success passing PCI compliance scans on shared hosts before. It's going to be a while before I handle this issue. That's why I didn't open up a support ticket. Quote Link to comment Share on other sites More sharing options...
Michael D. Posted November 27, 2010 Report Share Posted November 27, 2010 I used header('X-Powered-By:') in an init type hook of the app, and the header is removed from all pages. Same effect as expose_php = Off (I think). The problem with VPS or dedicated is that it is expensive, and if a customer doesn't pass, the extra fee they have to pay is less than the cost of VPS/Dedicated. I've had success passing PCI compliance scans on shared hosts before. It's going to be a while before I handle this issue. That's why I didn't open up a support ticket.Just open a ticket whenever you're ready/need to Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.