display_errors = Off log_errors = On expose_php = Off session.use_strict_mode = 1 session.use_only_cookies = 1 session.cookie_httponly = 1 session.cookie_samesite = Lax session.cookie_secure = 1 ; Place logs and session storage outside the document root with restricted access. ; error_log = /var/log/hcr/php-errors.log ; session.save_path = /var/lib/hcr/sessions