OWASP Top 10 for PHP

When to use

• The user wants to harden a PHP application against the common web risks the OWASP Top 10 covers, prioritizing which controls to add first.
• The user has a specific PHP weakness — access control, crypto, injection, SSRF, misconfiguration — and wants the matching OWASP Top 10 category and mitigation.
• The user wants a security review or audit of a PHP application against the OWASP Top 10, or asks which OWASP category a finding belongs to.

When NOT to use