Why is output buffering set to 4096 in standard WP setups?


#1

PHP Output Buffering: 4096
Why is this not set to zero as a standard setting for an optimised WP server install?

and while I on php.ini settings, I get it that you may not want to disable PHP Allow URL fopen straight off the bat, but shouldn’t this be highlighted somewhere, given it is a security risk?


#2

What do you mean by “highlight”? Have you seen another host highlight this somehow? I never have, one way or the other.


#3

If you optimise and harden your Wordpress site then it is something that one naturally looks for - and yes other managed WordPress hosting services do provide this.

All decent security products include a summary of recommended settings, it is a standard thing for WordPress optimisation to set the buffer to zero.

So yes, I think a service that is promoting itself as managed hosting for WordPress would include this as a minimum, as well as a step by step for what has been done to harden the site and suggestions for further hardening.

PHP Server|PHP.ini Info File|Folder Permissions (CGI or DSO)|Script Owner User ID (UID)|File Owner User ID
PHP Version: 7.1.26-1+0~20190113101856.12+jessie~1.gbp7077bb
PHP Memory Usage: 27.84 MB
WordPress Admin Memory Limit: 2048M
WordPress Base Memory Limit: 1800M
PHP Actual Configuration Memory Limit: 3096M
PHP Configuration File (php.ini): /etc/php/7.1/fpm/php.ini
WP Temp Dir: /tmp/
PHP Temp Dir: /tmp
PHP Upload Temp Dir: Not set/defined or directory is not writable
Session Save Path: /var/lib/php/sessions
Garbage Collector: On | Cycles: 0
PHP Max Upload Size: 128M
PHP Max Post Size: 128M
PHP Safe Mode: Off
PHP Allow URL fopen: On
PHP Allow URL Include: Off
PHP Display Errors: Off
PHP Display Startup Errors: Off
PHP Expose PHP: Off
PHP Register Globals: Off
PHP MySQL Allow Persistent Connections: Off
PHP Output Buffering: 4096
PHP Max Script Execution Time: 1800 Seconds
PHP Magic Quotes GPC: Off
PHP open_basedir: Off/Not in use
PHP XML Support: Yes
PHP IPTC Support: Yes
PHP Exif Support: Yes


#4

Hello @garth,

Good day to you sir.

Cloudways web stack is designed in such a way that our customers get both the performance and stability out of it, PHP output_buffering settings were Implemented to achieve the best of both the worlds.

Some guides suggest setting output_buffering = Off in your php.ini configuration in order to stream a PHP response. However, in some circumstances, this is useful, but typically, if you’re calling flush() in your PHP code, PHP will flush the output buffer immediately after the buffer is filled (the default value is 4096, which means PHP will flush its buffer in 4096-byte chunks).

Feel free to contact me if you have any more querries.

Regards,
Ibad Rehman
Community Manager


#5

From what I have seen WordPress out of the box runs better without Output Buffering, and streams faster to the browser. yes, it can be useful for sites that use shortcodes but most of our sites don’t use shortcodes.