Settings & maintenance

Security and privacy

How PHPPoll keeps your polls secure and your voters private: protected data folder, hashed passwords, CSRF tokens, safe uploads, anonymous IP hashes and server tips.

PHPPoll is built with security and privacy in mind. This page lists what is already protected and what you should check on your server.

Built-in security

Area	Protection
Admin login	Passwords are hashed, login is locked for 15 minutes after 5 failed attempts, the session ID changes on login.
Admin forms	CSRF tokens on every form. Destructive actions need a confirmation.
Output	All texts from visitors are escaped before display, preventing cross-site scripting (XSS).
Voting	Server-side validation of answers, honeypot, minimum fill-in time, captcha option, bot filter. See Prevent duplicate votes and spam.
Uploads	Only real JPG, PNG, GIF and WebP images up to 3 MB. The `uploads/` folder cannot execute PHP.
CSV export	Protected against spreadsheet formula injection. See Export poll votes to CSV.
Data storage	XML files, written atomically with file locking, so simultaneous votes cannot corrupt them.

Protect the data folder

The folder data/ contains settings (including the password hash) and all votes. Make sure it cannot be opened in a browser.

Apache: the included .htaccess files already deny access.

nginx: add a rule to your server block, adjusting the path:

location ^~ /poll/data/    { deny all; return 404; }
location ^~ /poll/uploads/ { location ~ \.php$ { deny all; } }

IIS: use request filtering to deny the data folder.
Best practice: move the folder outside the web root and point to it in config.php:
```
define('PP_DATA', '/home/youruser/phppoll-data');
```

Test it: open https://www.example.com/poll/data/settings.xml. You must see an error, not the file.

Privacy of your voters

IP addresses are never stored. Only a salted, irreversible hash is saved to enforce the vote limit.
No third-party services, trackers, fonts or analytics are loaded by polls.
The only cookie set on voters is a small one that remembers that they voted (when cookie limits are on).
Names, emails and comments are collected only if you enable them. See Collect voter details and comments.

Recommendations

Use HTTPS on your website.
Choose a strong admin password. See Admin panel login and account.
Keep PHP updated on your hosting.
Take regular backups. See Backup, restore and moving to a new server.
Optionally protect the admin/ folder with an extra HTTP password.

Last updated 1 November 2026