PhpStorm Built-in Server: Evaluating the Continued Need for 'Allow external connections' After 2023.2 Localhost-Only Default

Question

PhpStorm 2023.2 changed the built‑in web server to bind only to 127.0.0.1 by default, reducing the chance of accidental public exposure. A hidden advanced setting named “Allow external connections” can revert the binding to 0.0.0.0, restoring the pre‑2023.2 behavior.

The presence of this toggle creates an unresolved decision: whether to keep the option for users who rely on legacy external‑access workflows or to remove it entirely to eliminate the risk of inadvertent exposure. Clear guidance on the security implications of enabling the setting is still limited in the official documentation.

Should the “Allow external connections” option be deprecated in favor of a safer default? Should the documentation explicitly warn that enabling it bypasses the localhost‑only safety net? Would a more conspicuous UI warning mitigate the risk of accidental activation?

Tasadduq Burney · Answer

Recommendation firstKeep the "Allow external connections" option, do not deprecate it outright. Gate it behind an explicit warning that enabling it disables the localhost-only safety net introduced in 2023.2, and document the security implications clearly. A conspicuous UI warning mitigates accidental activation better than removal, which would break legitimate LAN and mobile testing workflows.Confirmed facts vs likely explanationConfirmed from the question contextPhpStorm 2023.2 changed the built-in web server default to bind only to 127.0.0.1.An advanced setting named "Allow external connections" can revert binding to 0.0.0.0, restoring pre-2023.2 behavior.Likely explanation, not verified in current release notesLegitimate use cases remain for binding to 0.0.0.0: testing from a mobile device on the same LAN, demoing to colleagues, or accessing from a VM/container without port forwarding.Enabling external binding widens attack surface on untrusted networks and with a permissive host firewall. Safer alternatives for most needs are SSH port forwarding or a tunneling tool.Exact setting location and name may vary by build; JetBrains has not confirmed a formal deprecation or relocation after 2023.2 in the supplied data.Verification steps for this caseStart the built-in server in PhpStorm and note the reported URL and port.Run ss -tlnp or netstat -an while the server is running to confirm listening address: 127.0.0.1 vs 0.0.0.0.From another device on the same network, try http://:. With the option off it should fail, with it on it should succeed.Check your installed build's Settings/Preferences and Registry via Find Action to confirm the current presence and wording of the external connections option.One missing diagnostic that changes the recommendationCurrent PhpStorm build number and where the option lives in that build. If JetBrains has already moved or removed the toggle in a recent release, the guidance shifts from warning design to migration to alternatives.

PhpStorm Built-in Server: Evaluating the Continued Need for 'Allow external connections' After 2023.2 Localhost-Only Default

1 answer

Recommendation first

Confirmed facts vs likely explanation

Confirmed from the question context

Likely explanation, not verified in current release notes

Verification steps for this case

One missing diagnostic that changes the recommendation

Your perspective belongs here.

0 question comments