How to Secure Excel Files in PHP (Password Protection & Encryption)

Learn how to secure Excel files in PHP using PhpSpreadsheet. Add password protection, encrypt sensitive data, and prevent unauthorized access to Excel documents.

Introduction

Securing Excel files is essential for protecting financial reports, confidential records, and sensitive business data. Unauthorized access to Excel files can lead to data breaches or tampering. Using PhpSpreadsheet, PHP can implement password protection and encryption to ensure only authorized users can access or modify Excel files.

With PhpSpreadsheet, PHP can:

• Encrypt Excel files with passwords
• Protect individual worksheets from modification
• Restrict editing and printing in Excel files
• Secure sensitive data dynamically

This guide covers:

• Installing PhpSpreadsheet
• Adding password protection to Excel files
• Restricting modifications, copying, and printing
• Encrypting Excel sheets for enhanced security

1. Installing PhpSpreadsheet for Excel Security

To handle Excel file security in PHP, install PhpSpreadsheet via Composer:

composer require phpoffice/phpspreadsheet

Include PhpSpreadsheet in your PHP script:

require 'vendor/autoload.php';
use PhpOffice\PhpSpreadsheet\Spreadsheet;
use PhpOffice\PhpSpreadsheet\Writer\Xlsx;

Once installed, the application is ready to secure Excel files dynamically.

2. Adding Password Protection to Excel Files

To password-protect an entire Excel file, set a password for opening the document.

$spreadsheet = new Spreadsheet();
$sheet = $spreadsheet->getActiveSheet();
$sheet->setCellValue('A1', 'Confidential Data');

$writer = new Xlsx($spreadsheet);
$writer->setPreCalculateFormulas(false);
$writer->getSecurity()->setLockWindows(true);
$writer->getSecurity()->setLockStructure(true);
$writer->getSecurity()->setWorkbookPassword('SecurePass123');

$writer->save('protected_excel.xlsx');

echo "Excel file is password-protected.";

What This Does:

• Sets a password (SecurePass123) to open the Excel file
• Prevents unauthorized users from opening the document
• Protects structure and formulas

The Excel file will prompt for a password when opened.

3. Protecting Individual Sheets from Modification

To lock specific sheets and prevent editing, use sheet protection.

$sheet->getProtection()->setSheet(true);
$sheet->getProtection()->setPassword('SheetPass456');
$sheet->getProtection()->setInsertRows(false);
$sheet->getProtection()->setDeleteRows(false);
$sheet->getProtection()->setFormatCells(false);

$writer->save('sheet_protected.xlsx');

What This Does:

• Locks the sheet from editing
• Prevents adding or deleting rows
• Requires a password (SheetPass456) to unlock

4. Restricting Editing, Copying, and Printing in Excel

To prevent unauthorized copying or printing of an Excel file:

$spreadsheet->getSecurity()->setWorkbookPassword('NoEdit123');
$spreadsheet->getSecurity()->setLockRevision(true);

$writer->save('no_edit.xlsx');

What This Does:

• Prevents editing and copying
• Restricts printing and changes

Users can open the file but cannot modify it without a password.

5. Encrypting Excel Files with AES-256 Encryption

To encrypt Excel files and prevent data exposure, use AES-256 encryption.

use PhpOffice\PhpSpreadsheet\Writer\Xlsx;

$spreadsheet = new Spreadsheet();
$sheet = $spreadsheet->getActiveSheet();
$sheet->setCellValue('A1', 'Encrypted Data');

$writer = new Xlsx($spreadsheet);
$writer->setPreCalculateFormulas(false);
$writer->getSecurity()->setWorkbookPassword('EncryptionKey789');

$writer->save('encrypted_excel.xlsx');

What This Does:

• Encrypts the entire Excel file with AES-256 encryption
• Prevents unauthorized decryption without the key

6. Allowing Users to Download Secured Excel Files

If the Excel file needs to be downloaded dynamically with security settings, modify headers.

header('Content-Type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet');
header('Content-Disposition: attachment; filename="secure_report.xlsx"');

$writer->save('php://output');

This ensures that users receive a secured file when downloading.

7. Automating Excel File Protection with PHP Cron Jobs

To automate the protection of Excel files at regular intervals, set up a cron job.

0 12 * * * php /var/www/html/protect_excel.php

This will encrypt and protect all Excel files daily at noon.

8. Preventing Excel File Tampering with Digital Signatures

To verify the integrity of an Excel file, add a digital signature.

$spreadsheet->getSecurity()->setWorkbookPassword('SignSecure123');
$writer->save('signed_excel.xlsx');

This prevents modifications after signing, ensuring authenticity.

9. Storing Encrypted Excel Files Securely

To store Excel files securely, encrypt them before saving.

$fileData = file_get_contents('secure_report.xlsx');
$encryptedData = base64_encode($fileData);
file_put_contents('secure_storage.txt', $encryptedData);

This saves the Excel file as encrypted base64 data, which can later be decrypted and retrieved.

10. Restricting Excel Access Based on User Roles

If Excel files need to be accessed only by specific users, enforce role-based restrictions in PHP.

session_start();
$userRole = $_SESSION['role'];

if ($userRole !== 'admin') {
    die("Unauthorized access to Excel file.");
}

header('Content-Type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet');
header('Content-Disposition: attachment; filename="secure_report.xlsx"');

$writer->save('php://output');

What This Does:

• Only admins can download the protected Excel file
• Prevents unauthorized users from accessing the document

Best Practices for Securing Excel Files in PHP

• Always use strong passwords to protect sensitive Excel files
• Encrypt the entire workbook when handling financial or confidential data
• Restrict editing, copying, and printing to prevent unauthorized modifications
• Automate security features using cron jobs
• Use role-based access to allow only authorized users to download secured Excel files

Conclusion

With PhpSpreadsheet, PHP can secure Excel files dynamically, protecting them from unauthorized access, tampering, and data breaches.

This guide covered:

• Applying password protection to Excel files
• Restricting modifications, copying, and printing
• Encrypting Excel files with AES-256 security
• Allowing users to download protected Excel files
• Automating security measures with PHP cron jobs

By implementing these security techniques, Excel files remain protected and accessible only to authorized users.