If you are dealing with PHP scripts that access external files or URLs (like file_get_contents or include statements from a URL), you’ve likely come across the allow_url_fopen directive. In this guide, you’ll learn exactly what it is, when to enable or disable it, and how to configure it using your cPanel dashboard — all in a few easy steps.
What is allow_url_fopen?
allow_url_fopen is a PHP directive that lets your PHP code open external files or URLs using file functions like:
file_get_contents()
include()
require()
fopen()
When enabled, these functions can fetch data from a URL like http://example.com/data.txt.
When disabled, PHP will only be able to access local files, not remote ones.
Should You Enable or Disable allow_url_fopen?
Enable
Disable
Your site needs to fetch remote data (e.g., APIs, RSS feeds, remote files).
For better security (to prevent remote file execution).
Certain plugins or CMS (e.g., WordPress, Joomla) require it.
If you’re not using remote includes or remote file access.
Security Note: While allow_url_fopen is useful, enabling it can be a risk if your PHP code is not secure — especially if it uses user inputs without validation.
How to Check if allow_url_fopen is Enabled
You can create a small PHP file to check your current configuration.
Create a phpinfo.php file:
Upload this file to your site’s root directory using File Manager or FTP.
Visit https://yourdomain.com/phpinfo.php.
Look for allow_url_fopen in the output — it will show On or Off.
How to Enable or Disable allow_url_fopen in cPanel
You can change this directive using MultiPHP INI Editor in your cPanel account.
Method 1: Using MultiPHP INI Editor (Recommended)
Step-by-Step:
Log in to your cPanel dashboard.
Scroll to the Software section.
Click on MultiPHP INI Editor.
4. Choose your domain from the dropdown.
5. Scroll down to find allow_url_fopen.
6. Check (✔) to enable or uncheck to disable.
7. Click Apply or Save at the bottom.
Method 2: Editing the .htaccess File (For Apache Servers)
If MultiPHP INI Editor isn’t available, try editing the .htaccess file.
php_flag allow_url_fopen On
To disable:
php_flag allow_url_fopen Off
Note: This may not work on all servers depending on configuration.
Method 3: Using a Custom php.ini File
If your server allows custom php.ini overrides:
Navigate to the root folder of your site.
Create or edit the php.ini file.
Add this line:
allow_url_fopen = On
To disable:
allow_url_fopen = Off
Save the file and restart your application (or contact your host to reload PHP).
Test After Making Changes
After enabling or disabling, use the phpinfo() method again to confirm the update. If the setting didn’t change:
Your host might restrict user-level PHP overrides
Contact your hosting support team for assistance
The allow_url_fopen directive is a powerful but sensitive setting in PHP. Whether you’re enabling it to connect to APIs or disabling it for better security, make sure you understand its impact on your applications.
If you are unsure, it’s best to consult your developer or hosting provider before making the change.