---
title: "How to Enable or Disable PHP's allow_url_fopen Using CloudLinux Selector in DirectAdmin"
description: "Switch allow_url_fopen on or off from the Options tab of the DirectAdmin PHP Selector, and understand the security risk it adds and why cURL is unaffected."
url: "https://docs.noiz.ie/directadmin/how-to-enable-or-disable-phps-allow-url-fopen-using-cloudlinux-selector-in-direc/"
section: "DirectAdmin"
categories:
  - "Control Panels > DirectAdmin"
last_reviewed: "27 July 2026, against the current DirectAdmin release with the Evolution interface, and the current CloudLinux PHP Selector release"
---

# How to Enable or Disable PHP's allow_url_fopen Using CloudLinux Selector in DirectAdmin

`allow_url_fopen` is the PHP directive that decides whether your code may treat a remote URL as though it were a local file. With it switched on, functions such as `file_get_contents()`, `fopen()`, `copy()` and `getimagesize()` will accept `https://example.com/feed.xml` in place of a path on disk. With it switched off, those same calls fail on anything that is not a local file.

On Noiz DirectAdmin hosting that runs CloudLinux, you control this yourself from the **Select PHP version** tool, commonly called the CloudLinux **PHP Selector**. No support ticket and no server-level access are needed. This guide shows you where the toggle lives in DirectAdmin, what enabling it genuinely exposes, and why the setting sometimes appears to ignore you.

**Last reviewed:** 27 July 2026, against the current DirectAdmin release with the Evolution interface, and the current CloudLinux PHP Selector release. This guide is written for Noiz hosting and is kept current against DirectAdmin and CloudLinux. It complements, and does not replace, the official documentation linked below.

### Official Documentation Reference

- [PHP: Filesystem and Streams Configuration Options](https://www.php.net/manual/en/filesystem.configuration.php): the authoritative definition of `allow_url_fopen`, including its default value and the fact that it is an `INI_SYSTEM` setting.
- [PHP: Using Remote Files](https://www.php.net/manual/en/features.remote-files.php): how the URL-aware stream wrappers behave once the directive is enabled.
- [CloudLinux OS Components: PHP Selector](https://docs.cloudlinux.com/cloudlinuxos/cloudlinux_os_components/#php-selector): how the Selector stores per-account PHP settings, and what its limitations are.
- [DirectAdmin documentation](https://docs.directadmin.com/): reference for the DirectAdmin user interface itself.
- [OWASP: Server Side Request Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery): the attack class that an enabled `allow_url_fopen` makes easier to reach through vulnerable code.

## Prerequisites

- A Noiz DirectAdmin hosting account and its login details.
- An account set to a numbered CloudLinux PHP version rather than **native**. If you are still on native, change it first using [How to Change the PHP Version via CloudLinux Selector in DirectAdmin](/directadmin/how-to-change-the-php-version-via-cloudlinux-selector-in-directadmin/).
- A clear reason for the change. Knowing which script or plugin needs remote file access makes the troubleshooting section far shorter if something breaks.

## Before You Change It: What allow\_url\_fopen Actually Exposes

PHP ships with `allow_url_fopen` set to `1`, so on most accounts it is already on and most people never think about it. It is worth thinking about, because the directive does not grant a capability to your application so much as it grants a capability to *every* line of PHP running under your account, including code you did not write and have not read.

- **It turns file functions into network clients.** Anywhere your code passes a variable into `file_get_contents()`, `fopen()`, `copy()` or a similar call, an attacker who can influence that variable can point it at a URL instead of a path. That is the standard route to server-side request forgery, where your own server is used to reach things the attacker cannot reach directly, such as an internal service, a local admin interface, or a cloud metadata endpoint.
- **It widens the blast radius of one bad plugin.** A single unpatched plugin with a careless file handler becomes considerably more useful to an attacker when remote URLs are accepted. Disabling the directive does not fix the plugin, but it removes an entire category of exploitation from a vulnerability you have not found yet.
- **It is a prerequisite for something worse.** The related `allow_url_include` directive, which would let `include` and `require` pull in remote code, only functions when `allow_url_fopen` is on. `allow_url_include` defaults to off and has been deprecated since PHP 7.4. It should stay off permanently. Leave it alone.
- **Turning it off is rarely as disruptive as people expect.** The cURL extension is a completely separate mechanism and is unaffected by this directive. Well-written applications prefer cURL for outbound requests, so they keep working with `allow_url_fopen` disabled. What tends to break is older or lazier third-party code that calls `file_get_contents()` straight on a URL.

The practical position: leave it on if something you rely on genuinely needs it, and turn it off if nothing does. If you are unsure which applies to your site, disable it on a quiet day and watch for errors rather than guessing.

## Enable or Disable allow\_url\_fopen

### 1. Open Select PHP version

Log in to your DirectAdmin account. On the dashboard, find the **Extra Features** section and click **Select PHP version**. If the section is collapsed or the icon is not where you expect it, type `Select PHP` into the navigation filter box at the top of the left-hand menu and click the result.

![The Select PHP version icon in the Extra Features section of the DirectAdmin user dashboard](/img/DA-CL-PHP-selector-icon.gif)

### 2. Open the Options tab

The PHP Selector opens with its own navigation bar across the top: **My domains**, **Extensions** and **Options**. Click **Options**.

![The CloudLinux PHP Selector navigation bar with the Options tab highlighted, alongside the My domains and Extensions tabs](/img/CL-options-menu.gif)

**Note:** if the **Options** tab is empty or shows an error mentioning the native PHP version, check the **Current PHP version** shown on the page. When the account is set to **native**, the server manages PHP directly and the Selector cannot edit its directives, so there is nothing for the Options tab to show. Switch to a numbered version first, then come back here.

### 3. Set the directive

Find `allow_url_fopen` in the list of directives. Tick the checkbox to enable it, or clear the checkbox to disable it.

![The Options tab of the CloudLinux PHP Selector showing the allow_url_fopen directive and its tick box for enabling or disabling it](/img/CL-fopen-enable-disable.gif)

### 4. Let the change save

The Selector saves each directive as you change it, so there is no separate submit button to press. Wait for the on-screen confirmation before you navigate away, and allow a few seconds for it to apply. Nothing needs restarting from your side.

## Confirm the Setting Took Effect

Do not trust the checkbox alone. Create a file called `phpinfo.php` in your `public_html` directory containing:

```
<?php phpinfo();
```

Load `https://yourdomain.com/phpinfo.php` in your browser, replacing `yourdomain.com` with your own domain, and search the page for `allow_url_fopen`. The **Local Value** column is the one that matters.

**Delete the file as soon as you have read it.** A `phpinfo()` page left in place publishes your full server configuration, module list and filesystem paths to anyone who finds the URL, and automated scanners look for exactly that filename.

## Things the Toggle Does Not Do

- **It does not travel with you between PHP versions.** The Selector stores directive values separately for each PHP version. Change your PHP version later and the new version starts on its own defaults, so a carefully disabled `allow_url_fopen` can quietly switch back on. Re-check the Options tab after every version change.
- **It cannot be overridden from your code.** `allow_url_fopen` is an `INI_SYSTEM` directive, which means `ini_set('allow_url_fopen', '1')` inside a script has no effect. The same applies to a `php_value` line in `.htaccess`. The Selector, or a support request, is the only route.
- **It applies to the whole DirectAdmin account.** Every domain, subdomain and parked domain under the account shares the setting. You cannot enable it for one site and disable it for another within the same account.
- **It has no effect on cURL.** Scripts that use `curl_exec()` to fetch remote content carry on regardless of this setting, in both directions. Disabling `allow_url_fopen` is not a way to stop outbound HTTP requests from your account.

## Troubleshooting

- **Symptom: the Options tab is empty, or errors about the native PHP version.** The account is running native PHP, which the Selector does not manage. Change to a numbered PHP version and try again.
- **Symptom: `file_get_contents(): https:// wrapper is disabled in the server configuration`.** That is precisely what a disabled `allow_url_fopen` looks like. Either enable it, or better, change the offending code to use cURL.
- **Symptom: the checkbox is ticked but `phpinfo()` still reports Off.** Confirm that the version shown in the Selector is the version your site is actually running. Editing directives while a different version is selected is the usual cause. Clear any opcode or full-page cache, then check again.
- **Symptom: `allow_url_fopen` is not in the directive list at all.** Some server configurations lock the directive. Open a ticket with Noiz support stating which value you need and why.
- **Symptom: an installer or plugin insists `allow_url_fopen` is required.** Check whether the requirement is real before enabling it. Many installers list it as a preference and fall back to cURL without complaint. If it genuinely is required, enable it, but treat that dependency as a reason to review how well maintained the software is.

## Related Guides

- [How to Change the PHP Version via CloudLinux Selector in DirectAdmin](/directadmin/how-to-change-the-php-version-via-cloudlinux-selector-in-directadmin/)
- [How to Enable or Disable PHP Extensions Using the CloudLinux Selector in DirectAdmin](/directadmin/how-to-enable-or-disable-php-extensions-using-cloudlinux-selector-in-directadmin/)

If a script needs `allow_url_fopen` and you would rather not leave it enabled, or a site stopped working the moment you changed it, open a ticket with Noiz support. Include your domain name, the PHP version shown in the Selector, and the exact error text. On managed plans, Noiz will review which of your scripts genuinely depend on remote file access and help you move them across to cURL instead.

---
Source: https://docs.noiz.ie/directadmin/how-to-enable-or-disable-phps-allow-url-fopen-using-cloudlinux-selector-in-direc/