Skip to content

Knowledgebase

Configuring allow_url_fopen with CloudLinux in cPanel

cpanel-whm, development

allow_url_fopen controls whether PHP file functions can use supported URL wrappers, such as reading an HTTPS resource with a file-handling function. It is separate from cURL and from allow_url_include. A change should follow the application's documented needs.

Check access and requirements

Identify the exact failing operation and its error. An external connection can also fail because of a blocked destination, DNS problem, certificate verification issue or timeout. Record the current value so you can reverse an unnecessary configuration change.

01 Change the setting

  1. In cPanel, search for Select PHP Version and open the CloudLinux tool. It is commonly listed under Software. Select the intended domain if your installation displays a domain selector.
  2. Check the active PHP version and which websites the selector change will affect. cPanel may also offer MultiPHP Manager and MultiPHP INI Editor. These tools manage a different PHP configuration path. Identify whether the domain uses CloudLinux Alt-PHP or a native EasyApache PHP handler before editing.
  3. Open Options and locate allow_url_fopen.
  4. Set the value required by the application and save if requested. Leave allow_url_include disabled unless a qualified administrator has a specific justified requirement; it is not needed merely to fetch an HTTPS document.
  5. Retry the original operation against a trusted, expected endpoint. Verify the application still validates user-supplied URLs and does not fetch arbitrary internal addresses.

Confirm the expected result

Confirm the effective value in the application's diagnostics and test the original download or remote read. If the software uses cURL, changing this option may have no effect because cURL follows its own configuration and certificate validation.

Why can a remote request still fail with allow_url_fopen enabled?

A certificate error needs a valid remote certificate or trust configuration, not disabled TLS verification. If the control is unavailable or reverts, it may be restricted by server policy. Give support the application feature, destination hostname and error without exposing private URLs or access tokens.

Was this answer helpful?

Need a little more help?

Our support team can help you find the next step.

Contact support

Powered by WHMCompleteSolution