How to Enable or Disable PHP's allow_url_fopen Using CloudLinux Selector in DirectAdmin

allow_url_fopen is the PHP directive that decides whether your code may treat a remote URL as though it were a local file. With it switched on, functions such as file_get_contents(), fopen(), copy() and getimagesize() will accept https://example.com/feed.xml in place of a path on disk. With it switched off, those same calls fail on anything that is not a local file.

On Noiz DirectAdmin hosting that runs CloudLinux, you control this yourself from the Select PHP version tool, commonly called the CloudLinux PHP Selector. No support ticket and no server-level access are needed. This guide shows you where the toggle lives in DirectAdmin, what enabling it genuinely exposes, and why the setting sometimes appears to ignore you.

Last reviewed: 27 July 2026, against the current DirectAdmin release with the Evolution interface, and the current CloudLinux PHP Selector release. This guide is written for Noiz hosting and is kept current against DirectAdmin and CloudLinux. It complements, and does not replace, the official documentation linked below.

Official Documentation Reference

• PHP: Filesystem and Streams Configuration Options: the authoritative definition of allow_url_fopen, including its default value and the fact that it is an INI_SYSTEM setting.
• PHP: Using Remote Files: how the URL-aware stream wrappers behave once the directive is enabled.
• CloudLinux OS Components: PHP Selector: how the Selector stores per-account PHP settings, and what its limitations are.
• DirectAdmin documentation: reference for the DirectAdmin user interface itself.
• OWASP: Server Side Request Forgery: the attack class that an enabled allow_url_fopen makes easier to reach through vulnerable code.

Prerequisites

• A Noiz DirectAdmin hosting account and its login details.
• An account set to a numbered CloudLinux PHP version rather than native. If you are still on native, change it first using How to Change the PHP Version via CloudLinux Selector in DirectAdmin.
• A clear reason for the change. Knowing which script or plugin needs remote file access makes the troubleshooting section far shorter if something breaks.

Before You Change It: What allow_url_fopen Actually Exposes

PHP ships with allow_url_fopen set to 1, so on most accounts it is already on and most people never think about it. It is worth thinking about, because the directive does not grant a capability to your application so much as it grants a capability to every line of PHP running under your account, including code you did not write and have not read.

• It turns file functions into network clients. Anywhere your code passes a variable into file_get_contents(), fopen(), copy() or a similar call, an attacker who can influence that variable can point it at a URL instead of a path. That is the standard route to server-side request forgery, where your own server is used to reach things the attacker cannot reach directly, such as an internal service, a local admin interface, or a cloud metadata endpoint.
• It widens the blast radius of one bad plugin. A single unpatched plugin with a careless file handler becomes considerably more useful to an attacker when remote URLs are accepted. Disabling the directive does not fix the plugin, but it removes an entire category of exploitation from a vulnerability you have not found yet.
• It is a prerequisite for something worse. The related allow_url_include directive, which would let include and require pull in remote code, only functions when allow_url_fopen is on. allow_url_include defaults to off and has been deprecated since PHP 7.4. It should stay off permanently. Leave it alone.
• Turning it off is rarely as disruptive as people expect. The cURL extension is a completely separate mechanism and is unaffected by this directive. Well-written applications prefer cURL for outbound requests, so they keep working with allow_url_fopen disabled. What tends to break is older or lazier third-party code that calls file_get_contents() straight on a URL.

The practical position: leave it on if something you rely on genuinely needs it, and turn it off if nothing does. If you are unsure which applies to your site, disable it on a quiet day and watch for errors rather than guessing.

Enable or Disable allow_url_fopen

1. Open Select PHP version

Log in to your DirectAdmin account. On the dashboard, find the Extra Features section and click Select PHP version. If the section is collapsed or the icon is not where you expect it, type Select PHP into the navigation filter box at the top of the left-hand menu and click the result.

2. Open the Options tab

The PHP Selector opens with its own navigation bar across the top: My domains, Extensions and Options. Click Options.

Note: if the Options tab is empty or shows an error mentioning the native PHP version, check the Current PHP version shown on the page. When the account is set to native, the server manages PHP directly and the Selector cannot edit its directives, so there is nothing for the Options tab to show. Switch to a numbered version first, then come back here.

3. Set the directive

Find allow_url_fopen in the list of directives. Tick the checkbox to enable it, or clear the checkbox to disable it.

4. Let the change save

The Selector saves each directive as you change it, so there is no separate submit button to press. Wait for the on-screen confirmation before you navigate away, and allow a few seconds for it to apply. Nothing needs restarting from your side.

Confirm the Setting Took Effect

Do not trust the checkbox alone. Create a file called phpinfo.php in your public_html directory containing:

<?php phpinfo();

Load https://yourdomain.com/phpinfo.php in your browser, replacing yourdomain.com with your own domain, and search the page for allow_url_fopen. The Local Value column is the one that matters.

Delete the file as soon as you have read it. A phpinfo() page left in place publishes your full server configuration, module list and filesystem paths to anyone who finds the URL, and automated scanners look for exactly that filename.

Things the Toggle Does Not Do

• It does not travel with you between PHP versions. The Selector stores directive values separately for each PHP version. Change your PHP version later and the new version starts on its own defaults, so a carefully disabled allow_url_fopen can quietly switch back on. Re-check the Options tab after every version change.
• It cannot be overridden from your code. allow_url_fopen is an INI_SYSTEM directive, which means ini_set('allow_url_fopen', '1') inside a script has no effect. The same applies to a php_value line in .htaccess. The Selector, or a support request, is the only route.
• It applies to the whole DirectAdmin account. Every domain, subdomain and parked domain under the account shares the setting. You cannot enable it for one site and disable it for another within the same account.
• It has no effect on cURL. Scripts that use curl_exec() to fetch remote content carry on regardless of this setting, in both directions. Disabling allow_url_fopen is not a way to stop outbound HTTP requests from your account.

Troubleshooting

• Symptom: the Options tab is empty, or errors about the native PHP version. The account is running native PHP, which the Selector does not manage. Change to a numbered PHP version and try again.
• Symptom: file_get_contents(): https:// wrapper is disabled in the server configuration. That is precisely what a disabled allow_url_fopen looks like. Either enable it, or better, change the offending code to use cURL.
• Symptom: the checkbox is ticked but phpinfo() still reports Off. Confirm that the version shown in the Selector is the version your site is actually running. Editing directives while a different version is selected is the usual cause. Clear any opcode or full-page cache, then check again.
• Symptom: allow_url_fopen is not in the directive list at all. Some server configurations lock the directive. Open a ticket with Noiz support stating which value you need and why.
• Symptom: an installer or plugin insists allow_url_fopen is required. Check whether the requirement is real before enabling it. Many installers list it as a preference and fall back to cURL without complaint. If it genuinely is required, enable it, but treat that dependency as a reason to review how well maintained the software is.

Related Guides

• How to Change the PHP Version via CloudLinux Selector in DirectAdmin
• How to Enable or Disable PHP Extensions Using the CloudLinux Selector in DirectAdmin

If a script needs allow_url_fopen and you would rather not leave it enabled, or a site stopped working the moment you changed it, open a ticket with Noiz support. Include your domain name, the PHP version shown in the Selector, and the exact error text. On managed plans, Noiz will review which of your scripts genuinely depend on remote file access and help you move them across to cURL instead.