Turn Off Risky PHP Functions

What is a PHP function?

PHP is the language behind many websites, such as WordPress. A function is a ready-made action in that language. For example, one function can run a command on the server.

Some functions are risky. If a hacker slips bad code onto your site, these functions let the code do real harm. Turning them off makes your site safer.

The list of disabled functions is a setting called disable_functions.

Commonly disabled functions

• exec
• passthru
• shell_exec
• system
• popen
• proc_open

These all run commands on the server.

Steps in cPanel

1. Log in to your control panel.
2. Search for MultiPHP INI Editor and click it.
3. Choose Editor Mode. Select your domain from the list.
4. Find disable_functions in the text.
5. Copy the old value into a notepad as a backup.
6. Add the function names you want to turn off. Separate them with commas, like this:

disable_functions = exec,passthru,shell_exec,system,popen,proc_open

This tells PHP not to allow those six functions.

7. Click Save.
8. Open your site and test all the main pages and forms.

Your panel may look different. If you do not see this tool, ask Hostvento support. You can open a support ticket.

If something breaks

1. Go back to the editor.
2. Remove the function that the broken feature needs.
3. Save and test again.

The error message often names the missing function. Look at your site's error log to find it.

Quick recap

• Risky PHP functions can run commands on the server.
• Disable them with disable_functions.
• Use the MultiPHP INI Editor in cPanel.
• Keep a copy of the old value.
• Test your site and undo if a feature breaks.