Enable allow_url_fopen in php ini

This article describes how to enable and disable the allow_url_fopen directive in a custom php.ini file.

The information in this article only applies to certain types of hosting accounts. To determine whether or not the information below applies to your account, please see this article.

This article assumes that you have already set up a custom php.ini file on your web site. If you have not already set up a custom php.ini file, please read this article first.

Using the allow_url_fopen directive

The allow_url_fopen directive is disabled by default. You should be aware of the security implications of enabling the allow_url_fopen directive. PHP scripts that can access remote files are potentially vulnerable to arbitrary code injection.

When the allow_url_fopen directive is enabled, you can write scripts that open remote files as if they are local files. For example, you can use the file_get_contents function to retrieve the contents of a web page.

To enable this functionality, use a text editor to modify the allow_url_fopen directive in the php.ini file as follows:

allow_url_fopen = on

To disable this functionality, modify the allow_url_fopen directive in the php.ini file as follows:

allow_url_fopen = off

To verify the current value of the allow_url_fopen directive and other directives, you can use the phpinfo() function. For more information, please see this article.

More Information

  • To view a complete list of php.ini directives, please visit http://www.php.net/manual/en/ini.list.php.
  • For more information about the allow_url_fopen directive, please visit http://www.php.net/manual/en/filesystem.configuration.php#ini.allow-url-fopen.
  • For more information about the file_get_contents function, please visit http://www.php.net/file_get_contents.

We are going to see:

Introduction Introduction

allow_url_fopen is a filesystem and streams configuration option. Which enables the URL-aware fopen() wrappers that enable accessing URL objects like files.

If allow_url_fopen() is enabled then by default we can access remote files using the FTP or HTTP protocol.

Also, extensions like zlib may register additional wrappers.

Top ↑

Issue Issue

We could not use the fopen() if the option allow_url_fopen is DISABLED from the server.

If it is enabled then you can disable it for testing purposes by adding code allow_url_fopen=Off in your php.ini file. Also, After updating the php.ini file don’t forget to restart the apache server.

Now, Let’s assume that we have below code in the file C:/xampp/htdocs/tutorials/index.php:

Note: We can use function ini_get() https://www.php.net/manual/en/function.ini-get.php to check the value of a server configuration. We have checked the value of allow_url_fopen as ini_get( 'allow_url_fopen' ). By default allow_url_fopen returns the boolean value.

We check the code by executing the PHP file with command line with below steps:

  • Open terminal or command prompt.
  • Goto C:/xampp/htdocs/tutorials/ with command cd C:/xampp/htdocs/tutorials/
  • Now execute command php index.php

You can see something similar in your terminal window.

$ php index.php
allow_url_fopen is DISABLED.
PHP Warning:  fopen(): http:// wrapper is disabled in the server configuration by allow_url_fopen=0 in C:\xampp\htdocs\tutorials\index.php on line 9
PHP Stack trace:
PHP   1. {main}() C:\xampp\htdocs\tutorials\index.php:0
PHP   2. fopen() C:\xampp\htdocs\tutorials\index.php:9

Warning: fopen(): http:// wrapper is disabled in the server configuration by allow_url_fopen=0 in C:\xampp\htdocs\tutorials\index.php on line 9

Call Stack:
    0.4036     406560   1. {main}() C:\xampp\htdocs\tutorials\index.php:0
    0.4037     406592   2. fopen() C:\xampp\htdocs\tutorials\index.php:9

Variables in local scope (#1):
  $file = *uninitialized*

PHP Warning:  fopen(http://www.example.com/): failed to open stream: no suitable wrapper could be found in C:\xampp\htdocs\tutorials\index.php on line 9
PHP Stack trace:
PHP   1. {main}() C:\xampp\htdocs\tutorials\index.php:0
PHP   2. fopen() C:\xampp\htdocs\tutorials\index.php:9

Warning: fopen(http://www.example.com/): failed to open stream: no suitable wrapper could be found in C:\xampp\htdocs\tutorials\index.php on line 9

Call Stack:
    0.4036     406560   1. {main}() C:\xampp\htdocs\tutorials\index.php:0
    0.4037     406592   2. fopen() C:\xampp\htdocs\tutorials\index.php:9


Variables in local scope (#1):
  $file = *uninitialize

The issue with Composer Update: The issue with Composer Update:

If you try the composer update command then you can see something like below error:

MaheshW@DESKTOP-5E1INLB C:\xampp\htdocs\developer.wordpress.org\wp-content\plugins\phpdoc-parser
 $ composer update
 Loading composer repositories with package information
 The "https://repo.packagist.org/packages.json" file could not be downloaded: allow_url_fopen must be enabled in php.ini (https:// wrapper is disabled in the server configuration by allow_url_fopen=0
 failed to open stream: no suitable wrapper could be found)
 https://repo.packagist.org could not be fully loaded, package information was loaded from the local cache and may be out of date
 Updating dependencies (including require-dev)
 [Composer\Downloader\TransportException]
   The "http://repo.packagist.org/p/scribu/lib-posts-to-posts%24375806a5270591820170d67f4467d3f709c9e02e790b81753f82c8c15ea5cebd.json" file could not be downloaded: allow_url_fopen must be
   enabled in php.ini (http:// wrapper is disabled in the server configuration by allow_url_fopen=0
   failed to open stream: no suitable wrapper could be found)
 update [--prefer-source] [--prefer-dist] [--dry-run] [--dev] [--no-dev] [--lock] [--no-custom-installers] [--no-autoloader] [--no-scripts] [--no-progress] [--no-suggest] [--with-dependencies] [--with-all-dependencies] [-v|vv|vvv|--verbose] [-o|--optimize-autoloader] [-a|--classmap-authoritative] [--apcu-autoloader] [--ignore-platform-reqs] [--prefer-stable] [--prefer-lowest] [-i|--interactive] [--root-reqs] [--] []…

Top ↑

Fix/Solution Fix/Solution

Open the php.ini file and search allow_url_fopen.

If you find it then change allow_url_fopen=Off with allow_url_fopen=On.

If you have not found the allow_url_fopen then simply add the allow_url_fopen=On.

After adding the allow_url_fopen=On our server support the fopen().

Now execute the same code as below:

$ php index.php
allow_url_fopen is ENABLED.

For more information visit: https://www.php.net/manual/en/filesystem.configuration.php#ini.allow-url-fopen

Post navigation

How do you Allow_url_fopen must be enabled in PHP INI?

# Fix/Solution Open the php. ini file and search allow_url_fopen . If you find it then change allow_url_fopen=Off with allow_url_fopen=On . If you have not found the allow_url_fopen then simply add the allow_url_fopen=On .

How do you enable allow url include in htaccess?

If it is not On, then you can try two things..
Create an . htaccess file and keep it in root folder ( sometimes it may need to place it one step back folder of the root) and paste this code there. php_value allow_url_fopen On..
Create a php. ini file (for update server php5..

What is the use of Allow_url_fopen?

allow_url_fopen can be used to retrieve data from remote servers or websites. However, if incorrectly used, this function can compromise the security of your site.

What is Default_socket_timeout PHP?

default_socket_timeout int. Default timeout (in seconds) for socket based streams. Specifying a negative value means an infinite timeout.