Restrict PHP functions without breaking your application

PHP includes functions that can run processes, open connections or interact with the system. Some applications need them and others do not.

disable_functions can reduce what PHP code that is already running is able to do, but it does not fix a vulnerability or replace updates, isolation, least privilege or the investigation of an intrusion.

In cPanel > Select PHP Version > Options, look for disable_functions, if the selector allows it. Confirm the version and the scope it applies to; several websites may share that configuration.

Do not delete the existing configuration or copy a generic list. Write down its current value and disable only the functions you have checked the application does not need. As a starting point for an application that does not run system processes, you can assess functions such as these one by one:

exec,passthru,proc_open,shell_exec,system

Do not include eval: it is a language construct and disable_functions cannot disable it. Do not disable network, file, process or logging functions either without first checking the application's dependencies and scheduled tasks.

After each change, check that the websites, scheduled tasks and maintenance processes all work fully. If a function is needed, enable it again and apply a suitable control in another layer.

Check web requests and console commands separately, as they may use different PHP configurations. Do not try to change this directive with ini_set() inside the application: PHP treats it as a system setting.

Since PHP 8, a disabled function is no longer defined and user code can define another one with that name. That is why it should not be seen as a sufficient isolation barrier. The PHP documentation explains its limits.