How to Disable PHP Functions from WHM Panel

Disabling PHP functions via the WHM panel is helpful for system administrators who want to make their servers more secure. It is a versatile scripting language that provides many features. However, some functions could prove dangerous if applied inappropriately. The following is an example of how some risks can be managed: Disabling specific PHP functions.

This guide provides a comprehensive overview of disabling PHP functions via the WHM panel.

Understanding the Need to Disable PHP Functions

PHP functions enable server interaction and command execution like exec() 

- shell_exec()

- system()

- passthru()

While useful, malicious users can exploit these functions to execute arbitrary commands. It leads to potential server compromises. Disabling such functions helps in reducing the attack surface of your server. Thereby bolstering its security posture.

Accessing WHM and Navigating to the PHP Configuration

Log in to your WHM panel using your root or administrative credentials.

You can access it via a URL like `https://yourdomain.com:2087`. 

Once signed-in, follow these steps:

Locate the PHP Configuration Editor

 In the WHM dashboard, use the search bar on the left-hand side and type "PHP Configuration Editor."

You will find two options: Basic Mode and Advanced Mode. 

Click on PHP Configuration Editor under either of these modes. The Basic Mode suffices for our purposes, but the Advanced Mode offers more detailed settings.

Editing PHP Configuration

Open Basic Mode

In the PHP Configuration Editor, choose Basic Mode to access the common PHP settings. This mode provides a user-friendly interface for making changes without delving into complex configurations.

Disable Functions

Scroll down until you find the `disable_functions` directive. This setting allows you to specify which PHP functions should be disabled.

To disable functions, enter their names in the text box next to `disable_functions,` separated by commas. For instance:

exec,passthru,shell_exec,system

Ensure that there are no spaces between the function names and commas. This directive instructs PHP to disable the listed functions, preventing them from being executed on the server.

Applying and Saving Changes

Save Changes

After adding the desired functions to the `disable_functions` list, scroll down and click the Save button to apply the changes. This action updates the PHP configuration, and the specified functions will now be disabled server-wide.

Advanced Mode for Detailed Configuration

Using Advanced Mode (Optional)

In the PHP Configuration Editor, you can switch to Advanced Mode for more granular control. This mode allows you to edit the `php.ini` file directly.

Locate the `disable_functions` line in the `php.ini` file. If it doesn’t exist, you can add it manually:

disable_functions = exec,passthru,shell_exec,system

Save the changes after editing.

Verifying Changes

Verification

You can create a PHP info file to ensure the changes have been applied correctly. Create a file named `info.php` in your web root directory with the following content:

Access this file via your web browser (e.g., `https://yourdomain.com/info.php`) and search for the `disable_functions` directive in the output. It should list all the functions you disabled.

Best Practices and Considerations

Test Before Implementing

Before disabling functions, test their impact in a staging environment. Some functions might be essential for certain applications.

Security Plugins

Consider using security plugins and tools that offer additional layers of protection beyond just disabling PHP functions.

Regular Updates

Keep your PHP version and server software up to date to mitigate vulnerabilities.

Audit Logs

Regularly review your server logs to identify any attempts to use disabled functions.

To Sum it Up!

Disabling PHP functions from the WHM panel is a straightforward yet powerful method of enhancing your server's security. By carefully selecting and disabling high-risk functions, you can prevent potential exploits and ensure a more secure hosting environment. Always remember to test changes and understand their implications to maintain the functionality of your web applications while safeguarding your server against malicious activities.