How to prevent filesystem browsing with php shell scripts?

Leo Mastropierro

Updated November 19, 2025 17:55

kb: how-to Plesk for Linux ABT: Group A

Applicable to:

PHP shell script was uploaded under the home directory of subscription.

How to prevent filesystem browsing with php shell scripts?

It's possible to disable shell_exec and other functions in PHP by using the disable_functions directive:

Warning: Applications may rely on these functions and may not work properly when restrictions are applied.

For Plesk Onyx 17.8 and newer

Login to Plesk
Navigate to Domains > example.com > PHP Settings
Set the following value to the disable_functions:

CONFIG_TEXT: opcache_get_status,exec,passthru,shell_exec,system,proc_open,popen

Note: To set the restriction to multiple domains at once, this value can be specified in Service Plans > <service_plan> > PHP Settings > disable_functions, or apply it globally for a PHP handler as specified in this article.

For Plesk Onyx 17.5 and older

Login to Plesk
Navigate to Domains > example.com > PHP Settings
Add the following line under Additional configuration directives and apply the changes:

CONFIG_TEXT: disable_functions=opcache_get_status,exec,passthru,shell_exec,system,proc_open,popen