How to Limit Available PHP Versions in the MultiPHP Manager


Last modified: August 28, 2019

Overview

In cPanel & WHM version 70, we added the ability to only display specific versions of PHP to a user on systems that run EasyApache 4 You may wish to limit an account’s visible PHP versions for a variety of reasons, including to limit access to legacy versions of PHP or to prevent an early upgrade to a newer version of PHP.

Note:
You can only use this feature on systems that run EasyApache 4.
Important:

A user can bypass the the PHP version restrictions if they set the the PHP version manually in an .htaccess file. This feature only prevents the selection of a PHP version in cPanel's MultiPHP Manager interface (cPanel >> Home >> Software >> MultiPHP Manager). Bug bounties do not apply.

How to set up restrictions

Limitations on an account’s PHP versions requires a Feature List, an account package, and installed PHP versions. When you install a PHP version on your system, all accounts can access the version by default. You must add a limitation if you do not wish to make the version visible to all users.

To create limitations for specific versions of PHP, perform the following steps:

  1. Create a new feature list or modify an existing one in WHM’s Feature Manager interface (WHM >> Home >> Packages >> Feature Manager).

  2. Deselect any PHP versions that you wish to limit visibility of for your users.

    Note:
    • When you install a new version of PHP on your server, all users can access it by default.
    • Limitations apply to all PHP versions available in EasyApache 4, including custom PHP packages.

  3. Either create a new package in WHM’s Add a Package interface (WHM >> Home >> Packages >> Add a Package), or modify an existing one in WHM’s Edit a Package interface (WHM >> Home >> Packages >> Edit a Package).

  4. Assign the feature list to your selected package.

  5. Assign the package to the users for which you wish to limit PHP in WHM’s Modify an Account interface (WHM >> Home >> Account Functions >> Modify an Account).

Limitations

If you set PHP limitations for a user’s account, the user cannot select the limited PHP versions in cPanel’s MultiPHP Manager interface (cPanel >> Home >> Software >> MultiPHP Manager). A system administrator can still assign a user to a limited PHP version. This allows a user to remain on a legacy version of PHP, but not to revert to that version via the interface if they move to a different version of PHP.

Additional Documentation