The error "Warning: system() has been disabled for security reasons" means your PHP script is trying to execute a system command, and that function has been disabled on the server. This is intentional. On shared hosting, functions like system(), exec(), passthru(), and shell_exec() are disabled because they allow PHP scripts to run operating system commands, which is a major security risk in a shared environment.
These Functions Cannot Be Enabled on Shared Hosting
Functions like system(), exec(), and shell_exec() are disabled server-wide on shared hosting for security. This is not a per-account setting and cannot be changed by support request. If your application requires these functions, you need a VPS or dedicated server.
01. Why These Functions Are Disabled
On shared hosting, hundreds of accounts share the same server. If one account's PHP script could execute system commands, a compromised script (from a hacked WordPress plugin, for example) could read other users' files, send spam, install malware, or even take over the server.
Disabling these functions is an industry-standard security practice. Every major shared hosting provider does it. CloudLinux's CageFS provides additional isolation, but disabling dangerous PHP functions is the first line of defense.
02. Full List of Disabled Functions
The following PHP functions are disabled on our shared hosting servers:
system, exec, shell_exec, passthru, popen, proc_open,
proc_close, proc_get_status, proc_nice, proc_terminate,
pcntl_exec, pcntl_fork, pcntl_signal, pcntl_waitpid,
pcntl_wexitstatus, pcntl_setpriority, pcntl_getpriority,
show_source, escapeshellcmd, escapeshellargYou can see the full list for your account by checking phpinfo() output. Look for the disable_functions directive.
03. Alternatives and Workarounds
PHP Has Built-In Replacements for Most Tasks
Most uses of system() and exec() in PHP scripts have pure-PHP alternatives:
- File operations - use PHP's
file_get_contents(),file_put_contents(),copy(),rename(),unlink()instead of calling shell commands likecp,mv,rm - Directory operations - use
mkdir(),rmdir(),scandir(),glob() - Image processing - use PHP's GD library or ImageMagick PHP extension instead of calling the
convertcommand - Sending email - use PHP's
mail()function or a library like PHPMailer instead of callingsendmaildirectly - HTTP requests - use
curlfunctions (the PHP extension, not the CLI tool) orfile_get_contents()with stream contexts - Compression - use PHP's ZipArchive class or gzip functions instead of calling
tarorzip
WordPress Plugins That Trigger This Error
Some WordPress plugins try to use exec() for tasks like image optimization (calling optipng or jpegoptim), backups (calling mysqldump), or security scanning. These plugins usually have a fallback mode that works without shell access. Check the plugin's settings for an option like "Use PHP method" or "Disable shell commands."
If a WordPress plugin shows this warning in your error log but the plugin still works, you can usually ignore it. The plugin is trying the fast path (shell command), failing, and falling back to the slower PHP method. It's noisy but harmless.
04. Need These Functions? Consider a VPS
If your application genuinely requires system(), exec(), or other shell functions, a VPS or dedicated server is the right choice. On a VPS, you have root access and full control over PHP configuration, including which functions are enabled.
Common applications that need shell functions include: custom deployment scripts, video/audio processing, machine learning pipelines, and applications that shell out to command-line tools.
See our hosting comparison guide or view our VPS and dedicated server plans.
Not Sure If You Need Shell Functions?
If you're getting this error and aren't sure how to work around it, open a ticket with the exact error message and the application you're running. We can often suggest an alternative approach.
Open a Support TicketFrequently Asked Questions
Why is system() disabled for security reasons on my hosting?
Functions like system(), exec(), passthru(), and shell_exec() let PHP run operating-system commands, which is a serious risk on shared hosting where many accounts share a server. They are disabled on purpose to keep one account from running commands that could affect the server or other users.
Which PHP functions are disabled on shared hosting?
The shell-execution family is disabled, including system(), exec(), passthru(), shell_exec(), proc_open(), and popen(). These all allow running external programs. Standard PHP for building websites and applications does not need them, so most software runs fine without them.
How do I run a script that needs exec() or system()?
Look for a native PHP alternative first, since many tasks that scripts shell out for can be done with PHP functions or libraries directly. If the software genuinely requires shell execution, it is not suited to shared hosting and you should run it on a VPS or dedicated server where you control the PHP configuration.
Can I re-enable disabled PHP functions on shared hosting?
No. These functions are disabled server-wide for security and cannot be re-enabled on a shared account. If your application truly needs them, a VPS or dedicated server gives you root access to set your own disable_functions list.
Quick Recap
If you only do 5 things from this guide, do these:
- system(), exec(), shell_exec() are disabled - this is a security requirement on shared hosting
- Cannot be enabled per-account - it's a server-wide setting
- Use PHP built-in functions instead - most shell tasks have pure-PHP equivalents
- Check plugin settings - many plugins have a "PHP mode" fallback
- Need shell access? Get a VPS - full control over PHP configuration
Last updated November 2026 · Browse all PHP articles
