allow_url_fopen controls whether PHP file functions can use supported URL wrappers, such as reading an HTTPS resource with a file-handling function. It is separate from cURL and from allow_url_include. A change should follow the application's documented needs.
IN THIS ARTICLE
Check access and requirements
Identify the exact failing operation and its error. An external connection can also fail because of a blocked destination, DNS problem, certificate verification issue or timeout. Record the current value so you can reverse an unnecessary configuration change.
01 Change the setting
- In Plesk, select the correct subscription and open PHP Selector from the available sidebar or additional tools. This guide applies to Linux subscriptions where the CloudLinux integration is installed. Windows Plesk uses its own PHP configuration.
- Check the active PHP version and which websites the selector change will affect. Plesk also has a native PHP Settings page for each domain. A CloudLinux setting will not automatically override a different Plesk PHP handler. Confirm which handler serves the website first.
- Open Options and locate allow_url_fopen.
- Set the value required by the application and save if requested. Leave
allow_url_includedisabled unless a qualified administrator has a specific justified requirement; it is not needed merely to fetch an HTTPS document. - Retry the original operation against a trusted, expected endpoint. Verify the application still validates user-supplied URLs and does not fetch arbitrary internal addresses.
Confirm the expected result
Confirm the effective value in the application's diagnostics and test the original download or remote read. If the software uses cURL, changing this option may have no effect because cURL follows its own configuration and certificate validation.
Why can a remote request still fail with allow_url_fopen enabled?
A certificate error needs a valid remote certificate or trust configuration, not disabled TLS verification. If the control is unavailable or reverts, it may be restricted by server policy. Give support the application feature, destination hostname and error without exposing private URLs or access tokens.