WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

recently installed some debugging software on our server and realised that most errors are coming from realpath() in Wordpress sites.

realpath() [<a href='function. realpath'>function. realpath</a>]: open_basedir restriction in effect. File(/var/www/vhosts/ xxx. com) is not within the allowed path(s): (/var/www/vhosts/ xxx. com/httpdocs/:/tmp/)

The sites are working OK but these are bugging me. Mostly because its hard to see any serious errors coming up!

Would errors like this also affect performance?

share|improve this question
This is a PHP question not a WordPress one, you're passing paths into realpath that are outside the apache allowable area, stackoverflow.com/questions/1846882/… – Tom J Nowell Feb 20 '13 at 11:04
maybe - but a lot of Wordpress users have found a solution to this by changing Wordpress settings. And its curious that it would be built with this error but still work? – daniel Crabbe Feb 20 '13 at 11:22
You dont mention what URL was called or where the call to realpath was made. The problem lies in accessing folders you have no business accessing ( as far as your php.ini is concerned ). If you have examples of people changing WordPress settings please provide links so that others can see, else all I see is a standard PHP core function being called on something it has been told it is not allowed to touch. – Tom J Nowell Feb 20 '13 at 11:26
its getting flagged on most pages and leads back to wp-config.php. ie in realpath called at /var/www/vhosts/xxx.com/httpdocs/wp-config.php (4) &hellip; WP_LOCATION called at /var/www/vhosts/xxx.com/httpdocs/wp-config.php (22) in require_once called at /var/www/vhosts/xxx.com/httpdocs/wp-load.php (29) &hellip;re_once called at /var/www/vhosts/xxx.com/httpdocs/wp-admin/admin.php (30) &hellip;re_once called at /var/www/vhosts/xxx.com/httpdocs/wp-admin/tools.php (10) – daniel Crabbe Feb 20 '13 at 11:29
can you edit your question to include the line of code and the surrounding code, also are you making use of symbolic links? – Tom J Nowell Feb 20 '13 at 11:34
up vote 1 down vote accepted

Looks like you are using one of the hacks to have the same wp-config.php file in development and deployment environments. AS it is noted at the end of that page, the hack were not tested in restricted environments like your. If you are not in development phase anymore then you should change your code in wp-config.php and manually set the constants instead of relying on location detection.

share|improve this answer
yes - realised last night ! We moved all a bunch of stuff to a testing server and never removed it once it was live. Still have some errors flagging up but only a small % compared to before. Dc – daniel Crabbe Feb 21 '13 at 13:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.