I have a Wordpress site running on my local network. I want to disable dangerous functions like system and exec as a safety precaution. This site is run with a simple PHP server instead of apache2 or nginx.

php -S -f /var/www/html/wordpress/

Since, disabling functions in the /etc/php/7.x/apache2/php.ini won't matter. I could disable these functions in the /etc/php/7.x/cli/php.ini, but I just want them to be disabled to the Wordpress site.Is there a way that I can go around this. My final goal is to prevent execution of those functions through the Wordpress site.

  • For the record, this question is likely off-topic and not related to WordPress. Better to ask this kind of question over at Stack Overflow.
    – ScottM
    Commented Sep 11, 2021 at 20:55

1 Answer 1


Create a php.ini file for your WP instance and add the disable_functions directive to it. Then, start the PHP server with -c option, such as php -S -c /path/to/php.ini -f /var/www/html/wordpress/.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.