Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am receiving an open_basedir restriction at random times when consumers are finishing an enrollment on my website.

I am able to complete the enrollment process just fine from my machine, as well as two other test machines but it appears some clients are unable to do so.

When I check my error logs, i find the following:

[Tue Feb 01 11:55:24 2011] [error] [client 11.222.333.444] PHP Warning: require() [function.require]: open_basedir restriction in effect. File(../phpmailer/class.phpmailer.php) is not within the allowed path(s): (/var/www/vhosts/aabbenefits.com/httpdocs:/tmp) in /var/www/vhosts/site.com/httpdocs/dir/email_inc.php on line 3, referer: https://www.site.com/previouspage

[Tue Feb 01 11:55:24 2011] [error] [client 11.222.333.444] PHP Warning: require(../phpmailer/class.phpmailer.php) [function.require]: failed to open stream: Operation not permitted in /var/www/vhosts/site.com/httpdocs/dir/email_inc.php on line 3, referer: https://www.site.com/previouspage

[Tue Feb 01 11:55:24 2011] [error] [client 11.222.333.444] PHP Fatal error: require() [function.require]: Failed opening required '../phpmailer/class.phpmailer.php' (include_path='.:') in /var/www/vhosts/site.com/httpdocs/dir/email_inc.php on line 3, referer: https://www.site.com/previouspage

can somebody please provide any suggestions?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

As Alvosu said, it's not just php.ini that can contain open_basedir. It is also commonly found in virtual host conf files of httpd.conf itself. Possibly even in .htaccess files.

Plesk also has a tendency to put this in to every vhost conf it creates. If you're running Plesk, you'll see the generated configuration in /var/www/vhosts/site.com/conf/httpd.include. That probably has a line php_admin_value open_basedir "/var/www/vhosts/site.com/httpdocs:/tmp" (which is the format it normally is in). To fix that, don't edit the httpd.include file, as it gets overwritten by Plesk anyway. Instead, create a file called vhost.conf in the same folder. The contents should be something like:

<Directory /var/www/vhosts/site.com/httpdocs>
php_admin_value open_basedir none

(or some other value rather than none). Then, when you've created this file, go into Plesk and just enter the hosting setup for the site.com domain and save it without any changes. This will cause Plesk to detect the vhost.conf file and include it in its generated httpd.include file.

share|improve this answer

Disable open_basedir, edit php.ini(or .htaccess or virtual host conf):

open_basedir none

or add '/var/www/vhosts/site.com' to open_basedir

open_basedir /var/www/vhosts/aabbenefits.com/httpdocs:/var/www/vhosts/site.com/httpdocs:/tmp
share|improve this answer
according to my php.ini file, my open_basedir is disabled. however, when i run a security scan, I find out it is not only enabled, but has the following value: /var/www/vhosts/site.com/httpdocs:/tmp –  JM4 Feb 1 '11 at 18:52
# find /etc/ -type f -exec grep open_basedir {} \; -print –  alvosu Feb 1 '11 at 18:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.