Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top
  1. Can I use an includes folder on one website and set up "trusted domains/IPs" that are allowed to access the files in this folder (all other domains/IPs are restricted)? All the sites are on the same shared hosting server, the global site has a dedicated IP, the others share a different IP.

  2. Is this too insecure to allow PHP includes across domains?

  3. If this scenario is not possible to configure, are there some alternatives to share server-side files globally and relatively securely?

Edit: Server is Apache

When including files across domains it gives the error:

Warning: include(/home/user1/public_html/file.php) [function.include]:
failed to open stream: Permission denied in /home/user2/public_html/file.php
share|improve this question
What web server is this? – Sam Oct 22 '09 at 9:18

If all the websites are on a shared server you can make a folder readable and they can include that way. Say /blah/globalphpshare/ and user 'homer' wants to use greet.php he/she could simply do include("/blah/globalphpshare/greet.php");

share|improve this answer
Yes. The includes are done locally through the filesystem, nothing has to do with domains or IPs. I would go with MrStatic's solution. If you can't get access to something logical (I like to put site-wide PHP stuff in /usr/local/share/php) you could just try to make sure that /home/user1/public_html/file.php and the directories above it are world readable. – Jason Antman Oct 22 '09 at 13:06

If your host enables webroot protection in apache, the file system path will not work, but you may still be able to include like this:

<?php include(''); ?>

The main differences are that the included file only sees the variables you passed it in the string, and what is returned is the HTML that php parsed out of the file on the source domain. Depending on what's in the included file, that may be okay.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.