In cPanel & WHM version 70, we added the ability to only display specific versions of PHP to a user on systems that run EasyApache 4. You may wish to limit an account's visible PHP versions for a variety of reasons, including to limit access to legacy versions of PHP or to prevent an early upgrade to a newer version of PHP.
You can only use this feature on systems that run EasyApache 4.
A user can bypass the the PHP version restrictions if they set the the PHP version manually in an
.htaccess file. This feature only prevents the selection of a PHP version in cPanel's MultiPHP Manager interface (cPanel >> Home >> Software >> MultiPHP Manager). Bug bounties do not apply.
How to set up restrictions
Limitations on an account's PHP versions requires a Feature List, an account package, and installed PHP versions. When you install a PHP version on your system, all accounts can access the version by default. You must add a limitation if you do not wish to make the version visible to all users.
To create limitations for specific versions of PHP, perform the following steps:
- Create a new feature list or modify an existing one in WHM's Feature Manager interface (WHM >> Home >> Packages >> Feature Manager).
Deselect any PHP versions that you wish to limit visibility of for your users.
When you install a new version of PHP on your server, all users can access it by default.
Limitations apply to all PHP versions available in EasyApache 4, including custom PHP packages.
- Either create a new package in WHM's Add a Package interface (WHM >> Home >> Packages >> Add a Package), or modify an existing one in WHM's Edit a Package interface (WHM >> Home >> Packages >> Edit a Package).
- Assign the feature list to your selected package.
- Assign the package to the users for which you wish to limit PHP in WHM's Modify an Account interface (WHM >> Home >> Account Functions >> Modify an Account).
If you set PHP limitations for a user's account, the user cannot select the limited PHP versions in cPanel's MultiPHP Manager interface (cPanel >> Home >> Software >> MultiPHP Manager). A system administrator can still assign a user to a limited PHP version. This allows a user to remain on a legacy version of PHP, but not to revert to that version via the interface if they move to a different version of PHP.