<p>Your host has likely added <code>proc_open</code> to your php.ini file's <a href="https://secure.php.net/manual/en/ini.core.php#ini.disable-functions" rel="nofollow noreferrer">disable_functions</a> setting.</p>

<p>If you have access to it, you can remove it from that setting.  If not, you'll have to ask your host to do it.</p>

<p>You can see that Craft requires the PHP <code>proc_*</code> methods to be able to perform some operations here: <a href="https://docs.craftcms.com/v3/requirements.html#optional-php-methods-and-configurations" rel="nofollow noreferrer">https://docs.craftcms.com/v3/requirements.html#optional-php-methods-and-configurations</a></p>

CC BY-SA 4.0
2018-12-03T09:24:50.407Z
Hi Brad, Thankfor your answer. I've contact hosting and they won't activate it because it's a shared hosting solution. Is the only solution changing hosts? Or is there something on my end I could do to circumvent this problem. Thanks in advance.
Ludwig Seufert
CC BY-SA 4.0
2018-12-03T16:08:18.607Z
For updating, you can set https://docs.craftcms.com/v3/config/config-settings.html#backuponupdate to false and just remember to manually make a backup.  There will probably be other things that don't work though... like the Plugin Store.
Brad Bell
CC BY-SA 4.0
2018-12-07T06:52:47.080Z
Thanks again! I'll create backups manually before I update.
Ludwig Seufert
CC BY-SA 4.0
2019-11-01T02:02:32.223Z
Hi @BradBell, some hosting providers argue that this function has potential security risk so they won't enable it. So I wonder, what could potentially go wrong? I read this: https://www.php.net/manual/en/function.proc-open.php#67109, seems like it could only go wrong if data is from user input? But since it is required by Craft for sending emails, then the Contact Form plugin will need to use it to send emails and the data is probably from user input? How does Craft prevent the potential risk, or is there anything the hosting provider can do to have it enabled but also prevent the risk?
Wei
CC BY-SA 4.0
2018-11-30T23:13:59.307Z
2018-11-30T23:13:59.307Z
Brad Bell
<p>I'm trying to update Craft, but I'm getting an error while updating stating it's not possible to make a database backup. I've therefore gone for the suggestion to revert back instead of pushing on. Back in the CMS now when I try to create a backup manually (utilities-> database backup) it tells me: </p>

<p>there was a problem backing up your database. Please check the logs. </p>

<p>I've done that and it says this: </p>

<p>2018-11-30 11:43:57 [-][1][-][error][yii\base\Exception] yii\base\Exception: Could not create backup: proc_open() has been disabled for security reasons in /home/bxrdvjsx/xxxxxx.de/vendor/craftcms/cms/src/controllers/UtilitiesController.php:382</p>

<p>Does anyone know how I can fix this? If it isn't obvious from my question I'm not very familiar with Craft and have inherited this website from the person who built it.</p>

CC BY-SA 4.0
2018-11-30T15:38:09.823Z
So this is a hosting issue; whatever (likely shared) hosting environment you're using has disabled `proc_open()` https://stackoverflow.com/questions/33401630/proc-open-has-been-disabled-for-security-reasons-php-error
andrew.welch
<craft3>
proc_open() has been disabled for security reasons
# proc_open() has been disabled for security reasons

(Asked by: username_0 on 2018-11-30)

I'm trying to update Craft, but I'm getting an error while updating stating it's not possible to make a database backup. I've therefore gone for the suggestion to revert back instead of pushing on. Back in the CMS now when I try to create a backup manually (utilities-> database backup) it tells me:

there was a problem backing up your database. Please check the logs.

I've done that and it says this:

2018-11-30 11:43:57 [-][1][-][error][yii\base\Exception] yii\base\Exception: Could not create backup: proc\_open() has been disabled for security reasons in /home/bxrdvjsx/xxxxxx.de/vendor/craftcms/cms/src/controllers/UtilitiesController.php:382

Does anyone know how I can fix this? If it isn't obvious from my question I'm not very familiar with Craft and have inherited this website from the person who built it.

**Tags:** craft3
> **Comments:**
> **username_1**: So this is a hosting issue; whatever (likely shared) hosting environment you're using has disabled `proc_open()` https://stackoverflow.com/questions/33401630/proc-open-has-been-disabled-for-security-reasons-php-error  

---

## 1 answers

### Answer by username_2 on 2018-11-30. Score: 2 | Accepted answer

Your host has likely added `proc_open` to your php.ini file's [disable\_functions](https://secure.php.net/manual/en/ini.core.php#ini.disable-functions) setting.

If you have access to it, you can remove it from that setting. If not, you'll have to ask your host to do it.

You can see that Craft requires the PHP `proc_*` methods to be able to perform some operations here: <https://docs.craftcms.com/v3/requirements.html#optional-php-methods-and-configurations>

> **Comments:**
> **username_0**: Hi Brad, Thankfor your answer. I've contact hosting and they won't activate it because it's a shared hosting solution. Is the only solution changing hosts? Or is there something on my end I could do to circumvent this problem. Thanks in advance.  
> **username_2**: For updating, you can set https://docs.craftcms.com/v3/config/config-settings.html#backuponupdate to false and just remember to manually make a backup.  There will probably be other things that don't work though... like the Plugin Store.  
> **username_0**: Thanks again! I'll create backups manually before I update.  
> **username_3**: Hi @BradBell, some hosting providers argue that this function has potential security risk so they won't enable it. So I wonder, what could potentially go wrong? I read this: https://www.php.net/manual/en/function.proc-open.php#67109, seems like it could only go wrong if data is from user input? But since it is required by Craft for sending emails, then the Contact Form plugin will need to use it to send emails and the data is probably from user input? How does Craft prevent the potential risk, or is there anything the hosting provider can do to have it enabled but also prevent the risk?  

---

