Title: PHP Errors – HTTP API Should be Used, not file_get_contents()
Last modified: December 24, 2016

---

# PHP Errors – HTTP API Should be Used, not file_get_contents()

 *  Resolved [blackhawkcybersec](https://wordpress.org/support/users/blackhawkcybersec/)
 * (@blackhawkcybersec)
 * [9 years, 5 months ago](https://wordpress.org/support/topic/php-errors-http-api-should-be-used-not-file_get_contents/)
 * We were testing the plugin out, and found that you’re using the `file_get_contents()`
   function to request URLS.
 * The following errors fire:
 *     ```
       /XXXXXX/wp-content/plugins/mywebtonet-performancestats/mywebtonet-performancestats.php on line 654
       PHP Warning:  file_get_contents(http://static.webhosting.dk/1mbfile): failed to open stream: no suitable wrapper could be found in /XXXXXX/wp-content/plugins/mywebtonet-performancestats/mywebtonet-performancestats.php on line 654
       PHP Warning:  file_get_contents(): http:// wrapper is disabled in the server configuration by allow_url_fopen=0 in /XXXXXX/wp-content/plugins/mywebtonet-performancestats/mywebtonet-performancestats.php on line 655
       PHP Warning:  file_get_contents(http://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.js): failed to open stream: no suitable wrapper could be found in /XXXXXX/wp-content/plugins/mywebtonet-performancestats/mywebtonet-performancestats.php on line 655
       PHP Warning:  file_get_contents(): http:// wrapper is disabled in the server configuration by allow_url_fopen=0 in /XXXXXX/wp-content/plugins/mywebtonet-performancestats/mywebtonet-performancestats.php on line 658
       PHP Warning:  file_get_contents(http://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.js): failed to open stream: no suitable wrapper could be found in /XXXXXX/wp-content/plugins/mywebtonet-performancestats/mywebtonet-performancestats.php on line 658
       PHP Warning:  file_get_contents(): http:// wrapper is disabled in the server configuration by allow_url_fopen=0 in /XXXXXX/wp-content/plugins/mywebtonet-performancestats/mywebtonet-performancestats.php on line 659
       PHP Warning:  file_get_contents(http://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.js): failed to open stream: no suitable wrapper could be found in /XXXXXX/wp-content/plugins/mywebtonet-performancestats/mywebtonet-performancestats.php on line 659
       PHP Warning:  file_get_contents(): http:// wrapper is disabled in the server configuration by allow_url_fopen=0 in /XXXXXX/wp-content/plugins/mywebtonet-performancestats/mywebtonet-performancestats.php on line 660
       PHP Warning:  file_get_contents(http://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.js): failed to open stream: no suitable wrapper could be found in /XXXXXX/wp-content/plugins/mywebtonet-performancestats/mywebtonet-performancestats.php on line 660
       PHP Warning:  file_get_contents(): http:// wrapper is disabled in the server configuration by allow_url_fopen=0 in /XXXXXX/wp-content/plugins/mywebtonet-performancestats/mywebtonet-performancestats.php on line 661
       PHP Warning:  file_get_contents(http://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.js): failed to open stream: no suitable wrapper could be found in /XXXXXX/wp-content/plugins/mywebtonet-performancestats/mywebtonet-performancestats.php on line 661
       PHP Warning:  file_get_contents(): http:// wrapper is disabled in the server configuration by allow_url_fopen=0 in /XXXXXX/wp-content/plugins/mywebtonet-performancestats/mywebtonet-performancestats.php on line 662
       PHP Warning:  file_get_contents(http://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.js): failed to open stream: no suitable wrapper could be found in /XXXXXX/wp-content/plugins/mywebtonet-performancestats/mywebtonet-performancestats.php on line 662
       PHP Warning:  file_get_contents(): http:// wrapper is disabled in the server configuration by allow_url_fopen=0 in /XXXXXX/wp-content/plugins/mywebtonet-performancestats/mywebtonet-performancestats.php on line 663
       PHP Warning:  file_get_contents(http://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.js): failed to open stream: no suitable wrapper could be found in /XXXXXX/wp-content/plugins/mywebtonet-performancestats/mywebtonet-performancestats.php on line 663
       PHP Warning:  file_get_contents(): http:// wrapper is disabled in the server configuration by allow_url_fopen=0 in /XXXXXX/wp-content/plugins/mywebtonet-performancestats/mywebtonet-performancestats.php on line 671
       PHP Warning:  file_get_contents(http://static.webhosting.dk/1mbfile): failed to open stream: no suitable wrapper could be found in /XXXXXX/wp-content/plugins/mywebtonet-performancestats/mywebtonet-performancestats.php on line 671
       ```
   
 * **Sorry to be blunt, but using `file_get_contents()` to retrieve URLs is a bad
   coding practice for _both_ compatibility and security.**
 * **Security:**
 * You are potentially putting user websites at risk by using the `file_get_contents()`
   function to retrieve URLS. This is quite possibly the single worst way to retrieve
   remote files/URLS. For best security, servers should set `allow_url_fopen` and`
   allow_url_include` options to Off (or 0) in their `php.ini` settings, which will
   prevent scripts from retrieving or including remote URLS using insecure methods,
   thus reducing the risk of various exploits.
 * Also, since you are requesting insecure URLs (non-https), this opens sites using
   your plugin up to Man in the Middle attacks. Not only does SSL/TLS encrypt the
   data, but it also provides verification the the requested site is legit, and 
   not an imposter. Any time a plugin or script requests data from an external site,
   it needs to be done via HTTPS. If you want to give the user the option to use
   either HTTPS or HTTP, then you need to set the default to secure, and only switch
   to insecure if the user has made a specific choice, and should provide a security
   warning if the insecure option is chosen.
 * **Compatibility:**
 * As mentioned above, many sites set `allow_url_fopen` and `allow_url_include` 
   to Off in their `php.ini` settings for security reasons. Best security practices
   require this If you depend on the `file_get_contents()` function, your plugin
   won’t be very compatible.
 * Even using CURL would even be preferred to `file_get_contents()`, but calling
   CURL directly is not a WordPress coding best practice, and therefore not recommended.
   Plugin developers should be using the [WordPress HTTP API](https://codex.wordpress.org/HTTP_API)
   for retrieving remote URLs, as it provides a secure framework, and takes care
   of potential compatibility issues. More info on the [HTTP API](https://developer.wordpress.org/plugins/http-api/)
   in the developer docs.
 * Additionally the following error fired:
 *     ```
       PHP Notice:  Undefined variable: headertext in /XXXXXX/wp-content/plugins/mywebtonet-performancestats/mywebtonet-performancestats.php on line 363
       ```
   
 * While an undefined variable is technically not a major issue, it’s still best
   practice to initialize all variables, to prevent unexpected results.
 * Please fix these glaring issues.

Viewing 3 replies - 1 through 3 (of 3 total)

 *  Plugin Author [mywebtonet](https://wordpress.org/support/users/mywebtonet/)
 * (@mywebtonet)
 * [9 years, 3 months ago](https://wordpress.org/support/topic/php-errors-http-api-should-be-used-not-file_get_contents/#post-8871939)
 * Hi
 * This has been sorted a while back, all in order.
 * Rgds
 *  Plugin Author [mywebtonet](https://wordpress.org/support/users/mywebtonet/)
 * (@mywebtonet)
 * [8 years, 10 months ago](https://wordpress.org/support/topic/php-errors-http-api-should-be-used-not-file_get_contents/#post-9407112)
 * Hi Blackhawk
 * this issue has been resolved 5 months ago, and you have still not changed your
   rating for this plugin, we appreciate you had a look at it, and the issue you
   reported was corrected, can we ask you to update your review?
 * Rgds
 *  Plugin Author [mywebtonet](https://wordpress.org/support/users/mywebtonet/)
 * (@mywebtonet)
 * [8 years, 10 months ago](https://wordpress.org/support/topic/php-errors-http-api-should-be-used-not-file_get_contents/#post-9407113)
 * Hi Blackhawk
 * Set as resolved now.
 * Rgds

Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘PHP Errors – HTTP API Should be Used, not file_get_contents()’ is closed
to new replies.

 * ![](https://s.w.org/plugins/geopattern-icon/mywebtonet-performancestats.svg)
 * [PHP/MySQL CPU performance statistics](https://wordpress.org/plugins/mywebtonet-performancestats/)
 * [Support Threads](https://wordpress.org/support/plugin/mywebtonet-performancestats/)
 * [Active Topics](https://wordpress.org/support/plugin/mywebtonet-performancestats/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/mywebtonet-performancestats/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/mywebtonet-performancestats/reviews/)

## Tags

 * [compatibility](https://wordpress.org/support/topic-tag/compatibility/)
 * [file_get_contents](https://wordpress.org/support/topic-tag/file_get_contents/)
 * [PHP errors](https://wordpress.org/support/topic-tag/php-errors/)

 * 3 replies
 * 2 participants
 * Last reply from: [mywebtonet](https://wordpress.org/support/users/mywebtonet/)
 * Last activity: [8 years, 10 months ago](https://wordpress.org/support/topic/php-errors-http-api-should-be-used-not-file_get_contents/#post-9407113)
 * Status: resolved