Error Function putenv() was disabled by the domain protection module can surprise you at the most unexpected moment – especially after the store has been working flawlessly for a long time. In this post, I explain where this problem comes from and how to fix it quickly.
What exactly is putenv()?
putenv() is a built-in PHP function used to set environment variables during script execution. PrestaShop uses it, among other things, when handling localization and translations – it calls it when setting the locale for a given store language. Without this function, the store can still work, but warnings start appearing in the logs, and in some configurations errors can be visible directly on the page – which is of course unacceptable in production.
Where does this error come from?
The problem is characteristic of shared hosting that uses the mechanism domain protection (domain protection). This mechanism isolates individual domains from each other at the operating system level, which is a good security practice – but it also blocks certain PHP functions, including putenv(). The most popular case is hosting Cyber Folks and Hostido, which at some point began automatically enabling this option for every newly added domain or subdomain. The result? The store was working fine, you added a subdomain or switched a domain – and suddenly it started throwing warnings.
Warning
If the error appears directly on the store page (and not just in the logs), urgently disable PHP error display in the server configuration or the file config/defines.inc.php – visible errors on the front end are a serious reputation and security issue.
The full text of the warning looks like this:
User Warning: Function putenv() was disabled by the domain protection module. Disable domain protection for this domain in the Server Panel to use this function.
The solution is very simple and does not require any modifications to the store code. Just disable domain separation in the hosting panel.
Log in to the panel DirectAdmin – usually available at domainname.pl:2222 or domainname.pl:2223
Go to the section Domain settings
Find your store's domain in the list
Change the option Domain separation z YES to NO
Save changes
Success
After disabling domain separation, the error should disappear immediately, without the need to restart the server or rebuild the PrestaShop cache.
What if I have a different hosting panel?
Not every hosting uses DirectAdmin. Below I have collected where to look for this option in other popular panels:
Hosting panel
Where to look for the setting
DirectAdmin (Cyber Folks)
Domain settings – Domain separation – NO
cPanel
PHP Selector or ModSecurity – check disabled PHP functions
Plesk
Domains – PHP settings – Disabled functions
HestiaCP
No built-in domain separation – check PHP-FPM configuration in /etc/php/X.X/fpm/pool.d/
Own server (VPS/dedicated)
File php.ini or php-fpm.conf – directive disable_functions
Alternative solution – own server or no access to the panel
If you have access to the file php.ini or PHP-FPM configuration, check if putenv is not on the list of blocked functions:
disable_functions = putenv, ...
Delete putenv from this list and restart PHP-FPM:
systemctl restart php8.1-fpm
Note
Adjust the version number in the command above to the PHP version used by your store. You can check this in the hosting panel or through the file phpinfo().
Is it worth worrying about this error?
Yes. Although the store often works seemingly normally despite this warning:
the error may appear on the page for customers (depending on PHP error display configuration)
in some versions of PrestaShop, incorrect locale settings may cause problems with PDF invoice generation or email translations
accumulated warnings in logs make diagnosing actual problems difficult
Tip
After adding each new domain or subdomain to Cyber Folks hosting, go directly to domain settings and check the separation option – it enables automatically by default and it's better to disable it before the store starts generating errors.
Do you have other questions about PrestaShop configuration or hosting issues? Leave a comment below.
Contains information related to marketing campaigns of the user. These are shared with Google AdWords / Google Ads when the Google Ads and Google Analytics accounts are linked together.
90 days
__utma
ID used to identify users and sessions
2 years after last activity
__utmt
Used to monitor number of Google Analytics server requests
10 minutes
__utmb
Used to distinguish new sessions and visits. This cookie is set when the GA.js javascript library is loaded and there is no existing __utmb cookie. The cookie is updated every time data is sent to the Google Analytics server.
30 minutes after last activity
__utmc
Used only with old Urchin versions of Google Analytics and not with GA.js. Was used to distinguish between new sessions and visits at the end of a session.
End of session (browser)
__utmz
Contains information about the traffic source or campaign that directed user to the website. The cookie is set when the GA.js javascript is loaded and updated when data is sent to the Google Anaytics server
6 months after last activity
__utmv
Contains custom information set by the web developer via the _setCustomVar method in Google Analytics. This cookie is updated every time new data is sent to the Google Analytics server.
2 years after last activity
__utmx
Used to determine whether a user is included in an A / B or Multivariate test.
18 months
_ga
ID used to identify users
2 years
_gali
Used by Google Analytics to determine which links on a page are being clicked
30 seconds
_ga_
ID used to identify users
2 years
_gid
ID used to identify users for 24 hours after last activity
24 hours
_gat
Used to monitor number of Google Analytics server requests when using Google Tag Manager
1 minute
SourceBuster is used by WooCommerce for order attribution based on user source.
Name
Description
Duration
sbjs_first
Traffic origin information for the visitor's first visit to your store (only applicable if the visitor returns before the session expires)
session
sbjs_current
Traffic origin information for the visitor's current visit to your store
session
sbjs_first_add
Timestamp, referring URL, and entry page for your visitor's first visit to your store (only applicable if the visitor returns before the session expires)
session
sbjs_current_add
Timestamp, referring URL, and entry page for your visitor's current visit to your store
session
sbjs_migrations
Technical data to help with migrations between different versions of the tracking feature
session
sbjs_session
The number of page views in this session and the current page path
30 minutes
sbjs_udata
Information about the visitor's user agent, such as IP, the browser, and the device type