I’m managing a self hosted WordPress site with Ninja firewall.

To allow a full WAP protection with Ninja, I have to add some auto_prepend_file config in the .user.ini file in my root directory.

Actually, Ninja does it for you and I checked the file (/var/www/mysite/.user.ini) and it looks ok.

I also checked my php.ini file.

I'm using PHP FPM 7.3 which contains the following lines. What am I doing wrong?

; php.ini Options  ;
; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini"
user_ini.filename = ".user.ini"

; To disable this feature set this option to an empty value
;user_ini.filename =

; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 $
;user_ini.cache_ttl = 300

but when I look at my loaded config, the user.ini file is not loaded:

Server API  FPM/FastCGI
Virtual Directory Support   disabled
Configuration File (php.ini) Path   /etc/php/7.3/fpm
Loaded Configuration File   /etc/php/7.3/fpm/php.ini
Scan this dir for additional .ini files     /etc/php/7.3/fpm/conf.d
Additional .ini files parsed    /etc/php/7.3/fpm/conf.d/10-mysqlnd.ini, /etc/php/7.3/fpm/conf.d/10-opcache.ini, /etc/php/7.3/fpm/conf.d/10-pdo.ini, /etc/php/7.3/fpm/conf.d/15-xml.ini, /etc/php/7.3/fpm/conf.d/20-bcmath.ini, /etc/php/7.3/fpm/conf.d/20-bz2.ini, /etc/php/7.3/fpm/conf.d/20-calendar.ini, /etc/php/7.3/fpm/conf.d/20-ctype.ini, /etc/php/7.3/fpm/conf.d/20-curl.ini, /etc/php/7.3/fpm/conf.d/20-dom.ini, /etc/php/7.3/fpm/conf.d/20-exif.ini, /etc/php/7.3/fpm/conf.d/20-fileinfo.ini, /etc/php/7.3/fpm/conf.d/20-ftp.ini, /etc/php/7.3/fpm/conf.d/20-gd.ini, /etc/php/7.3/fpm/conf.d/20-gettext.ini, /etc/php/7.3/fpm/conf.d/20-iconv.ini, /etc/php/7.3/fpm/conf.d/20-igbinary.ini, /etc/php/7.3/fpm/conf.d/20-imagick.ini, /etc/php/7.3/fpm/conf.d/20-intl.ini, /etc/php/7.3/fpm/conf.d/20-json.ini, /etc/php/7.3/fpm/conf.d/20-mbstring.ini, /etc/php/7.3/fpm/conf.d/20-mysqli.ini, /etc/php/7.3/fpm/conf.d/20-pdo_mysql.ini, /etc/php/7.3/fpm/conf.d/20-pdo_sqlite.ini, /etc/php/7.3/fpm/conf.d/20-phar.ini, /etc/php/7.3/fpm/conf.d/20-posix.ini, /etc/php/7.3/fpm/conf.d/20-readline.ini, /etc/php/7.3/fpm/conf.d/20-redis.ini, /etc/php/7.3/fpm/conf.d/20-shmop.ini, /etc/php/7.3/fpm/conf.d/20-simplexml.ini, /etc/php/7.3/fpm/conf.d/20-smbclient.ini, /etc/php/7.3/fpm/conf.d/20-sockets.ini, /etc/php/7.3/fpm/conf.d/20-sqlite3.ini, /etc/php/7.3/fpm/conf.d/20-sysvmsg.ini, /etc/php/7.3/fpm/conf.d/20-sysvsem.ini, /etc/php/7.3/fpm/conf.d/20-sysvshm.ini, /etc/php/7.3/fpm/conf.d/20-tidy.ini, /etc/php/7.3/fpm/conf.d/20-tokenizer.ini, /etc/php/7.3/fpm/conf.d/20-wddx.ini, /etc/php/7.3/fpm/conf.d/20-xmlreader.ini, /etc/php/7.3/fpm/conf.d/20-xmlwriter.ini, /etc/php/7.3/fpm/conf.d/20-xsl.ini, /etc/php/7.3/fpm/conf.d/20-zip.ini, /etc/php/7.3/fpm/conf.d/90-ncp.ini 

1 Answer 1



There was an ini file in the /etc/php/7.3/fpm/conf.d directory that was resetting the user_ini.filename to an empty value.

If you face the same problem, the simple way to detect this on Linux is run this grep command:

grep -R user_ini.filename /etc/php/7.3

And check if there is a line that looks like this:

/etc/php/7.3/fpm/conf.d/90-ncp.ini:user_ini.filename =

Then edit the file and comment the line with a semicolon.

  • 2
    Late comment but if you ask me the issue is not commenting out that line in 90-ncp.ini but rather setting that user_ini.filename = ".user.ini" in 90-ncp.ini instead of the main php.ini. That is the whole reason that /etc/php/7.3/fpm/conf.d/ directory exists: It contains individual configs that should be used for customizations. Aug 27, 2022 at 17:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .