A WP website shows error 500: open_basedir restriction in effect: failed to open stream: Operation not permitted in Unknown on line 0

Symptoms

• Plesk Obsidian running on a Linux-based operating system
• A WordPress website (example.com) that uses the Wordfence plugin shows a 500 external Server Error once opened in a browser

• Error messages that are similar to the following can be found in the /var/www/vhosts/system/example.com/logs/error_log file:

  2024-06-05 11:25:34 Warning 203.0.113.2 AH01071: Got error 'PHP message: PHP Warning: Unknown: open_basedir restriction in effect. File(/var/www/vhosts/example.org/httpdocs/wordfence-waf.php) is not within the allowed path(s): (/var/www/vhosts/example.com/:/tmp/) in Unknown on line 0; PHP message: PHP Warning: Unknown: Failed to open stream: Operation not permitted in Unknown on line 0; PHP message: PHP Fatal error: Failed opening required '/var/www/vhosts/example.org/httpdocs/wordfence-waf.php' (include_path='.:/opt/plesk/php/8.2/share/pear') in Unknown on line 0' Apache error
  2024-06-05 11:55:28 Error 203.0.113.2 500 GET / HTTP/1.0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 745 Apache SSL/TLS access

• A file called .user.ini that resides within the Document root directory of the website contains lines that are similar to the following:

  ; Wordfence WAF
  auto_prepend_file = '/var/www/vhosts/example.org/httpdocs/wordfence-waf.php'
  ; END Wordfence WAF

Cause

The domain example.com tries to get access to a Wordfence-related file in the folder of another domain (example.org), which is not allowed, because different Subscriptions in Plesk are isolated intentionally.

Resolution

1. Log into Plesk
2. Go to Domains > example.com > Dashboard > Files

3. Either rename the file .user.ini to .user.ini-bak and save the changes (in order to disable this file) or edit its contents, so that the used path becomes /var/www/vhosts/example.com/httpdocs/wordfence-waf.php instead of /var/www/vhosts/example.org/httpdocs/wordfence-waf.php