Panellicense

Set up CloudLinux PHP Selector on a cPanel server

Let each cPanel user pick their own PHP version and extensions, without breaking shared-server stability. Install alt-php, enable CageFS, and avoid the three configuration mistakes that turn this into a support flood.

7 min readUpdated 2026-05-15cloudlinux · php-selector · alt-php · cpanel
schema: HowToschema: FAQPageschema: BreadcrumbList

PHP Selector is the per-user PHP-version chooser that ships with CloudLinux. On a shared cPanel server it removes the single biggest support category: "my site needs PHP 7.4 but your server runs 8.2". Each user picks their own version — 5.6 through 8.4 — plus extensions and php.ini directives, all without root access and without affecting other users.

The catch is that it depends on CageFS being enabled and alt-php being installed. Skip either step and the selector either silently does nothing or breaks every site on the server. This guide does it in the right order: alt-php packages first, CageFS enabled, selector turned on, defaults configured.

Prerequisites

You need:

  • CloudLinux installed and an active licence. If you haven't installed it yet, see installing CloudLinux on cPanel.
  • Root SSH access to the cPanel server.
  • At least 8 GB of free space in /opt/alt/ — the full alt-php package set across 11 versions takes 6-7 GB on disk.
  • LiteSpeed or Apache with mod_lsapi as the PHP handler. PHP-FPM works too but loses some per-user override capability. If you're on stock CGI or DSO handlers, switch first or the selector won't apply per-user.

Step 1 — Install the alt-php package set

CloudLinux ships PHP as alt-php packages, separate from EasyApache's PHP. Install all supported versions in one go:

yum groupinstall alt-php

On a fresh CloudLinux install this pulls roughly 2,300 packages and takes 8-12 minutes. Each version gets its own /opt/alt/phpXX/ tree with the full extension set pre-compiled.

To install only specific versions (e.g. you don't need PHP 5.6 because no customer asked for it):

yum install alt-php74 alt-php80 alt-php81 alt-php82 alt-php83 alt-php84

Confirm the versions installed:

selectorctl --available

You should see one line per installed version, e.g. 5.6 7.4 8.0 8.1 8.2 8.3 8.4.

Step 2 — Enable CageFS

CageFS is the per-user filesystem isolation layer. Without it, PHP Selector has nothing to isolate against and silently no-ops:

cagefsctl --init
cagefsctl --enable-all

--init builds the cage skeleton (creates /usr/share/cagefs-skeleton/, populates binaries, sets up the virtual /proc views). It takes 2-5 minutes on first run.

--enable-all enables CageFS for every existing cPanel user. New cPanel accounts will also be auto-caged from this point forward (this is the cPanel-aware behaviour; CloudLinux's hook into cPanel handles new account creation).

Verify a user is caged:

cagefsctl --user-status exampleuser

Expected output: Enabled. If you see Disabled, run cagefsctl --enable exampleuser manually.

Step 3 — Enable PHP Selector

PHP Selector itself is a flag in CageFS:

selectorctl --enable-selector

This installs the user-facing selectorctl binary inside the cage, registers the "Select PHP Version" icon in cPanel under the Software section, and pulls the default version map from /etc/cl-selector/.

Restart the cPanel UI service so the icon shows up immediately:

service cpsrvd restart

Step 4 — Set sensible global defaults

Two configuration files govern selector defaults — both live in /etc/cl-selector/:

  • defaults.cfg — sets the default PHP version for users who haven't picked one
  • native.cfg — sets the "native" version that EasyApache PHP would be (selector inherits this if a user explicitly chooses "native")

Edit defaults.cfg:

nano /etc/cl-selector/defaults.cfg

A working set of defaults for a 2026 server:

default=8.2
modules=apcu,curl,gd,imagick,intl,mbstring,mysqli,opcache,pdo_mysql,redis,soap,xml,zip

Bumping the default extension set saves users a click — most WordPress and Laravel installs need exactly these. Save and run:

selectorctl --apply-defaults

This rewrites every user's PHP profile to match the new default. Users who had manually selected a version keep their choice; users who never touched the selector get the new default.

Step 5 — Configure per-user limits

The selector lets users pick their PHP version and toggle extensions, but you may want to restrict what versions are available per-user (e.g. only allow modern PHP for new customers).

To restrict a single user to PHP 8.1+:

selectorctl --set-versions=8.1,8.2,8.3,8.4 --user=exampleuser

To set the global allow-list (applies to users without per-user overrides):

selectorctl --set-allowed-versions=7.4,8.0,8.1,8.2,8.3,8.4

Anything not in the allowed list disappears from the dropdown. Sites running on a disallowed version keep running — the selector only gates the picker, not currently- running PHP. You'll need to migrate them off manually before retiring a version.

Step 6 — Test as a user

Switch to a non-root cPanel user and confirm:

su - exampleuser
selectorctl --user-current

Expected output: the user's current PHP version and the extension set. If you get Permission denied or a missing binary, CageFS isn't set up correctly for this user — re-run cagefsctl --enable exampleuser and recheck.

Then load the cPanel interface as that user and confirm the Select PHP Version icon appears under Software. Click through, change version, save, and reload a page on one of the user's domains. The X-Powered-By header should reflect the new version.

Three configuration mistakes that flood support

  1. Forgetting selectorctl --apply-defaults after editing defaults.cfg. The file changes but no user actually picks up the new default. Every new account gets the old default until you apply it.

  2. Not coordinating PHP Selector versions with EasyApache versions. If EasyApache only has PHP 8.2 enabled but the selector allows PHP 8.4, sites selecting 8.4 actually run on alt-php's 8.4 (which is correct — alt-php is independent of EasyApache). But monitoring tools that read EasyApache config will report PHP 8.2 across the fleet. Document this in your runbook.

  3. Enabling mod_lsapi only for some users. PHP Selector requires every user's handler to be lsphp (under LiteSpeed) or mod_lsapi (under Apache). Mixed handlers break the per-user override silently. Set the handler globally in EasyApache and don't override per-domain.

Does PHP Selector work without CageFS?+
No. PHP Selector depends on CageFS to give each user an isolated PHP environment. Without CageFS, selectorctl --enable-selector returns an error. CageFS must be installed and enabled first.
Can users change php.ini values themselves?+
Yes — the selector exposes a curated set of php.ini directives (memory_limit, upload_max_filesize, max_execution_time, etc.) for per-user override. Users cannot set arbitrary directives, only ones on the allow-list configured in /etc/cl-selector/.
What happens to existing sites when I enable PHP Selector?+
Nothing immediately. Sites keep running on whatever PHP handler was active before. Users have to actively open the selector and pick a version for the change to take effect. The 'native' option leaves them on the EasyApache PHP version.
Does PHP Selector affect server PHP performance?+
Marginal. Each alt-php version has its own OPcache, so opcache memory usage scales with the number of versions in active use. On a server with 5 active alt-php versions and 200 sites, expect 1.5-2.5 GB additional RAM for OPcache compared to a single shared PHP version.
Can I use PHP Selector with PHP-FPM?+
Yes, but the per-user override is more limited — PHP-FPM pools are configured per-domain, not per-user, so a user with multiple domains may end up with different versions per domain. mod_lsapi or LiteSpeed lsphp gives the cleaner per-user model.
How do I disable PHP Selector for a single user?+
Run selectorctl --disable --user=username. The user keeps running on whatever PHP version they had last selected, but the picker UI in cPanel is hidden. To force a version, use selectorctl --set-current=X.Y --user=username.

Next steps

Related articles

All tutorials & how-tos →
how to
Set up JetBackup 5 deduplication backups to cut storage cost
JetBackup 5.4 added a deduplication backup structure that fingerprints data in chunks and stores each unique chunk once — here's how it works, where it pays off, and how to turn it on.
6 min read
how to
Plesk 360 setup guide for centralized licenses and monitoring
Plesk 360 is the SaaS control plane for everyone running more than one Plesk box — license management, uptime monitoring, and SSO into every panel from one dashboard.
7 min read
how to
Use the Plesk REST API with reseller and customer accounts
Plesk Obsidian 18.0.79 opens the REST API to reseller and customer accounts and adds file, log, and impersonation endpoints — how to authenticate and use them.
7 min read
Switch in an afternoon

Switch from your current reseller — free.

We migrate active cPanel, Plesk, LiteSpeed and CloudLinux licenses from any reseller. We prorate the first month so you never pay twice, and your customers see zero downtime during the swap.