How to Disable the Monarx Protect PHP Extension

This guide shows you how to disable the Monarx Protect PHP extension (monarxprotect) on a web server that powers our ThreatShield service, and how to confirm it is inactive both from the server console and in the Monarx web app. Monarx Protect loads as a standard PHP extension, so the steps to disable it depend on which PHP handler serves requests on your server: Apache with mod_php, nginx with PHP-FPM, or LiteSpeed/OpenLiteSpeed with lsphp. On servers with cPanel/WHM, Plesk, or CloudLinux with CageFS, there are a few additional steps to make sure the change takes effect.

⚠️ Important:

Disabling Monarx Protect removes real-time malware detection and blocking for Incoming Malicious requests on the affected server. Only disable it for a specific, time-boxed reason (such as compatibility testing or a false-positive investigation), and re-enable it as soon as that reason is resolved.

💡 Before You Begin

A few things to confirm before making changes:

You have root or sudo access to the server.
You know which PHP handler(s) are in use. A single server can run more than one PHP version and more than one handler at the same time (for example, Apache mod_php for one PHP version and PHP-FPM for another).
The Monarx Protect extension is registered as monarxprotect in PHP's module list, loaded from a file typically named something like monarxprotect.ini in the active PHP configuration directory.

Note: Exact file names and paths vary by OS, PHP version, and installation method (native OS packages, cPanel EasyApache 4, Plesk, or CloudLinux alt-php/CageFS). Where a path differs, both are called out below.

Disabling the PHP Module

Apache (mod_php)

When Apache loads PHP directly as a module (mod_php), the extension is disabled by removing or commenting out its configuration file in the PHP configuration directory that Apache's PHP handler reads from.

Find the Monarx Protect configuration file for the PHP version bound to Apache:

find / -iname "*monarxprotect*.ini" 2>/dev/null

Typical locations:

Debian/Ubuntu: /etc/php/<version>/apache2/conf.d/*monarxprotect*.ini
RHEL/CloudLinux with cPanel EasyApache 4: /opt/cpanel/ea-php<version>/root/etc/php.d/*monarxprotect*.ini

2. Disable the module by renaming the file or commenting out its extension line:

mv /path/to/monarxprotect.ini /path/to/monarxprotect.ini.disabled

Alternatively, edit the file and comment out the line that loads the extension:

;extension=monarxprotect

3. Restart Apache to unload the module:

systemctl restart httpd      # RHEL / cPanel
systemctl restart apache2    # Debian / Ubuntu

nginx + PHP-FPM

nginx does not process PHP itself — it proxies PHP requests to a PHP-FPM pool. Disabling the module means editing the PHP-FPM configuration for the PHP version in use, not nginx itself.

Identify the PHP-FPM configuration directory for the PHP version handling the site (check the pool's php_admin_value or the fastcgi_pass socket/port in the nginx server block to confirm the version).
Find the Monarx Protect configuration file for that PHP-FPM instance:

find / -iname "*monarxprotect*.ini" 2>/dev/null

Typical locations:

Debian/Ubuntu: /etc/php/<version>/fpm/conf.d/*monarxprotect*.ini
RHEL/CloudLinux with cPanel EasyApache 4: /opt/cpanel/ea-php<version>/root/etc/php.d/*monarxprotect*.ini
RHEL with Remi repo PHP: /etc/opt/remi/php<version>/php.d/*monarxprotect*.ini

Rename or comment out the file, same as the Apache steps above.
Restart the PHP-FPM service (nginx itself does not need to restart):

systemctl restart php<version>-fpm   # Debian / Ubuntu
systemctl restart php-fpm            # RHEL

# cPanel: restart the pool via WHM > MultiPHP Manager, or:
systemctl restart ea-php<version>-php-fpm

LiteSpeed / OpenLiteSpeed (lsphp)

LiteSpeed and OpenLiteSpeed typically run PHP through their own lsphp binaries rather than the OS's default PHP, so the module must be disabled in the lsphp configuration, and the LiteSpeed web server (not just PHP) needs to be restarted for the change to take effect.

Find the Monarx Protect configuration file for the lsphp version in use:

find / -iname "*monarxprotect*.ini" 2>/dev/null

Typical locations:

Standalone OpenLiteSpeed: /usr/local/lsws/lsphp<version>/etc/php.d/*monarxprotect*.ini
cPanel + LiteSpeed (using EasyApache 4 PHP via LSAPI): /opt/cpanel/ea-php<version>/root/etc/php.d/*monarxprotect*.ini

Rename or comment out the file, same as the steps above.
Restart LiteSpeed (this reloads all lsphp worker processes):

systemctl restart lsws
# or
/usr/local/lsws/bin/lswsctrl restart
# WHM: Server Configuration > Restart LiteSpeed Web Server

Control Panel Notes

cPanel / WHM

On cPanel servers, PHP is usually managed through EasyApache 4 (ea-php<version>), and the same ea-php configuration directory is shared by Apache mod_php, PHP-FPM, and LiteSpeed's lsphp when EasyApache PHP is used as the LSAPI backend. Because Monarx Protect is not a standard PECL extension, it will not appear in WHM's MultiPHP INI Editor extension toggles — use the manual file method described above for the relevant handler. After disabling, restart the appropriate service (Apache, PHP-FPM, or LiteSpeed) from WHM's Restart Services page, or from the command line.

Plesk

On Plesk servers, PHP versions are installed under /opt/plesk/php/<version>/, and Monarx Protect's configuration file is typically found under /opt/plesk/php/<version>/etc/php.d/. Plesk assigns a PHP handler (Apache module, FastCGI, or FPM application) per domain under Websites & Domains > <domain> > PHP Settings. After disabling the module file, restart the matching service:

systemctl restart plesk-php<version>-fpm
# or restart Apache/nginx if using the Apache module handler

Note: Because Plesk PHP handlers are assigned per domain, confirm which PHP version and handler the affected domain actually uses before editing configuration files — a server can have several Plesk PHP versions installed side by side.

CloudLinux with CageFS

On CloudLinux, PHP is often installed as alt-php packages (/opt/alt/php<version>/) and served to tenants inside CageFS jails. Configuration changes made on the host are not automatically visible inside running CageFS containers.

Locate and disable the Monarx Protect file under the relevant alt-php or ea-php directory, as described above.
Force CageFS to pick up the change:

cagefsctl --force-update

3. Restart the relevant web server / PHP-FPM service.

Validating on the Server Console

Monarx Protect loads as the PHP module monarxprotect. Once disabled, it should no longer appear in that PHP handler's module list.

Check the module list for the specific PHP binary that serves the site (not just the default php-cli binary, since a server can have multiple PHP versions):

php -m | grep monarxprotect

No output means the module is not loaded for that binary. If the command still returns monarxprotect, either the wrong PHP binary/version was checked, the configuration file wasn't fully disabled, or the corresponding service hasn't been restarted yet.

For cPanel EasyApache 4 environments with multiple PHP versions, point directly at the version in question, for example:

/opt/cpanel/ea-php81/root/usr/bin/php -m | grep monarxprotect

Note: php-cli, PHP-FPM, and lsphp can each load their own separate php.ini and conf.d directory even on the same server. If php -m still shows the module after disabling it for Apache, check whether the site is actually served by PHP-FPM or lsphp instead, and repeat the check against that binary.

As an alternative check that reflects exactly what a given web request sees, create a

temporary phpinfo() script in the site's document root, load it in a browser, search the page for "monarx", and delete the script when finished.

Validating in the Monarx Web App

Log in to the Monarx web app.
Go to Dashboard > Server Agents.
Locate the server in the agent list and check its PHP Protection status. After disabling the module and restarting the affected service, the status should update to reflect that PHP protection is inactive on that server (this may take a few minutes for the agent's next check-in).

Re-enabling Monarx Protect

To restore protection, reverse the steps above: restore or uncomment the monarxprotect.ini file for the affected PHP handler, run cagefsctl --force-update if on CloudLinux/CageFS, and restart the corresponding service (Apache, PHP-FPM, or LiteSpeed). Confirm it's active again using the same php -m | grep monarxprotect check and by checking the server's status in Dashboard > Server Agents.

Still Having Issues?

If the module still shows as active after following these steps, or the Monarx web app doesn't reflect the change after several minutes, contact Monarx support with the server's OS, PHP version(s), web server/handler combination, and the output of the php -m check for the affected PHP binary.