Fix “Fatal error: Uncaught Error: Call to undefined function curl_exec()” in Wordfence

Short version

Wordfence is calling curl_exec() in its firewall code.

Your new PHP environment does not provide that function. Either the PHP cURL extension is not installed or enabled or curl_exec is disabled in php.ini for security.

You fix this by enabling cURL for the PHP that runs your site or asking your host to do it.

Once cURL is available, Wordfence will stop throwing this fatal error.

---

Quick path. Pick your situation

• Your site is showing the fatal error and you cannot reach wp admin. Start with Step 0. Get your site back online.
• You can still log in but see this error in logs or during rule updates. Start with Step 1. What this error means for Wordfence.
• You have cPanel or a PHP selector in your hosting control panel. Jump to Step 3. Enable cURL in your control panel.
• You are on managed hosting and cannot touch PHP settings. Jump to Step 4. Ask your host with the right wording.

If you are not sure, just walk through the steps in order.

---

Step 0. Get your site back if it is down

If this fatal error is on screen and WordPress will not load, temporarily disable Wordfence so you can work.

Option A. Rename the Wordfence plugin folder

Use FTP or your hosting file manager.

1. Open the wp-content/plugins/ folder.
2. Find the wordfence folder.
3. Rename it to wordfence-disabled.
4. Reload your site and /wp-admin/ in a browser.

WordPress will stop loading Wordfence and the fatal error should disappear.

You will re enable Wordfence after cURL is fixed.

---

Step 1. What this error means in Wordfence

A typical message looks like this.

Fatal error: Uncaught Error: Call to undefined function curl_exec()
in wp-content/plugins/wordfence/vendor/wordfence/wf-waf/src/lib/http.php on line...

Key points.

• The error comes from wf-waf, the Wordfence firewall code.
• That code uses cURL to connect to Wordfence servers and update firewall rules.
• PHP tried to run curl_exec() and could not find that function.

This does not mean the Wordfence plugin is corrupted. It means your PHP configuration on this server is missing the cURL extension or the function is disabled.

This often appears right after a migration or PHP upgrade when the new server uses a different php.ini.

---

Step 2. Confirm that cURL is missing or disabled

If you can reach wp admin, the easiest check is through Wordfence diagnostics.

Check via Wordfence diagnostics

1. In wp admin go to Wordfence → Tools → Diagnostics.
2. Scroll to the PHP Extensions section.
3. Look for cURL in the list.

You might see either:

• cURL listed as present with version information. That means the extension is loaded.
• No cURL line at all. That means the extension is not loaded for this PHP.

If cURL is not listed then PHP cannot see it and Wordfence cannot use it.

If you cannot open wp admin

You can use a small temporary PHP file.

1. In your site root, create a file named check-curl.php.
2. Put this inside it.

<?php
if (function_exists('curl_exec')) {
    echo 'cURL is enabled.';
} else {
    echo 'cURL is NOT enabled.';
}

1. Visit https://your-site.com/check-curl.php in a browser.

If it prints cURL is NOT enabled then the extension is missing or disabled.

Delete this file after testing.

---

Step 3. Enable the PHP cURL extension

Exactly how you do this depends on your hosting. The core idea is always the same.

You need to enable cURL for the exact PHP version that runs your WordPress site.

On cPanel hosts

Names differ a bit by host. The steps are usually close to this.

1. Log in to your hosting control panel.
2. Open Select PHP Version or PHP Extensions or MultiPHP INI Editor.
3. Select the same PHP version that your site uses.
4. Find curl in the extension list.
5. Tick the box to enable it.
6. Save or apply the changes.
7. Restart Apache or PHP FPM if your panel has a button for that, or wait a minute for it to reload.

Then run the check-curl.php test again or reload the Wordfence diagnostics page. It should now show cURL as enabled.

On custom VPS or dedicated servers

You or your sysadmin may need to install and enable cURL manually.

Examples for common setups. Adjust for your OS and PHP version.

For Ubuntu or Debian with Apache or Nginx:

sudo apt-get install php-curl
sudo service apache2 restart    # or: sudo service php8.2-fpm restart

For CentOS or similar:

sudo yum install php-curl
sudo systemctl restart httpd    # or: sudo systemctl restart php-fpm

In php.ini you should see a line like:

extension=curl

Make sure it is not commented out.

After installing and restarting, rerun your check-curl.php script.

If cURL still appears to be missing even after you enable it, check that the correct php.ini is being used. The PHP version for the web server and the one for the command line can be different.

---

Step 4. Ask your hosting provider to enable cURL

If you cannot change PHP settings yourself, your hosting provider needs to fix this.

Open a ticket with wording like this.

I am getting this fatal error when Wordfence loads:

Fatal error: Uncaught Error: Call to undefined function curl_exec()
in wp-content/plugins/wordfence/vendor/wordfence/wf-waf/src/lib/http.php

This is after migrating to your server.

It looks like the PHP cURL extension is not enabled for the PHP version that runs my WordPress site.

Can you please:
1) Enable the PHP cURL extension for my site.
2) Make sure the curl_exec function is not disabled in php.ini.
3) Confirm that WordPress sees cURL as enabled.

Ask them to confirm when cURL is active, then retest Wordfence.

---

Step 5. Check if curl_exec is disabled for security

Some hosts disable functions with a configuration line like this in php.ini.

disable_functions = exec,passthru,shell_exec,curl_exec,system

If cURL is installed but curl_exec() appears as undefined or you see a message like “curl_exec has been disabled for security reasons” then this list is the problem.

You or your host need to remove curl_exec from disable_functions for the PHP that runs WordPress.

This usually requires host level access. So mention this in your ticket if you suspect it.

If cURL is installed but curl_exec is disabled in php.ini using disable_functions, please remove curl_exec from that list for my site so Wordfence can run correctly.

After they change it, the web server or PHP FPM must be restarted.

---

Step 6. Re enable Wordfence and test

Once cURL is enabled and curl_exec is allowed:

1. If you renamed the plugin folder, rename wordfence-disabled back to wordfence.
2. Log in to wp admin.
3. Go to Plugins → Installed Plugins and activate Wordfence if needed.
4. Go to Wordfence → Tools → Diagnostics and confirm that cURL shows as available.
5. Go to Wordfence → Firewall and see if any rule update errors appear.

If everything is configured correctly, the fatal error should not return.

---

Step 7. What to send to Wordfence support if it persists

If you still see the fatal error after cURL is confirmed as enabled, gather this information.

• The full fatal error text including the path and line number.
• Your WordPress version.
• Your PHP version.
• Your Wordfence plugin version.
• A screenshot or copy of the cURL section from Wordfence → Tools → Diagnostics.
• Any lines relating to cURL from your phpinfo() output.

Send this to:

• Your hosting provider support if you still suspect configuration issues.
• Or Wordfence support if the host confirms cURL is installed and enabled but the plugin still fails.

This gives them everything they need to check for an edge case in the Wordfence HTTP layer.

---

Verification checklist

You are in good shape when:

• Your site loads without a curl_exec() fatal error.
• Wordfence is active and its dashboard shows no cURL or connection errors.
• Wordfence → Tools → Diagnostics reports cURL as present.
• Your check-curl.php test, if you used it, prints that cURL is enabled and you have removed the test file.

---

Still stuck?

For AI help

Hit Continue Chat below and tell me:

• Whether you can access wp admin now.
• Your hosting type. For example cPanel shared hosting, VPS, managed WordPress.
• What you see in Wordfence → Tools → Diagnostics under PHP extensions.
• What your host has said so far about cURL and curl_exec.

I can help you translate that into specific next steps or a clear ticket for your host.

For expert human help

Scroll down to the contact form below. Enter your name, email, and WordPress needs. Atiba will get back to you as soon as possible.