PHP in hosted pages and network access

The tracker runs .php files in uploaded landing pages and offers. There are two modes: regular, without internet access, and “PHP with network access” — for an offer whose script sends the lead to the affiliate network's API on its own. New hosted offers created by the owner, an admin or a designer have network mode enabled by default. They can turn it off in the offer settings.

Global PHP switch

PHP execution is turned on with one setting for the whole installation. Owners and admins can see the Settings («Настройки») section.

1. Open Admin panel → Settings («Админ-панель → Настройки»), the General («Основные») tab.
2. Check Allow PHP in hosted landing pages («Разрешить PHP в локальных лендингах»). The checkbox is checked by default.
3. Click Save («Сохранить»).

The setting applies to both landing pages and offers. While it is on:

• only files with the .php extension are executed; the rest are served as regular files;
• a folder opens with index.php, or with index.html if there is no index.php.

When the setting is off, a request to a .php file gets a 403 response PHP execution is disabled, and a folder opens with index.html. The offer's PHP with network access («PHP с доступом в сеть») checkbox works only when the global switch is on.

Click data in PHP

When the page is opened via a campaign link or a click-through from a landing page to an offer, its index.php file receives the click parameters:

• $_GET['click_id'] — the tracker's click ID. Pass it to the affiliate network: the network returns it in the incoming postback;
• the other $_GET keys — the parameters of the original campaign link, for example sub_id_1;
• $rawClick — an array with the same parameters;
• $click — an object with the same fields: $click->click_id, $click->sub_id_1.

<?php
$clickId = $_GET['click_id'] ?? '';

If the ad link had its own click_id parameter, it does not reach PHP: this name always carries the tracker's click ID.

The HTML that index.php returns under a campaign link goes through macro substitution. A handler that the form calls with a separate request, for example api.php, does not get the click parameters on its own. Pass it the click ID in a hidden form field:

<input type="hidden" name="subid" value="{click_id}">

The visitor's IP in any request to PHP is in $_SERVER['HTTP_CF_CONNECTING_IP'].

What is blocked in regular mode

Regular mode applies to all landing pages and to offers without the PHP with network access checkbox.

• There are no outgoing HTTP requests: curl_exec, curl_multi_exec and file_get_contents with an https://… address do not work.
• ini_set is disabled.
• The script sees only its page folder and the temporary directory /tmp. Files of other pages are not accessible.
• The page folder is read-only: PHP cannot create or modify a file in it.
• Running system commands (exec, shell_exec, system, proc_open), sockets (fsockopen, stream_socket_client), mail (mail) and phpinfo are disabled.
• .user.ini files from the archive are not applied, and file uploads by visitors are turned off.
• PHP errors are not shown to the visitor and are not written to the log.

Form data from such a page is sent to the tracker by the browser — see Leads from forms.

“PHP with network access”

The PHP with network access checkbox in a hosted offer's settings allows its PHP files to make outgoing HTTP requests from the tracker server: curl and file_get_contents with an https://… address. In this mode ini_set is also available.

Keep it on when the form handler from the archive — for example api.php — receives the visitor's data and sends the lead to the affiliate network's API on its own.

• The setting exists only for offers with Hosted («Локальный») hosting. Landing pages and external offers do not have it.
• The owner, admin and designer see and change the checkbox. When a team lead edits the offer, the value does not change.
• When the owner, admin or designer creates a hosted offer, the checkbox is on by default. A team lead creates offers without network mode. Existing offers keep their saved setting.
• It applies to one offer and to all of its .php files.

When you do not need it

• The page consists of HTML, CSS and JavaScript without server requests.
• The form is sent by the browser: directly to the affiliate network or by a script on the page.
• The offer is external or only redirects the visitor.
• You only need postbacks. The affiliate network's incoming postback and outgoing S2S are handled by the tracker itself; the checkbox does not affect them.

Enable when creating an offer

1. Open Offers («Офферы») and click + Offer («+ Оффер»).
2. Fill in Name («Название») and the other offer fields.
3. In the Hosting («Хостинг») field, choose Hosted.
4. The PHP with network access checkbox is already checked. Uncheck it if server-side HTTP requests are not needed.
5. Click Create offer («Создать оффер»).

The editor opens: upload a ZIP archive or add files. The setting is already saved and applies to the offer's PHP files, including after the archive is uploaded.

Network mode is not saved for an external offer. If you switch back to hosted before creating the offer, the form remembers your checkbox choice.

Enable or disable for an existing offer

1. Open Offers and click the hosted offer's name.
2. In the Edit offer («Изменить оффер») window, check or uncheck PHP with network access.
3. Click Save.

You do not need to re-upload the archive after changing the setting. It starts working on traffic within about 15 seconds.

What stays blocked in network mode

Network PHP runs separately from regular PHP. Requests from it go only to public addresses and only on ports 80 and 443. These are still blocked:

• the tracker's databases and data, the server's internal network and private addresses;
• running system commands, sockets and mail;
• files of other pages and writing to the offer folder;
• file uploads by visitors and .user.ini files.

Limits of both modes

The response time is counted in full, including waiting for the external service's response. If the script does not respond within this time, the visitor gets an error instead of the page. Waiting for the external service's response is not counted in max_execution_time.

Who changes the PHP code of a network offer

While the offer has PHP with network access checked, the owner, admin and designer can change .php files, upload a ZIP archive, rename files, and save and restore code versions. A team lead can edit the other files. For details, see File editor, versions and export.

When the owner, admin or designer makes a regular clone, the original's mode is kept, including network access that was explicitly turned off. A team lead's copies are created without network mode. Sending independent copies to team members is still available only to managers. A deleted network offer is restored from the trash by the owner, admin or designer; it stays paused until it is turned on separately.

Check

Test on a separate test offer and the recipient's test API.

1. Add the offer to a stream.
2. Open the campaign link. At the page's direct URL, click_id is not passed.
3. Submit the form with test data.
4. Check the PHP handler's response.
5. Make sure the lead appeared on the recipient's side. Reaching the thank-you page does not confirm delivery.
6. Find the click in click search: after the affiliate network's postback, a conversion appears in its card.
7. Check outgoing events in the delivery log.

Do not send real leads again for testing.

If something went wrong

PHP execution is disabled

The global switch is off. Check Allow PHP in hosted landing pages in Admin panel → Settings → General and click Save.

The PHP code of an offer with internet access can be changed by the owner, admin and designer («PHP-код оффера с доступом в интернет меняют владелец, администратор и верстальщик»)

You are logged in as a team lead and are changing a .php file, uploading an archive, renaming a file or working with code versions of a network offer. Ask the owner, an admin or a designer to make the change.

The form is sent, but the lead does not reach the affiliate network

1. Open the Edit offer window and make sure PHP with network access is checked and saved.
2. Check the API address, key and request parameters in the handler code. The address must be public, and the port must be 80 or 443.
3. Check the affiliate network's response time: the script's response, together with waiting for the network, is limited to 105 seconds.