“Function libxml_disable_entity_loader() is deprecated”: what it means for WordPress, and the fix
Short answer
It’s a deprecation notice from PHP 8.0 and later: a plugin or theme that reads XML (feeds, imports, sitemaps) calls libxml_disable_entity_loader(), a safety switch against a known XML attack. PHP 8 has that protection on by default, so the call no longer does anything useful, and PHP says so. The import keeps working. PHP 8.5 words it more plainly: “deprecated since 8.0, as external entity loading is disabled by default”. Update the plugin or theme; the developer fix is to call it only on PHP 7.
The message, exactly
A feed importer switches the protection on before reading XML, and restores it afterwards. PHP 7.4 reads the feed silently; PHP 8.0 adds a notice for each call; PHP 8.5 adds the reason:
wp-content/plugins/feed-importer/includes/xml.php
<?php
$previous = libxml_disable_entity_loader(true); // protect against XXE
$xml = simplexml_load_string('<feed><title>News</title></feed>');
libxml_disable_entity_loader($previous);
echo $xml->title, "\n";
NewsDeprecated: Function libxml_disable_entity_loader() is deprecated in /var/www/html/wp-content/plugins/feed-importer/includes/xml.php on line 2
Deprecated: Function libxml_disable_entity_loader() is deprecated in /var/www/html/wp-content/plugins/feed-importer/includes/xml.php on line 4
NewsDeprecated: Function libxml_disable_entity_loader() is deprecated since 8.0, as external entity loading is disabled by default in /var/www/html/wp-content/plugins/feed-importer/includes/xml.php on line 2
Deprecated: Function libxml_disable_entity_loader() is deprecated since 8.0, as external entity loading is disabled by default in /var/www/html/wp-content/plugins/feed-importer/includes/xml.php on line 4
NewsWhat it means
XML files can point to other files (“external entities”). A malicious feed could use that to make a site read its own files, an attack known as XXE. For years, careful plugins called libxml_disable_entity_loader(true) before reading XML from elsewhere.
php.net explains why PHP 8 deprecated it: “As libxml 2.9.0 is now required, external entity loading is guaranteed to be disabled by default, and this function is no longer needed to protect against XXE attacks, unless the (still vulnerable) LIBXML_NOENT is used.” (php.net)
So on PHP 8 the call is redundant: the import works the same, and the site is just as protected.
Who fixes it
- Find the plugin or theme: the folder after
wp-content/plugins/orwp-content/themes/in the message. - Update it (Dashboard → Updates).
- Already on the latest version? Send one line of the message to its developer.
- Meanwhile, keep notices off your pages: the WordPress debug log.
Found before you switch
The call is in the code, so a check that reads code finds it while your site still runs PHP 7.4:
More PHP 8.0 changes: moving from PHP 7.4 to PHP 8.
Key takeaways
- A deprecation notice from PHP 8.0 and later; the XML is still read normally.
- The function protected against XXE attacks; since PHP 8.0, that protection is the default.
- PHP 8.5 adds the reason to the message: “as external entity loading is disabled by default”.
- The fix that keeps PHP 7 support: call it only when
PHP_VERSION_ID < 80000. - A check that reads code finds it before you upgrade, and doesn’t report the guarded version.
Frequently asked questions
Is my site less secure because of this?
No. On PHP 8, external entity loading is off by default, which is what the call used to ensure. The notice is about a now-unneeded call, not a missing protection.
Can I ignore it?
On your pages, yes: log PHP messages instead of showing them. The plugin should still drop or guard the call, so the notice stops filling the log and the code is ready for a PHP version without the function.
Why does the notice appear twice?
The code calls the function twice, as in the example: once to switch the protection on, once to restore the previous setting. Each call adds a notice.
Check your own site before you upgrade
CompatNav is a free WordPress plugin. It reads the code of your plugins and themes on your own server and tells you, in plain words, what will break and what will only show notices on the PHP version you choose. It never changes your code. It can’t see problems that only appear while code runs with real data, so a quick check of your site after the upgrade still matters.
Sources
About the code examples: each output is the real output of the code shown, run with the official PHP builds, without a php.ini, with all errors reported and displayed. Only the file path was replaced by a neutral server path.