If enabled, allow_url_fopen allows PHP's file functions (such as file_get_contents() and the include and require statements) can retrieve data from remote locations, like an FTP or web site.
Developers frequently forget this and don't do proper input filtering when passing user-provided data to these functions, opening them up to code injection vulnerabilities. A large number of code injection vulnerabilities reported in PHP-based web applications are caused by the combination of enabling allow_url_fopen and bad input filtering.

It's advisable to put allow_url_fopen always off .

Recommendations

• You can disable/enable allow_url_fopen in the php.ini file:

to disable:
; Disable allow_url_fopen for security reasons
allow_url_fopen = 'off'

to enable:
; Enable allow_url_fopen 
allow_url_fopen = 'on'

• For remote file access, consider using the cURL functions provided by PHP.