VocalHyre
Sign up

Apache · Configuration and operations

How do CGI and FastCGI work in Apache?

Hardcgifastcgiprocess managementUpdated Oct 2026
Quiz this track

Short answer

CGI starts a new process per request, while FastCGI keeps persistent workers that handle many requests. Use CGI only for rare scripts and FastCGI through mod_proxy_fcgi or mod_fcgid for production runtimes.

CGI is a simple contract: the server sets environment variables, starts the program, passes the request body and reads headers plus body from stdout. It is easy to reason about but expensive because every request pays process startup. FastCGI keeps a pool of processes alive and multiplexes requests over a socket.

apache
ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/

<Directory "/usr/lib/cgi-bin">
  Options +ExecCGI
  AddHandler cgi-script .cgi .pl
  Require all granted
</Directory>

<FilesMatch "[.]php$">
  SetHandler "proxy:unix:/run/php/php-fpm.sock|fcgi://localhost"
</FilesMatch>

Security and operations

  • Every CGI script runs as the Apache user unless you use suexec or a separate wrapper
  • A script with a bug can read files and environment variables available to that user
  • FastCGI pools need their own user, socket permissions and resource limits
  • Set idle and request timeouts so stuck workers are recycled
  • Restrict handler mappings to expected extensions and real files
  • Keep scripts outside the document root when possible and serve only through ScriptAlias
  • Log stderr from scripts separately; a silent CGI failure usually appears in the error log

With mod_proxy_fcgi, Apache is only the front end. The application runtime owns process management, so tuning happens in the FPM or FastCGI pool, not in Apache. A 503 usually means the pool is down, the socket path is wrong or permissions block access.

CGI is not inherently insecure, but it is unforgiving. Any file writable by the web user that can be executed is a potential code execution path, so permissions and handler scope matter more than the protocol choice.

Follow-ups you should expect

Interviewers use these to check whether the first answer was understanding or memorisation.

  1. 1Why is CGI slower than FastCGI?
  2. 2What does ScriptAlias do?
  3. 3How do you secure a CGI directory?
  4. 4Where do you tune FastCGI worker limits?

Say it in the interview

CGI starts a process for every request, which is simple but expensive. FastCGI keeps workers alive and Apache proxies to them through mod_proxy_fcgi or mod_fcgid. I restrict handler mappings, keep scripts out of writable document roots and run pools under dedicated users. With FastCGI the real tuning lives in the pool, not in Apache.

Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.

Related questions

MediumHow do you run PHP with Apache?MediumHow do Apache modules work and how do you manage them?MediumHow do you configure Apache as a reverse proxy?

Reading is step one

Now say it out loud.

Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Apache mock interview and get scored feedback on depth, clarity and confidence.

Start a free Apache interviewBrowse all questions