VocalHyre
Sign up

Apache · Configuration and operations

How do you run PHP with Apache?

Mediumphpphp-fpmapacheUpdated Oct 2026
Quiz this track

Short answer

Use PHP-FPM with mod_proxy_fcgi and the event MPM, or legacy mod_php with prefork. PHP-FPM separates PHP from Apache, supports pools and opcache, and avoids the thread-safety constraints of mod_php.

mod_php embeds the PHP interpreter in each Apache worker. It is simple but ties Apache to prefork or a carefully built thread-safe PHP, and a PHP crash can affect the web server process. PHP-FPM runs PHP in separate workers and Apache proxies FastCGI requests to them.

apache
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_fcgi_module modules/mod_proxy_fcgi.so

<FilesMatch "[.]php$">
  SetHandler "proxy:unix:/run/php/php-fpm.sock|fcgi://localhost"
</FilesMatch>

<Directory "/var/www/app/public">
  Require all granted
  AllowOverride None
</Directory>
PHP-FPM through a Unix socket with the event MPM.

Production considerations

  • Run a separate FPM pool per application or tenant with its own user
  • Tune pm.max_children from memory per PHP worker and available RAM
  • Enable opcache and validate timestamps only as needed
  • Match PHP upload and execution limits to Apache body and proxy timeouts
  • Keep the FPM socket in a directory the Apache user can access but others cannot
  • Use a try_files-like pattern so only real PHP files reach FPM
  • Log PHP errors to a file or stderr, not to the HTTP response

The front controller pattern needs care. A rewrite that sends every missing path to index.php must not also send arbitrary .php paths to FPM, or a crafted path may execute an unintended file. Restrict the handler to .php and verify the resolved script exists.

A common 503 with PHP-FPM means the socket path is wrong, permissions are wrong, or the pool is exhausted. Check the FPM error log and the pool status before changing Apache.

Follow-ups you should expect

Interviewers use these to check whether the first answer was understanding or memorisation.

  1. 1Why is PHP-FPM preferred over mod_php in modern deployments?
  2. 2How do you tune FPM pool size?
  3. 3What causes a 503 from PHP-FPM?
  4. 4How do you prevent arbitrary PHP file execution?

Say it in the interview

I use PHP-FPM with mod_proxy_fcgi and the event MPM. That keeps PHP out of Apache workers and lets me run separate pools per app. I size pm.max_children from memory, enable opcache, and align upload and timeout limits. I restrict the FastCGI handler to real .php files and check the FPM log first when I see a 503.

Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.

Related questions

HardHow do CGI and FastCGI work in Apache?MediumHow do Apache modules work and how do you manage them?MediumHow do you run Apache well in Docker?

Reading is step one

Now say it out loud.

Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Apache mock interview and get scored feedback on depth, clarity and confidence.

Start a free Apache interviewBrowse all questions