PHP handlers are the behind-the-scenes tools that allow your web server (Apache, in most cases) to process PHP scripts. When you visit a website with PHP content—like a WordPress blog or an e-commerce store—the server needs to interpret and execute the PHP code to deliver the page you see. Different PHP handlers manage this process in unique ways, each offering trade-offs in performance, security, and resource usage.

Choosing the right PHP handler can:

Speed up your website: Faster processing means quicker page loads.
Enhance security: Proper isolation keeps your site safe from others on the server.
Optimize resources: Efficient handlers use less CPU and memory.

Let’s explore the five common PHP handlers available, their pros and cons, and when they might suit your needs.

Common PHP handlers

PHP-FPM (FastCGI Process Manager)

PHP-FPM is an enhanced version of FastCGI, designed specifically for PHP. It maintains a pool of reusable PHP processes to handle requests efficiently.

Pros:

Performance: Reuses processes instead of starting new ones, speeding up response times.
Security: Runs scripts under your user account, isolating them from other users’ files.
Resource Control: Lets you fine-tune process limits and memory usage on a per-site basis.

Cons:

Complexity: Requires more setup effort than simpler handlers.
Resource Usage: Can consume more resources if not configured carefully.

Best For: Most websites, especially those needing a balance of speed and security.

FastCGI

FastCGI is a protocol that keeps a persistent process alive to handle PHP requests, improving on traditional CGI by avoiding repeated startups.

Pros:

Performance: Faster than CGI since it reuses processes.
Security: Can run scripts under your account when paired with suexec (more on that later).

Cons:

Configuration: Needs proper tuning for optimal results.
Resource Usage: Persistent processes may use more memory if not managed well.

Best For: Sites needing better performance than CGI without PHP-FPM’s advanced features.

SuPHP

SuPHP is a module that runs PHP scripts under your user account rather than the web server’s, prioritizing security.

Pros:

Security: Isolates scripts by user, preventing unauthorized file access.

Cons:

Performance: Slower, as it starts a new process for every request.
Compatibility: May not work with all PHP setups or applications.

Best For: Shared hosting where security trumps speed.

CGI (Common Gateway Interface)

CGI is an older method that launches a new process for each PHP request.

Pros:

Security: Can run under your account with suexec, isolating each request.

Cons:

Performance: Very slow due to the overhead of starting new processes.
Scalability: Struggles with high-traffic sites.

We generally advise against using plain CGI, unless there is a specific need.

DSO (Apache mod_PHP)

DSO, or Apache mod_PHP, embeds the PHP interpreter directly into Apache, processing scripts within the web server itself.

Pros:

Performance: Extremely fast since there’s no external process communication.

Cons:

Security: Runs all scripts under Apache’s account, risking cross-site vulnerabilities.
Stability: A crashing script can take down the entire server.

Best For: Servers running a single, high-performance site with strong security measures implemented.

Our recommendation: PHP-FPM for most use cases

At Liquid Web, we recommend PHP-FPM as the go-to PHP handler for most customers. Here’s why:

Balanced Performance: Process pooling and reuse keep your site fast.
Strong Security: User-level script execution keeps things isolated.
OPCache Ready: Boosts speed further with caching.

That said, the ideal handler depends on your site’s needs—traffic, application type, and security priorities all play a role. For most, though, PHP-FPM hits the sweet spot.

Improving security for CGI and FastCGI with Suexec

Suexec is an Apache feature that lets CGI and FastCGI scripts run under your user account instead of Apache’s. In shared hosting, this is a game-changer—it prevents one user’s scripts from interfering with another’s files.

How Suexec works:

With CGI: Ensures each new process runs as you, not the server.
With FastCGI: Pairs with persistent processes to maintain user-level security.

Our Recommendation: We recommend enabling suexec with CGI and FastCGI for enhanced security and isolation, especially in shared environments.

Improving performance with PHP OpCache

PHP OPCache is a caching tool that stores precompiled PHP code in memory. Instead of reinterpreting scripts for every request, it reuses this cached version, cutting down on processing time.

Benefits:

Faster Load Times: Skips compilation for quicker responses.
Lower Resource Use: Reduces CPU load by compiling scripts just once.

Which handlers benefit from Opcache?

Handlers with persistent processes—PHP-FPM, FastCGI, and DSO—can keep OPCache’s cache alive across requests, maximizing its impact. CGI and SuPHP, which start fresh processes each time, can’t maintain this cache.

For the best results, pair OPCache with PHP-FPM or FastCGI.

Where to adjust PHP handlers:

cPanel: PHP handlers can be configured in WHM > MultiPHP Manager. Learn more.

InterWorx: Generally uses PHP-FPM by default. PHP versions and PHP-FPM settings can be configured by editing the SiteWrox account within NodeWorx.

Plesk: PHP Handlers can be configured under the PHP Settings section for each domain in Plesk.

Final thoughts

PHP handlers are a critical piece of your hosting environment, affecting how your website performs and stays secure. Whether you manage your site via cPanel, Plesk, or Interworx, understanding these options empowers you to optimize your setup.

Was this article helpful?

Thank you for your input.

Thank you for your feedback.