mod_php vs PHP-FPM: Which SAPI Runs Your Site

By PHP Patch Assurance · Last updated: 2026-10-25 · Plain-text version

SAPI is the layer between your web server and PHP. With mod_php, PHP runs inside Apache processes; with PHP-FPM, PHP runs as its pool of processes that Apache or nginx talks to. That matters in a vulnerability because it decides what an attacker who reaches PHP can touch, and it decides which service you restart when you patch.

mod_php: PHP inside Apache

With mod_php, the PHP interpreter is loaded as an Apache module, so PHP code runs inside Apache's own processes. It is simple to set up and was the traditional Apache arrangement — and it is the highest-risk configuration for a PHP flaw, because there is no process boundary between the web server and PHP.

PHP-FPM: PHP as its own service

With PHP-FPM, PHP runs as a separate pool of worker processes, and Apache or nginx forwards requests to it. The boundary between web server and PHP gives the operator separate controls: the pool can be restarted, limited, and monitored independently of the web server.

Other SAPIs exist

php-cgi, FrankenPHP and LiteSpeed's SAPI also run PHP sites. The fixed PHP releases apply to all of them — the version you need does not change with the SAPI — but the restart step does, so always confirm which SAPI serves your site before patching.

How to tell which one you run

phpinfo() shows a Server API line naming the SAPI.
apachectl -M listing a php module means mod_php.
A php-fpm master process in the process list means PHP-FPM.

Patching differences

The version to reach is the same either way — the fixed releases. What changes is the restart: mod_php needs an Apache restart, PHP-FPM needs its pool restarted, and Docker hosts rebuild the image either way. A patch that skips the restart is not live yet.

Check your site free Patch service

This guide pairs with the patch service.

Frequently asked questions

Which SAPI is safer?

PHP-FPM's process boundary is the safer arrangement in general, and it is the common choice for nginx and for high-traffic Apache setups. But the SAPI is not a substitute for patching: an unpatched version is vulnerable under either one.

How do I check my SAPI?

The fastest reliable way is phpinfo()'s Server API line on the web SAPI — not the CLI, which can report a different SAPI and even a different version.

Does the SAPI change the php2shell fix?

No. The fixed releases — 8.2.35, 8.3.36, 8.4.27, 8.5.12 — are the same for every SAPI. The SAPI changes the restart step, not the version you need.

← Guides