Hands-on guide series

PHP-FPM and the LEMP Runtime: A Hands-On Guide

A five-part, hands-on guide to running PHP in a LEMP stack on a single VPS: install php-fpm and serve through nginx, size a dedicated fpm pool, put a real app behind nginx with a safe FastCGI config, tune OPcache, and harden the runtime. Every command tested on a live Ubuntu 24.04 server.

5 parts35 min totalBy Amith Kumar

What you will build

Security is layers, not a switch. Each part closes a different category of attack, from the automated sweep that finds a brand-new server, to the day one gets in anyway. Read them in order, or jump to what you need.

  1. 1Install PHP-FPM and Serve a Page Through nginxSee the destination first, then install php-fpm on a bare Ubuntu 24.04 slice, point nginx at the fpm socket, and serve a PHP page that executes.9 min
  2. 2FPM Pools and the Process ManagerBuild a dedicated php-fpm pool that runs as its own user, size the worker count from the memory on the box, and read the live pool status through nginx.7 min
  3. 3A PHP App Behind nginxPut a multi-file PHP app behind nginx with a front controller and a SQLite query, then lock the FastCGI config so the runtime never runs an arbitrary path.7 min
  4. 4OPcache and PHP PerformanceTune PHP OPcache with a drop-in, read its near-perfect hit rate through a status page, and measure a repeated request with the bytecode cache on and off.6 min
  5. 5PHP-FPM Security and HardeningSet the php-fpm security baseline: hide the version, disable shell functions, fence files with open_basedir, and log errors instead of leaking them.6 min
Start with Part 1