Nginx For PHP Applications

Nginx normally serves static files and forwards PHP scripts to PHP-FPM through FastCGI.

Why This Matters

A correct boundary prevents source disclosure, routes front-controller requests, preserves useful headers, and exposes logs for 404, 403, and 502 diagnosis.

Working Model

The public document root contains the front controller and public assets. try_files checks real files before routing to index.php. A restricted PHP location passes the resolved script filename to the intended FPM socket or TCP listener.

Practical Rules

  • Point root at the public directory.
  • Use try_files $uri /index.php?$query_string or the framework-supported equivalent.
  • Restrict PHP execution to intended entry scripts.
  • Match fastcgi_pass to the real FPM listener.
  • Test configuration before graceful reload.

Failure Modes

  • Serving the project root.
  • Using an unsafe SCRIPT_FILENAME mapping.
  • Letting uploaded files execute as PHP.
  • Restarting instead of testing and reloading.

Verification

  • Run nginx -t.
  • Request static, routed, missing, forbidden, and PHP-source paths.
  • Inspect access, error, and FPM logs.
  • Verify upload and body-size limits.

What You Should Be Able To Do

After this lesson, you should be able to explain Nginx document roots, try_files routing, FastCGI and PHP-FPM integration, static assets, logs, and safe reloads, choose a suitable approach for a real PHP project, and verify the result instead of relying on assumptions.

Practice

Practice: Write A Front Controller Shape

Describe an Nginx server block for a PHP front controller.

Your answer must:

  • state the intended outcome;
  • show the commands, data flow, or implementation shape;
  • identify at least one unsafe alternative;
  • explain how the result will be verified.
Show solution

Use the public root, exact or restricted PHP handling, try_files for assets and fallback, included FastCGI parameters, a correct script filename, and the intended FPM socket.

The important part is not memorising one command or vendor screen. The solution makes the invariant, failure behavior, and verification evidence explicit.

Practice: Diagnose A 502

Nginx returns 502 after a PHP upgrade.

Your answer must:

  • state the intended outcome;
  • show the commands, data flow, or implementation shape;
  • identify at least one unsafe alternative;
  • explain how the result will be verified.
Show solution

Check Nginx error logs, FPM service status, configured socket path, socket ownership, versioned service names, and FPM logs before changing application code.

The important part is not memorising one command or vendor screen. The solution makes the invariant, failure behavior, and verification evidence explicit.

Practice: Block Source Download

Verify that PHP and environment files cannot be downloaded.

Your answer must:

  • state the intended outcome;
  • show the commands, data flow, or implementation shape;
  • identify at least one unsafe alternative;
  • explain how the result will be verified.
Show solution

Request known sensitive paths, ensure only the front controller executes, deny dotfiles and non-public directories, and confirm missing FastCGI does not fall back to static source delivery.

The important part is not memorising one command or vendor screen. The solution makes the invariant, failure behavior, and verification evidence explicit.