Web server choices for public-sector sites
This page is for infrastructure and application teams in public bodies who choose what serves an Exponential site. It answers which servers and engines the project supports, what each one means for operations, and how to choose when your organization keeps a list of approved server software. The facts come from Deploying, Chapter 8: Serving the site and the hosting page Choosing a web server.
Warning
.htaccess slows down every request. When .htaccess files are enabled (AllowOverride anything but None), let alone
used, Apache looks for them and reads and evaluates them on every request, in every directory of the path, and
page loading times go up drastically (measured). The only real fix is to switch the feature off for
the virtual host: AllowOverride None in the HTTPS virtual host, and the rules in the virtual host's own
configuration as mod_rewrite rules. That is far faster in production speed tests and well worth the time it takes
to optimize a production configuration. Switch over right away: copy the rules of the
example HTTPS virtual host into your virtual host (with the static cache, also
staticcache_offload.conf), set AllowOverride None, run apachectl configtest, reload Apache and
test the site. The same rules for other servers: nginx, LiteSpeed,
Caddy, IIS, Velocity (built in); where virtual host rules go in a control
panel: Plesk, cPanel, DirectAdmin, ISPConfig.
On LiteSpeed or OpenLiteSpeed, the server's own page cache can also answer anonymous visitors and crawlers without PHP: Page caching with LiteSpeed and OpenLiteSpeed.
Contents
- The three setups
- The choice in one table
- Questions that decide it
- Approved software lists
- Running two side by side
- Checklist
The three setups
| Setup | Choose it when |
|---|---|
| Apache (or nginx) with PHP-FPM | the server already has a web server, or your organization's standard is a classic web server |
Exponential Velocity (the qbix engine) | you want the fastest engine, persistent workers, a built-in response cache and no web server to configure |
| FrankenPHP | you want one verified binary with TLS and HTTP/2 and no PHP on the machine to maintain |
Velocity is the recommended engine for every stage; FrankenPHP is the production-ready alternative (Deploying). The setups can run side by side on different ports, so trying one never takes the others down.
The choice in one table
From Choosing a web server:
| Velocity | FrankenPHP | Apache + PHP-FPM | nginx + PHP-FPM | |
|---|---|---|---|---|
| PHP | 8.0 or later | built into the binary | 8.0 or later | 8.0 or later |
| Separate web server needed | no | no (Caddy is built in) | yes | yes |
| Own HTTPS and certificates | yes, including ACME | yes | no (mod_ssl and a certificate tool) | no |
| Application kept in memory between requests | yes | no | no | no |
| Response cache in front of PHP | yes | not yet | no | no |
| Rewrite rules | built in | generated | .htaccess_root | written by you |
PHP's built-in server is for development only: it has no TLS and must never face visitors.
Questions that decide it
| Question | If the answer is | Then |
|---|---|---|
| Does your organization allow a long-lived application process on its servers? | no | Apache or nginx with PHP-FPM |
| Is the machine's PHP 8.0 (for example the stock PHP of RHEL 9)? | yes | any engine; Velocity runs on 8.0 from its release 0.0.4.54 |
| Must the web tier be on your approved software list? | yes | see the next section |
| Does a central team terminate TLS on a load balancer or reverse proxy? | yes | any engine behind it, with trusted proxies set (Several web servers behind a load balancer) |
| Do anonymous visitors make most of the traffic? | yes | Velocity's response cache answers them without PHP (Velocity response cache and HTTP cache) |
Approved software lists
Many public bodies only run server software that has passed an internal assessment. Practical consequences:
- Apache and nginx are on most such lists already. The rules Exponential needs are in
.htaccess_root; for nginx they are translated rule by rule on nginx with PHP-FPM. - Velocity is a PHP application server shipped with Exponential, free software like the rest. Submit it to the assessment as part of the application, with its documentation: Velocity web server and Velocity for public-sector teams.
- FrankenPHP is downloaded as a pinned release whose SHA-256 checksum is verified before it runs
(Deploying);
install --engine=frankenphp --checkre-hashes an installed binary. Note that its embedded PHP reads no machinephp.ini(FrankenPHP). - Other servers (LiteSpeed, Caddy with PHP-FPM, IIS, lighttpd) are tier 3, expected to work (Operating system support). If your standard is one of them, record the risk.
Whatever you choose, keep the security rules of the shipped configuration. Do not remove rules from .htaccess to
make something work (Deploying).
Running two side by side
During a migration, or while an assessment of Velocity runs, both can serve the same installation on different ports:
a traditional server for visitors and Velocity on a test port for measurements. The shapes are described on
Velocity beside Apache or nginx. After any PHP change,
reload the right PHP-FPM and restart Velocity; exp:velocity deploy does both in the right order:
./console exp:velocity deploy --dry-run --allow-root-userChecklist
- To do: The setup is chosen and recorded in your hosting decision record.
- To do: It is on your approved software list, or an assessment is under way.
- To do: PHP version matches the engine (8.0 or later, Velocity included).
- To do: HTTPS is handled by the engine, the web server or a central proxy, and documented.
- To do: The deploy procedure names the right PHP-FPM service or Velocity.
Related pages
- Hosting index of this folder
- Apache with PHP-FPM, Velocity for hosts, FrankenPHP
- Hosting decision record
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.