Your question is much "romantic"and difficult to reply. You asked about Apache or Nginx. The first, Apache, is super known (and cracked) and to fire php originally pass by a phpmod (more safe) or by fastcgi. Nginx itself is built on a subsystem made of variables (easy to clear or change on the fly) and to fire php it passes by fastcgi. If you need php-fpm you neeed fastcgi. And with fastcgi, being multihop/multitear/multilayer/whatever web solution you change or clear a fastcgi variable and your http exchange is gone. Beyond these webservers httpd is maybe more secure in OpenBSD, when you are there, but a little limited in syntax and modernity (maybe miss the nginx variables ;) not really in portability..
Then they reply you of a php maybe not so secure. Maybe meaning that a scripting language is not so as cool as hamblee. But without class libraries is probably more sexy and less prone to 3rd party hacking. (did you heard any hacked voice system written in .net by the way?). Anyway, remaining on your security php plan.. it also depends on how much you are involved php in: db drivers, 3rd party components and external libraries. Here I'm enough serious ad less joke prone, be minimalist cause it pays off. I wonder than if at this point you think to be safe in C# or Java, but it needs an other thread.. Hope this helps. From: Romain FABBRI <[email protected]> To: Gustavo Rios <[email protected]>; OpenBSD-Misc <[email protected]> Date: Jul 28, 2026 17:42:10 Subject: Re: secure web > Hi, > > > > FPM is about PHP do you need PHP ? > > PHP is built « with » FPM on openbsd (so the php package is in fact php-fpm) > > > > If you need maximum security and less features have a look at httpd in base > it might be enough depending of your needs > > > > And if you need maximum security PHP might not be the best option unless it’s > needed > > What do you really want to do ? > > > > Regards, > > > > Romain > > > > *De :* [email protected] <[email protected]> *De la part de* > Gustavo Rios > *Envoyé :* mardi 28 juillet 2026 03:10 > *À :* OpenBSD-Misc <[email protected]> > *Objet :* secure web > > > > Hi folks. > > > > I am in need to setup a web server (apache/nginx) in order to get maximum of > security. I wonder how *-fpm could be used to supply such demand. > > > > thanks a lot for your time and cooperation. > > > > Gustavo. >
