Table of Contents
By Khimananda Oli | Last reviewed: August 2026
To host PHP on IIS reliably, you must configure the FastCGI module rather than legacy CGI or ISAPI handlers. This integration allows Internet Information Services to process PHP requests efficiently while maintaining native Windows authentication and security features. Many administrators struggle with this setup because they rely on outdated tutorials; however, the current standard involves using the Web Platform Installer or manual binary mapping with specific application pool isolation settings.
How do you install PHP on IIS using the Web Platform Installer?
The most reliable method to host PHP on IIS in 2026 remains the Microsoft Web Platform Installer (Web PI) or its modern command-line equivalents. While some engineers prefer manual zip extraction, Web PI automatically configures the necessary handler mappings, FastCGI settings, and dependency chains that are easy to miss during manual setup. If you are managing multiple servers or need audit-ready compliance for standards like ISO 27001, automated installation ensures consistency across your fleet.
Prerequisites and Feature Enablement
Before installing PHP, you must enable the underlying CGI infrastructure within Windows Server. Without this, IIS cannot spawn external processes regardless of your PHP configuration. Open PowerShell as Administrator and run the following command to install the required roles:
Install-WindowsFeature Web-Server, Web-CGI, Web-Mgmt-Console -IncludeManagementToolsThis command installs the core web server, the CGI/FastCGI gateway, and the management console. For teams familiar with Linux stacks, note that this is analogous to installing PHP on Ubuntu but requires explicit feature activation rather than package installation alone. After enabling these features, restart the W3SVC service to apply changes without a full reboot:
Restart-Service W3SVCInstalling PHP via Command Line
For repeatable infrastructure-as-code deployments, avoid the GUI. Use the Web PI command line or download the latest Non-Thread Safe (NTS) PHP binaries directly from windows.php.net. The NTS version is mandatory for IIS because FastCGI handles threading at the web server level; using Thread Safe builds introduces unnecessary overhead and potential stability issues.
- Download the latest PHP 8.x NTS x64 ZIP package.
- Extract to
C:\PHP(avoid paths with spaces). - Rename
php.ini-productiontophp.ini. - Enable required extensions by uncommenting lines like
extension=curl,extension=mbstring, andextension=openssl. - Set
cgi.fix_pathinfo=0to prevent path traversal vulnerabilities.
How do you configure FastCGI settings for optimal performance?
Once PHP is installed, you must register it with IIS as a FastCGI application. This step tells IIS how to spawn and manage PHP worker processes. A common mistake is leaving default instance limits, which causes request queuing under load. In production environments serving Nepali e-commerce sites or enterprise applications, tuning these values based on available RAM is critical for maintaining low latency.
Registering the Handler Mapping
You can configure handler mappings via the IIS Manager GUI or, preferably, through appcmd for documentation and automation purposes. The following command registers PHP 8.x globally:
%windir%\system32\inetsrv\appcmd set config /section:system.webServer/handlers /+"[name='PHP_via_FastCGI',path='*.php',verb='GET,HEAD,POST',modules='FastCgiModule',scriptProcessor='C:\PHP\php-cgi.exe',resourceType='Either']"After registering the handler, configure the FastCGI application settings to control process recycling and concurrency. These settings directly impact throughput and memory usage:
%windir%\system32\inetsrv\appcmd set config /section:system.webServer/fastCgi /+"[fullPath='C:\PHP\php-cgi.exe',maxInstances='8',instanceMaxRequests='10000',activityTimeout='300',requestTimeout='300']"
%windir%\system32\inetsrv\appcmd set config /section:system.webServer/fastCgi /+"[fullPath='C:\PHP\php-cgi.exe'].environmentVariables.[name='PHP_FCGI_MAX_REQUESTS',value='10000']"The maxInstances value should typically match your CPU core count or slightly exceed it for I/O-bound workloads. Setting instanceMaxRequests and PHP_FCGI_MAX_REQUESTS to matching values prevents race conditions during process recycling. For deeper insights into monitoring these metrics once configured, refer to our guide on Prometheus metrics monitoring fundamentals adapted for Windows exporters.
How do you secure PHP applications on Windows Server?
Security when you host PHP on IIS requires a defense-in-depth approach distinct from Linux environments. NTFS permissions replace POSIX chmod, and Windows Authentication integrates directly with Active Directory. Neglecting these specifics leaves applications vulnerable to privilege escalation and data leakage. Always assume the application will be probed for vulnerabilities and configure accordingly.
Application Pool Isolation
Never run PHP sites in the DefaultAppPool. Create a dedicated application pool for each site or tenant with the following critical settings:
- .NET CLR Version: Set to "No Managed Code". PHP does not use the CLR; loading it wastes memory and increases attack surface.
- Identity: Use ApplicationPoolIdentity or a specific service account with minimal privileges. Never use LocalSystem or Administrator.
- Load User Profile: Set to True if your application relies on user-specific environment variables or certificate stores.
File System Permissions
Grant the application pool identity (IIS AppPool\YourPoolName) only the access it needs. For a typical Laravel or WordPress deployment:
| Directory | Permission | Rationale |
|---|---|---|
| Web Root (public) | Read & Execute | Serves static assets and index.php |
| Storage / Logs | Modify | Required for caching, sessions, logging |
| Config Files | Read Only | Prevents malicious modification of .env |
| Uploads Directory | Modify (Restricted) | Isolate uploads; disable script execution |
To disable script execution in upload directories, add a local web.config file within that folder containing a handler removal directive. This prevents attackers from executing uploaded PHP shells even if they bypass validation logic.
What are the key differences between IIS and Nginx for PHP hosting?
Engineers often debate whether to host PHP on IIS or migrate to Linux-based alternatives. Understanding the trade-offs helps make informed architectural decisions, especially for organizations with existing Windows investments or compliance requirements mandating Windows Server.
| Criteria | IIS + FastCGI | Nginx + PHP-FPM |
|---|---|---|
| Integration | Native Windows Auth, AD, Kerberos | Requires additional modules/config |
| Performance | Excellent for ASP.NET/PHP mixed loads | Superior raw throughput for pure PHP |
| Management | GUI + PowerShell + appcmd | Text config + systemd |
| Licensing | Windows Server license required | Open source / free |
| Ecosystem | Azure DevOps, SQL Server, Exchange | Docker, Kubernetes, Cloud Native |
If your organization already operates Windows Server for Active Directory or SQL Server, hosting PHP on IIS reduces operational friction. However, for greenfield microservices or containerized workloads, consider exploring Docker for beginners to evaluate portable alternatives before committing to platform-specific configurations.
Deploy PHP on IIS with Confidence
Successfully configuring PHP on IIS requires attention to FastCGI tuning, strict NTFS permissions, and proper application pool isolation. When implemented correctly, this stack delivers enterprise-grade reliability with seamless Windows ecosystem integration. Start by validating your handler mappings and testing with phpinfo(), then progressively harden security and optimize performance based on real traffic patterns. If you need assistance auditing your Windows Server PHP deployment or migrating legacy applications to modern IIS configurations, reach out for a consultation tailored to your infrastructure.
