PHP Settings
The PHP version, memory, worker count and request limits one application runs with — plus its hardening and PHP-FPM tuning.
Every PHP application gets its own pool, so these settings are per application, not per server. The strip at the top of the screen is the summary you came for: version, memory, upload limit, page limit, and the user PHP runs as.
Basic settings
| Setting | Directive | What it decides |
|---|---|---|
| PHP version | php_version | Which PHP this application runs on. Changing it reloads the pool. |
| Memory each request may use | memory_limit | The ceiling for one request. |
| PHP worker processes | pm.max_children | How many requests can run at once. |
| Biggest file someone can upload | upload_max_filesize + post_max_size | Both are set together, so an upload cannot be refused by the smaller of the two. |
| How long a page may run | max_execution_time | Where a runaway request gets cut off. |
| Fields a form may contain | max_input_vars | Raise it for very large forms; a silently truncated $_POST is the symptom. |
The two numbers that matter most are multiplied for you:
256M × 5 workers = 1.3 GB at full load — 4.5 GB of 5.8 GB still free
That bar, and the "No other applications are using memory" line under it, is the panel preventing the classic mistake: raising both the memory limit and the worker count until the server can be OOM-killed by its own traffic.
Worker presets — Low traffic, Balanced, High traffic — set the worker count for you; picking a number yourself shows as Custom.
Security
| Setting | Directive | Notes |
|---|---|---|
| Keep PHP inside this application's folder | open_basedir | Off by default. On, PHP cannot read outside the application folder. What turning this on would allow expands to show what changes. |
| Let PHP open remote URLs | allow_url_fopen | On by default. Off breaks libraries that fetch over file_get_contents. |
| Blocked PHP functions | disable_functions | A list of functions PHP will refuse to run — "what an attacker reaches for first". |
The blocked list ships populated (53 functions by default) and each entry can be removed individually. Start from replaces the whole list with one of two baselines:
- Recommended — the default set.
- Strict — adds process, user and socket inspection. The panel warns that it "matches typical shared-hosting hardening, and may break a site that uses the sockets extension".
Advanced
This tab opens with a warning, and it means it: "These change how PHP-FPM runs this application. The defaults suit almost every application — change them only if you know why."
| Setting | Directive |
|---|---|
| How workers start | pm — On demand, or a static/dynamic pool |
| Restart a worker after this many requests | pm.max_requests — the standard defence against a slow memory leak |
| How long an upload may take | max_input_time |
| How long a login stays valid | session.gc_maxlifetime |
| Time zone PHP reports | date.timezone, defaulting to the server's |
| File to run before every page | auto_prepend_file |
| Biggest form submission | post_max_size |
| Extra directives | Anything else, one key = value per line |
Saving
Nothing applies until Save and reload PHP, and the button stays disabled while "Nothing has changed". Saving reloads this application's pool — a reload, not a restart, so in-flight requests finish.