How to Restart and Harden Apache and Nginx After a PHP Upgrade
Which services to restart after a PHP upgrade on Nginx, Apache, mod_php and LiteSpeed, and how to harden the web server for a Laravel app.
Upgrading PHP is only half the job. Until you restart the right services, your server keeps running the old binary. This guide covers what to restart on each web server setup, and how to harden Apache and Nginx for a Laravel app while you are there.
Patching for the October 2026 PHP vulnerabilities? Start with PHP Security Patch October 2026: What Laravel Devs Must Do.
What to Restart After a PHP Upgrade
| Setup | How PHP Runs | Restart After Upgrade |
|---|
| Nginx + PHP-FPM | FastCGI via socket/port | php8.4-fpm (Nginx reload optional) |
Apache + PHP-FPM (proxy_fcgi) | FastCGI via socket/port | php8.4-fpm, then reload Apache |
| Apache + mod_php | Inside Apache processes | Apache (required) |
| LiteSpeed / OpenLiteSpeed | LSAPI (lsphp) | lswsctrl restart |
Queue workers, Horizon and the scheduler also hold the old binary in memory. Restart them with php artisan queue:restart and php artisan horizon:terminate.
Which Setup Am I Running?
# Which web server is listening?
sudo ss -ltnp | grep -E ':80|:443'
# Apache: is mod_php loaded?
apache2ctl -M | grep -i php # Debian/Ubuntu
httpd -M | grep -i php # RHEL/Rocky/Alma
# Nginx: which FPM socket is it using?
grep -R "fastcgi_pass" /etc/nginx/
Nginx
Restart
sudo systemctl restart php8.4-fpm
sudo nginx -t && sudo systemctl reload nginx
Hide Version Details
# /etc/nginx/nginx.conf (http block)
server_tokens off;
fastcgi_hide_header X-Powered-By;
Block Sensitive Laravel Files
location ~ /\.(?!well-known) { deny all; }
location ~* \.(env|log|sql|bak)$ { deny all; }
Apache
Restart on Debian/Ubuntu
sudo systemctl restart php8.4-fpm # if using FPM
sudo apachectl configtest && sudo systemctl restart apache2
Restart on RHEL / Rocky / AlmaLinux
sudo systemctl restart php-fpm
sudo systemctl restart httpd
Hide Version Details
# /etc/apache2/conf-available/security.conf
ServerTokens Prod
ServerSignature Off
Header unset X-Powered-By
Set the DocumentRoot
Point the DocumentRoot at Laravel's public/ folder, never the project root. Otherwise .env can be downloaded.
For Both Servers
Set this in php.ini, then restart FPM or Apache:
expose_php = Off
The CLI and the web server can run different PHP binaries, so check both:
php -v
php-fpm8.4 -v
curl -sI https://yoursite.com | grep -iE 'server|x-powered-by'
After hardening, neither header should reveal a PHP version.
Frequently Asked Questions
Do I need to restart Nginx after updating PHP?
No. Restart PHP-FPM; Nginx only passes requests to it. A reload does no harm if you also changed Nginx config.
Do I need to restart Apache after updating PHP?
With mod_php, yes, because PHP runs inside Apache. With PHP-FPM, restart FPM and reload Apache.
How do I hide the PHP version from HTTP headers?
Set expose_php = Off in php.ini, plus server_tokens off on Nginx or ServerTokens Prod on Apache.
Running behind AWS or Azure? Add a firewall layer with our guide to AWS WAF and Azure WAF rules for PHP and Laravel. Need help with your server? Talk to our team.
Related Articles
SysNova Technologies, H NO 152 Muradgarhi, YEIDA Development Area, Gautam Buddh Nagar, 203209
Phone: +91 9793760210
Email: sales@sysnovatech.com