Configure PHP FastCGI on IIS, the settings that matter

Before you start

What has to be in place

• The CGI role service. Install-WindowsFeature Web-CGI. Despite the name, this is IIS's FastCGI support.
• The Non Thread Safe x64 build of PHP from windows.php.net, unpacked to its own folder, for example C:\PHP\8.4.
• The Visual C++ 2015-2022 runtime (x64). Without it php-cgi.exe cannot start and IIS reports "FastCGI process exited unexpectedly".

1. Register the FastCGI application

In IIS Manager, at server level, open FastCGI Settings and add an application whose full path is C:\PHP\8.4\php-cgi.exe. The settings on that application are where performance and stability are decided:

• Max instances: how many php-cgi.exe workers may run at once. 0 lets IIS choose from the processor count; on a small VPS a fixed number such as 4 to 8 per CPU core keeps memory in check.
• Instance max requests: a worker is recycled after this many requests, which clears slow memory leaks. 10000 is the usual value.
• PHP_FCGI_MAX_REQUESTS: add it as an environment variable with the same value as instance max requests, so PHP and IIS agree on when a worker retires. If PHP retires first, IIS sees a worker vanish mid-request.
• PHPRC: an environment variable pointing at the PHP folder, so php-cgi.exe reads the php.ini you intend and not one it finds elsewhere.
• Activity timeout and request timeout: how long a request may run without output, and in total. Raise them above your longest legitimate request (imports, reports), and keep PHP's max_execution_time just below, so PHP stops a runaway script with a proper error before IIS kills the worker.
• Monitor changes to file: point it at php.ini, so IIS recycles the workers when you change it instead of serving the old configuration until the next restart.

2. Map .php to the FastCGI application

Add a module mapping: request path *.php, module FastCgiModule, executable the same php-cgi.exe path, and restrict it to files that exist (Request Restrictions, "File"), so a request for a missing .php file returns a clean 404 instead of reaching PHP. Add index.php to the Default Document list.

3. Set php.ini for FastCGI

• Start from php.ini-production, never from the development file.
• cgi.force_redirect = 0: IIS does not use the redirect check Apache does.
• cgi.fix_pathinfo = 1: gives applications correct PATH_INFO and SCRIPT_FILENAME under IIS.
• fastcgi.impersonate = 1: PHP runs as the site's anonymous authentication user. Set that user to the application pool identity (in Authentication, Anonymous, Edit), so PHP runs as the site's own identity and file permissions work per site.
• fastcgi.logging = 0: stops PHP notices leaking into the FastCGI protocol stream.
• Turn on OPcache, and move session.save_path, upload_tmp_dir and sys_temp_dir outside the PHP folder so an upgrade does not touch them.

4. Test and watch

Load a page that calls phpinfo() once to confirm the Server API reads "CGI/FastCGI" and the loaded php.ini is the right one, then delete it. Watch memory in Task Manager under load: many idle php-cgi.exe processes point at max instances too high; requests queuing point at it too low.