--- title: PHP on IIS7 (RC1), but unsafe! | daily.dev description: Running PHP on the upcoming IIS 7 via the ISAPI extension approach shown by Microsoft's BillS is flagged as unsafe because ISAPI binds PHP into the... canonical: https://daily.dev/posts/php-on-iis7-rc1-but-unsafe--opf86c6hj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: PHP on IIS7 (RC1), but unsafe! | daily.dev og:description: Running PHP on the upcoming IIS 7 via the ISAPI extension approach shown by Microsoft's BillS is flagged as unsafe because ISAPI binds PHP into the... og:url: https://daily.dev/posts/php-on-iis7-rc1-but-unsafe--opf86c6hj og:image: https://api.daily.dev/og/posts/oPf86c6Hj.png og:image:alt: PHP on IIS7 (RC1), but unsafe! og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # PHP on IIS7 (RC1), but unsafe! **[Maarten Balliauw](https://daily.dev/sources/maartenballiauw)** · 3 min read · 0 upvotes · 0 comments ## Summary Running PHP on the upcoming IIS 7 via the ISAPI extension approach shown by Microsoft's BillS is flagged as unsafe because ISAPI binds PHP into the multi-threaded IIS worker process, and not all PHP extensions are thread-safe. Registering PHP as a CGI avoids the threading issue but hurts performance. The recommended fix is FastCGI, which recycles PHP processes and persistent database connections (e.g. mysql_pconnect). A step-by-step guide covers installing isapi_fcgi.dll, creating the FASTCGI.php registry key, mapping the .php extension to the FastCGI DLL in IIS6, and tuning registry values like ThreadPoolSize, StartServers, MaxServers, and Timeout. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why is running PHP as an ISAPI extension on IIS considered unsafe? PHP as an ISAPI extension binds to the multi-threaded IIS worker process, but not all PHP extensions are thread-safe, which can cause instability or crashes under load. Running PHP as a CGI process avoids this threading issue entirely but comes with a significant performance penalty, since a new process must be spawned for each request. _Teams weighing PHP deployment options on IIS can track these trade-offs through daily.dev._ ### How do I configure FastCGI for PHP on IIS6? Install PHP 4.3.x or later, download and unpack isapi_fcgi.dll into the PHP installation folder, then create a HKEY_LOCAL_MACHINE:\Software\FASTCGI.php registry key with AppPath and BindPath values pointing to php.exe and a bind path like php-fcgi. Finally, map the .php extension in IIS Internet Service Manager to the FastCGI DLL and restart IIS. _Developers setting up PHP on Windows servers can follow configuration walkthroughs like this via daily.dev._ ### What does the ThreadPoolSize and MaxServers registry setting control in IIS FastCGI for PHP? ThreadPoolSize sets the size of the thread pool FastCGI provides on IIS, defaulting to 10, while MaxServers caps the maximum number of FastCGI processes that can run, defaulting to 25. Related settings include StartServers (2), IncrementServers (2), and Timeout (600 seconds) for idle process termination, letting administrators tune process recycling and load handling. _Anyone tuning server concurrency settings can compare configuration tips on daily.dev._ ## Similar posts on daily.dev - [PHP language still relevant, advocate insists](https://daily.dev/posts/php-language-still-relevant-advocate-insists-kqkphaixm) · InfoWorld · 26 upvotes · 6 comments --- Tags: [#php](https://daily.dev/tags/php), [#.net](https://daily.dev/tags/.net) [View this post on daily.dev](https://daily.dev/posts/php-on-iis7-rc1-but-unsafe--opf86c6hj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"PHP on IIS7 (RC1), but unsafe!","url":"https://daily.dev/posts/php-on-iis7-rc1-but-unsafe--opf86c6hj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/php-on-iis7-rc1-but-unsafe--opf86c6hj"},"datePublished":"2026-10-04T13:05:17.443Z","dateModified":"2026-10-04T13:11:18.158Z","description":"Running PHP on the upcoming IIS 7 via the ISAPI extension approach shown by Microsoft's BillS is flagged as unsafe because ISAPI binds PHP into the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cf36546e839b8d6d4f71460de335fdfd?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cf36546e839b8d6d4f71460de335fdfd?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Maarten Balliauw","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Maarten Balliauw","logo":"https://media.daily.dev/image/upload/s--rOTg3VYO--/f_auto,q_auto/v1791119043/logos/maartenballiauw?_a=BAMAMicg0","url":"https://daily.dev/sources/maartenballiauw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/php-on-iis7-rc1-but-unsafe--opf86c6hj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"php,.net","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Maarten Balliauw","item":"https://daily.dev/sources/maartenballiauw"},{"@type":"ListItem","position":3,"name":"PHP on IIS7 (RC1), but unsafe!"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/php-on-iis7-rc1-but-unsafe--opf86c6hj#faq","mainEntity":[{"@type":"Question","name":"Why is running PHP as an ISAPI extension on IIS considered unsafe?","acceptedAnswer":{"@type":"Answer","text":"PHP as an ISAPI extension binds to the multi-threaded IIS worker process, but not all PHP extensions are thread-safe, which can cause instability or crashes under load. Running PHP as a CGI process avoids this threading issue entirely but comes with a significant performance penalty, since a new process must be spawned for each request. Teams weighing PHP deployment options on IIS can track these trade-offs through daily.dev."}},{"@type":"Question","name":"How do I configure FastCGI for PHP on IIS6?","acceptedAnswer":{"@type":"Answer","text":"Install PHP 4.3.x or later, download and unpack isapi_fcgi.dll into the PHP installation folder, then create a HKEY_LOCAL_MACHINE:\\Software\\FASTCGI.php registry key with AppPath and BindPath values pointing to php.exe and a bind path like php-fcgi. Finally, map the .php extension in IIS Internet Service Manager to the FastCGI DLL and restart IIS. Developers setting up PHP on Windows servers can follow configuration walkthroughs like this via daily.dev."}},{"@type":"Question","name":"What does the ThreadPoolSize and MaxServers registry setting control in IIS FastCGI for PHP?","acceptedAnswer":{"@type":"Answer","text":"ThreadPoolSize sets the size of the thread pool FastCGI provides on IIS, defaulting to 10, while MaxServers caps the maximum number of FastCGI processes that can run, defaulting to 25. Related settings include StartServers (2), IncrementServers (2), and Timeout (600 seconds) for idle process termination, letting administrators tune process recycling and load handling. Anyone tuning server concurrency settings can compare configuration tips on daily.dev."}}]} ```