A web server is the program, such as Apache, Nginx or LiteSpeed, that answers when a visitor opens your site and sends back the page and files. Every time someone opens your website, a web server answers.
What is a web server?
A web server serves plain files itself and hands anything that needs a program, such as a PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. page, to the right component to run first.
The word is used for both the machine and the software, which causes confusion. In this context it means the software. Its job is simple to describe: listen for requests, decide what each one is asking for, and respond with the right file or the result of a program, together with a status codeAn HTTP status code is a three-digit number a website sends back with every page request to say how it went, such as 200 for OK or 500 for an error. and headersAn HTTP header is a short line of extra information that a browser and a website send each other with every page request, invisible to the visitor..
Apache, Nginx and LiteSpeed are the best known. They differ in how they handle many visitors at once and in how they read their configuration, but for a site owner the practical difference is mostly in how PHP is attached and which settings files control redirects and security rules.
What the web server means for a PHP or WordPress site
A web server cannot run PHP by itself. It needs a connection to PHP, and there are two common ways. With PHP-FPMPHP-FPM is a helper on your hosting that runs your site's PHP code as a separate job and hands the finished page back to the program that answers visitors., the web server passes the request to a separate PHP process pool. With mod_phpmod_php is an older way of running PHP, in which PHP is built into Apache, the program that answers visitors, instead of running as a separate helper., PHP runs inside the Apache process itself. Other setups, such as php-cgi, FrankenPHP and LiteSpeed’s own PHP handling, exist as well.
Which method you use affects speed, memory use and which settings you can change per site. It also affects how a PHP security updateA security patch is a software update that closes one known security weakness and adds nothing else, so installing it protects you against that problem. reaches your site. According to php.net, the vulnerabilities fixed on 21 October 2026 concern all PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and php.net considers the risk highest for mod_php. php.net and CISA have not reported exploitation in the wild. For the sourced status and a way to ask for help, see the PHP2Shell page.
The web server also holds the rules that WordPressWordPress is free software for building and editing a website in your browser. It is written in PHP, so it builds each page when someone visits. relies on: redirects, access restrictions and the handling of pretty permalinks.
How to find out what you run
Check the Server header in the response of your site, or look in the hosting panel. On a VPSA VPS (virtual private server) is your own virtual computer inside a bigger shared machine. You get more control than on shared hosting, and more to manage., a terminal command shows which web server is installed and which PHP connection it uses. Write down the web server, the PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing. and the way they are connected.
Also note where the configuration lives. Redirects or blocks set in a configuration file are easy to lose in a migration if nobody remembers them.
When to act
Look at your web server when you plan a PHP update, because the update has to be installed on the right component. Look at it after a migration when redirects or permalinks stop working, and whenever the server is more than a few months behind on updates. The PHP upgrade service covers the PHP side with a test on a copy first.
Frequently asked questions
Is a web server the same as a hosting provider?
No. A web server is software, such as Apache or Nginx. A hosting provider is the company that runs the machines where that software and your site live. The provider chooses or lets you choose which web server runs.
Which web server does my site use?
Often the Server header in the HTTP response names it, though some setups hide it. Your hosting panel or provider can also tell you. The answer matters mostly for configuration and for how PHP is connected to it.
Does my web server need updates too?
Yes. The web server is software with its own security fixes. On managed hosting the provider installs them. On a VPS you or your partner must do it, next to the PHP updates.