Web Server

Last updated on
28 April 2017

Drupal works on any web server with PHP (greater or equal PHP Version 5.5.9) support (For better security support it is recommended to update to at least 5.5.21 or 5.6.5 and above).

Security note: Some security features are only provided for Apache and (to a lesser extent) IIS through the use of .htaccess and web.config files. You are responsible for recreating these features when not using Apache.


Apache is the most commonly used web server for Drupal. Drupal will work on Apache 2.x hosted on UNIX/Linux, OS X, or Windows.

The majority of Drupal development and deployment is done on Apache, so there is more community experience and testing performed on Apache than on other web servers.

The Apache 'mod_rewrite' extension is required. It is used for clean URLs.

The Apache Virtualhost configuration must contain the directive AllowOverride All to allow Drupal's .htaccess file to be used.

If the Apache server has Options +MultiViews enabled by default, then the Apache Virtualhost configuration should also contain Options -MultiViews (or have -MultiViews added to the existing Options directive).

On some systems, particularly OpenSuse distributions you may have to add SymLink settings to the .htaccess file. Depending on security settings, you may need to add either +FollowSymLinks or +SymLinksIfOwnerMatch (especially on shared hosts). If this is required, the onscreen error messages may be unhelpful, but the error logs identify the problem correctly in both cases. If you edit the .htaccess file remember that you have to re-edit after updates which overwrite the file!


Nginx is a commonly used web server that focuses on high concurrency, performance and low memory usage.

Drupal will work on Nginx legacy versions (0.7.x, 0.8.x, 1.0.x, 1.2.x), stable 1.8.x versions, and mainline 1.9.x versions hosted on UNIX/Linux, OS X, or Windows. Nginx is a popular alternative to Apache, so there is also significant community experience and testing performed on Nginx.

The `ngx_http_rewrite_module` module is required as Drupal 8 uses it for clean urls. See also Clean URLs with NGINX.


Hiawatha is a web server with a strong focus on security. It also aims at being easy to use and being lightweight. Research performed by independent researchers proves that Hiawatha offers a performance comparable to other web servers under normal conditions, but much better performances while under attack.

Hiawatha is fully compatible with Drupal. For information about the required URL rewriting rules to use Drupal with Hiawatha, read Clean URLs with Hiawatha.

Microsoft IIS

Microsoft IIS is a web server and a set of feature extension modules for use with Microsoft Windows.

Drupal core will work with IIS 5, IIS 6, IIS 7 or IIS 8 if PHP is configured correctly.

To achieve clean URLs you may need to use a third party product. For IIS 7 or 8 you can use the Microsoft URL Rewrite Module or a third party solution.

On IIS 7 Drupal requires Windows 2008 Server SP2 or later for fastCGI support.

PHP Built-in Web Server (Development Only)

PHP Built-in Web Server is included as a CLI SAPI tool in PHP versions 5.4.0 and above.

PHP web server was designed to aid in application development. It may also be useful for testing purposes or for application demonstrations that are run in controlled environments. It is not intended to be a full-featured web server therefore it should not be used as a production server for public use.

This web server can be started through a Drush command provided by the PHP Server Drupal module.