Upgrading WordPress to PHP 7: Configuration Changes

I upgraded my Ubuntu server to 16.04 and WordPress stopped working. Ubuntu 16.04 ships with PHP 7, and my nginx configuration still pointed to the old PHP 5 socket path.

The fix was one path. The php-fpm socket moved from /run/php/php5-fpm.sock to /run/php/php7.0-fpm.sock, while my nginx configuration still pointed to the old PHP 5 location.

Install the PHP 7 packages WordPress needs:

sudo apt install php-fpm php-mysql php7.0-xml

php-fpm provides the FastCGI process manager, php-mysql adds MySQL database support, and php7.0-xml handles XML parsing for WordPress’s RSS feeds and XML-RPC.

PHP has a setting called cgi.fix_pathinfo that’s enabled by default. It’s a security risk—it lets attackers execute arbitrary PHP code by crafting specific URLs. Open /etc/php/7.0/fpm/php.ini, find ;cgi.fix_pathinfo=1, and change it to cgi.fix_pathinfo=0. This blocks a common attack vector. Restart PHP-FPM with sudo systemctl restart php7.0-fpm.

nginx configuration

Point nginx to the new PHP 7 socket. Edit /etc/nginx/nginx.conf and add this upstream block inside the http section:

upstream php {
  server unix:/run/php/php7.0-fpm.sock;
}

This creates a named upstream called php pointing to the PHP 7 socket. Your site configs can reference php instead of hardcoding the socket path.

Here’s a reusable WordPress config that works with this upstream. Save it as global/wordpress.conf:

# WordPress single blog rules.
# Designed to be included in any server {} block.

rewrite /wp-admin$ $scheme://$host$uri/ permanent;

# Directives to send expires headers and turn off 404 error logging.
location ~* ^.+\.(ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|rss|atom|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$ {
  access_log off;
  log_not_found off;
  expires max;
}

# Pass all .php files onto a php-fpm/php-fcgi server.
location ~ [^/]\.php(/|$) {
  if (!-f $document_root$fastcgi_script_name) {
    return 404;
  }
  include snippets/fastcgi-php.conf;
  fastcgi_pass php;
}

The rewrite ensures /wp-admin URLs get the trailing slash (WordPress requires this). The static asset location block sets aggressive caching and stops logging 404s for missing images. The PHP location block checks if files exist before passing to php-fpm using the php upstream.

Include this in your WordPress site’s server block with include global/wordpress.conf;. Test with sudo nginx -t and reload with sudo systemctl reload nginx.

PHP 7 also brought meaningful performance and memory improvements over PHP 5.6. The forced upgrade was annoying, but after nginx pointed at the right socket, there was no reason for me to go back.

Years later, I moved away from WordPress entirely. For this blog, going static meant there was no PHP socket to break in the first place.