# Web stack

> nginx or OpenLiteSpeed, PHP 7.4–8.5, PHP extensions such as ionCube, Node.js, Python and switching web servers.

A server's **Web stack** section (under **Apps & data**, next to **Sites**) shows everything the server needs to serve sites: the web server, PHP versions, PHP extensions, Node.js, Python and the web application firewall. Installed versions are detected; pick what you need and click **Install / update**.

## Web server

Choose **nginx** or **OpenLiteSpeed** once; it serves every site on the server. Both are installed from repositories with pinned signing keys.

### Switching between nginx and OpenLiteSpeed

**Switch to OpenLiteSpeed** (or **Switch to nginx**) moves a running server to the other web server in place:

1. Zefily installs the other web server and its PHP,
2. rewrites every site for it (certificates already on the server are reused),
3. checks that every site still answers as before,
4. removes the old web server.

Sites are unavailable for up to a minute. If any site stops answering, the server switches back on its own. The switch needs your passkey.

## PHP

PHP runs as PHP-FPM with one pool per site (OpenLiteSpeed uses LSPHP). Pick the versions you need; several can run side by side and each site chooses its own.

- **8.2–8.5** are current versions.
- **Show older versions** reveals **7.4, 8.0 and 8.1** for moving legacy apps. They no longer get security fixes: use them only to migrate, then upgrade.
- On Ubuntu 26.04 only PHP 8.5 is available so far.

Per-site limits and `php.ini` settings are on the site's PHP pane — see [PHP settings](/docs/php-settings).

**Remove a version** under the PHP versions removes one installed version with its extensions. It is refused while a site still uses that version: move the site to another version first.

## PHP extensions

The **PHP extensions** list adds extensions to every PHP version on the server, for example `apcu`, `imagick`, `intl`, `mongodb`, `redis`, `soap`, `gmp`, `xdebug` and **ionCube Loader**. Checked extensions are loaded now. ionCube is downloaded from ionCube's own server and loaded first as a Zend extension for every PHP version.

## Node.js and Python

**Install Node.js** (22, 24, 26) and **Install Python** (3.12–3.14) when you run Node or Python apps; the apps themselves run as managed systemd services. See [Node.js and Python apps](/docs/node-python-apps).

Installed Node.js and Python versions can be removed the same way (the version chip with **×**), refused while a site still uses that version.

## Web application firewall

**Install WAF** adds ModSecurity with the OWASP Core Rule Set. It does nothing until you turn it on per site (**Detect only** or **Block**) — see [Access, caching and protection](/docs/access-and-caching).

## Tuning

After the stack is installed, and whenever a site is added or removed, Zefily tunes nginx, PHP-FPM, OPcache and the kernel for the server's hardware. See [Performance and autotune](/docs/performance).

---
Source: https://zefily.com/docs/web-stack