Web server

Drupal 8 runs on any web server that supports the required PHP version.

Many hosting providers offer different PHP version options. The default PHP version may be older than what Drupal requires, so check your current version in your host's control panel and upgrade to the latest supported version if necessary.

PHP periodically releases security updates—monitor php.net and update/patch your servers as needed or work with a hosting provider who manages PHP updates.

If you want to build and develop Drupal sites on your computer, you can install everything you need locally.

Security note: Some security features are only provided when using Apache and (to a lesser extent) IIS through .htaccess and web.config files. You are responsible for reproducing these features if Apache is not used.

File and Folder Permissions

Drupal and PHP need read and write access to the /sites/default/files directory. This area stores cached files (compressed CSS and JavaScript) and any files uploaded through the Drupal interface.

Security note: A universal permission such as 0777 is not secure and not recommended.

Apache

Apache is the most commonly used web server for Drupal. Drupal works on Apache 2.x, hosted on UNIX/Linux, OS X, or Windows. Drupal 9 requires at least Apache 2.4.7.

Most Drupal development and deployment is done on Apache, so there's more community experience and testing on Apache than other web servers.

The Apache 'mod_rewrite' extension is required. It is used for clean URLs.

The Apache VirtualHost configuration must include the AllowOverride All directive to allow Drupal’s .htaccess file to function.

If Apache has Options +MultiViews enabled by default, your Apache VirtualHost should also include Options -MultiViews (or add -MultiViews to the existing Options directive).

On some systems, especially OpenSuse distributions, you may need to add SymLink settings to the .htaccess file. Depending on security settings, you may need either +FollowSymLinks or +SymLinksIfOwnerMatch (especially on shared hosting). If this is needed, error messages on-screen may be unhelpful, but the error logs will identify the issue. If you edit the .htaccess file, remember to reapply changes after updates, which may overwrite the file!

Nginx

Nginx is a widely-used web server focused on high concurrency, performance, and low memory usage.

Drupal works with legacy Nginx versions (0.7.x, 0.8.x, 1.0.x, 1.2.x), stable 1.8.x releases, and mainline 1.9.x versions, hosted on UNIX/Linux, OS X, or Windows. Nginx is a popular alternative to Apache and has significant community use and testing.

The Nginx website provides a Drupal Nginx configuration file that you can use to set up Drupal websites.

Microsoft IIS

Microsoft IIS is a web server and feature extension framework for use with Microsoft Windows.

Drupal Core works with IIS 5, 6, 7, 8, or 10, as long as PHP is properly configured.

To enable clean URLs, you may need a third-party tool. For IIS 7 or 8, you can use Microsoft’s URL Rewrite Module or a third-party solution.

For IIS 7, Drupal requires Windows 2008 Server SP2 or later for fastCGI support.

PHP Built-in Web Server (Development Only)

The PHP built-in web server is included as a CLI SAPI tool in PHP versions 5.4.0 and above.

The PHP server is designed for development use. It can be useful for testing or demoing apps in controlled environments. It is not intended for production use.

You can run this server using the Drupal quick-start command.