“FastCGI sent in stderr” is a symptom, not a diagnosis. Nginx is reporting that the FastCGI backend—usually PHP-FPM—wrote diagnostic text to its error stream while Nginx was waiting for the upstream response. The quoted text after the prefix identifies the real problem: a PHP parse or fatal error, an incorrect script path, a filesystem permission failure, or a PHP-FPM connection or timeout problem.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Capture the complete log line, classify the quoted suffix, then check the matching layer. Most repairs involve correcting fastcgi_pass, making SCRIPT_FILENAME resolve to the file PHP-FPM can actually see, or fixing directory traversal and file-read permissions. Buffer settings do not repair a PHP syntax error or a wrong path.
As an Amazon Associate I earn from qualifying purchases.
What “FastCGI sent in stderr” means
FastCGI is the protocol Nginx uses to pass dynamic requests to an application server. In a common Nginx and PHP deployment, that application server is PHP-FPM, PHP’s primary FastCGI implementation. PHP-FPM can write messages to its diagnostic stream, and Nginx records those messages while reading the upstream response.
Nginx’s fastcgi_catch_stderr directive can search a FastCGI response’s error stream for a configured string and treat a match as an invalid response. The presence of the log prefix therefore tells you where the message came from, not why the request failed. The text inside the quotation marks is the useful part.
#1 Best Overall
FastCGI sent in stderr: "PHP message: PHP Parse error: syntax error, unexpected '<' in test.php on line 3" while reading response header from upstreamIn this example, the fix is in test.php on line 3. Changing Nginx buffers would not help. A different suffix, such as Primary script unknown or Connection refused, requires a different repair.
Read the entire error line before changing configuration
Open the Nginx error log and preserve the complete entry, including the timestamp, requested URI, upstream address, and every character inside the quoted message. A shortened screenshot or a line copied without its suffix can hide the distinction between an application bug and an infrastructure problem.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Look for the error class first. The following mapping is a practical way to select the smallest change that can solve it.
| Error signature | Likely failure layer | First check | Typical scope |
|---|---|---|---|
PHP Parse error, PHP Fatal error, uncaught exception |
Application code or PHP runtime | The named file, line, extension, and application configuration | One request, route, or release |
Primary script unknown, Unable to open primary script, No such file or directory |
Nginx-to-PHP path mapping | root/alias and SCRIPT_FILENAME |
One location, virtual host, or container |
Permission denied |
Filesystem ownership, mode, ACL, mount, or pool identity | Directory traversal and file-read access for the PHP-FPM worker | One path, pool, or deployment |
Connection refused, upstream unavailable |
PHP-FPM service or listener | Service state and the socket or TCP address in fastcgi_pass |
Every URL using that endpoint |
| Timeout or an upstream read timeout | PHP-FPM capacity, slow application work, network, or timeout policy | Pool health, slow code, and measured request duration | Slow routes or an overloaded pool |
Eight-step repair workflow
-
Capture the complete Nginx entry
Use the Nginx error log and copy the whole line. Record the URL that triggered it and whether the response was a 502, a blank page, or another status. Keep the original timestamp so you can match it with PHP-FPM and application logs.
-
Classify the quoted suffix
Separate application diagnostics from path, permission, connection, and timing messages. Do not treat every instance of the prefix as a socket problem. A parse error must be fixed in PHP; a primary-script error must be fixed in path mapping; a refused connection points to the service or listener.
-
Check the PHP-FPM logs
PHP-FPM pool configuration can redirect worker standard output and standard error to the main PHP-FPM error log. Check the pool-specific log when one is configured, then correlate its timestamp and worker message with Nginx’s entry. The PHP-FPM log often includes the application exception, startup failure, or pool condition that Nginx only summarizes.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Verify the FastCGI endpoint
Inspect the active server block and confirm that
fastcgi_passnames the listener PHP-FPM actually uses. Nginx accepts either a host and port or a Unix-domain socket. A stale versioned socket name, a typo, or a TCP port that is no longer bound produces connection errors even when the PHP files are correct.On a systemd-based host, service and socket names vary by distribution and installed PHP version. Check the running PHP-FPM unit and its pool configuration rather than copying a socket path from another server.
-
Verify the script path passed to PHP-FPM
Compare the Nginx
rootoraliaswith the actual path visible inside the PHP-FPM environment. The conventional parameter is:fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;This is correct only when Nginx’s document root and PHP-FPM’s view of the filesystem are the same. Containers, chroots, separate mounts, symlinks, and release-directory deployments can make the paths differ. A file that exists in the Nginx container but not at the corresponding path in the PHP-FPM container still causes
Primary script unknown.Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Check permissions along the whole path
The PHP-FPM worker must be able to traverse every parent directory and read the target script. Checking the file alone is insufficient: a directory without execute (traverse) permission blocks access even when the file mode looks readable. Also inspect ACLs, read-only mounts, and security policies if ordinary Unix permissions appear correct.
If the application writes cache, upload, or session files, those specific directories need write access for the configured pool user or group. Do not make the entire document root writable merely to suppress an error; narrow write access to directories that genuinely require it.
-
Validate, reload, and reproduce once
Run the platform’s Nginx configuration test before reloading. On installations that provide the standard command, this is commonly:
sudo nginx -tReload only after the test succeeds. A typical systemd command is:
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.sudo systemctl reload nginxThen request one known PHP URL while watching the Nginx and PHP-FPM logs. Compare the new entry with the original. The goal is to confirm that the identified error class changed or disappeared, not to make unrelated configuration edits.
-
Secure the listener
Keep PHP-FPM on a protected Unix socket or a private network segment. PHP’s security guidance warns that PHP-FPM must not be reachable from an untrusted network: a client able to open a FastCGI connection may control request configuration, including
auto_prepend_file, and use that control to execute code. Do not expose the FPM port directly to the public internet.
Check the essential Nginx FastCGI directives
The key directives are fastcgi_pass, fastcgi_index, and fastcgi_param SCRIPT_FILENAME. A minimal location has this shape:
location ~ .php$ {
fastcgi_pass unix:/run/php/php-fpm.sock;
fastcgi_index index.php;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
}Use the actual socket name and document root for the installed PHP-FPM version and deployment. Some distributions provide a different include file or a version-specific socket. The important checks are that the location matches the intended PHP requests, the endpoint is active, and the script filename resolves to the same effective path on both sides.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsFor POST requests, Nginx’s FastCGI module documentation identifies REQUEST_METHOD, CONTENT_TYPE, and CONTENT_LENGTH among the required parameters. Confirm that your included parameter file supplies them, or define them explicitly when your deployment’s include does not. Missing request parameters can break application behavior even when the PHP script path is correct.
Fix each common diagnostic
PHP parse errors and fatal errors
Messages beginning with PHP Parse error, PHP Fatal error, or an uncaught exception identify an application or runtime failure. Open the named file and line, then check the syntax, the PHP version, required extensions, and environment-specific configuration. If the message names a missing class or function, verify that the extension or dependency is installed in the PHP-FPM runtime—not just in a command-line PHP installation.
After correcting the code or configuration, repeat the same request and inspect the logs. If the suffix changes to a path or permission error, the application issue was only the first failure; continue with the newly exposed class rather than changing buffering directives.
“Primary script unknown” or “Unable to open primary script”
This signature means PHP-FPM cannot open the script path Nginx supplied. Check all of the following:
Free tools Windows power users keep installed
One-click scans. No signup required.
- The request reaches the intended server block and PHP location.
- The
rootoraliasmatches the deployed directory. $fastcgi_script_nameproduces the expected relative path.SCRIPT_FILENAMEproduces an absolute path that exists from PHP-FPM’s perspective.- A container mount, chroot, symlink, or release path has not changed the backend-visible location.
- The requested file really exists and has the expected case-sensitive spelling.
With an alias, do not assume the same concatenation behavior as root. Review the resulting path for the exact location block and test a known file rather than inferring it from the public URL.
“Permission denied”
Identify the user and group configured for the PHP-FPM pool, then test access as that identity where your operating system permits. Check execute permission on every parent directory, read permission on the script, and any ACL, mandatory access-control rule, or read-only mount. A deployment that runs Nginx and PHP-FPM under different identities can appear healthy until a new release directory or generated file has restrictive ownership.
For application writes, grant access only to cache, upload, temporary, or session directories that need it. Keep source files and configuration read-only when possible. Correcting ownership at deployment time is safer than adding broad permissions after every failure.
Connection refused or an unavailable upstream
Confirm that PHP-FPM is running, that the intended pool is loaded, and that it is listening on the exact Unix socket or TCP address in fastcgi_pass. Check for a version change that renamed the socket, a missing socket directory, a failed pool configuration, or a listener bound only to a different address. If Nginx points to TCP, verify the port is private and reachable from the Nginx host.
When every PHP URL fails at once, prioritize this service-and-endpoint check over individual script debugging. When only one virtual host fails, compare its location and endpoint with a known-working server block.
Timeouts and slow responses
A timeout can result from slow application work, an exhausted PHP-FPM pool, a blocked dependency, or a network problem between Nginx and a TCP listener. Examine PHP-FPM worker and queue behavior, application timing, and the request’s measured duration before changing limits. A larger timeout may keep connections open without fixing the slow operation or an undersized pool.
Best Value
Use a timeout change only when the diagnostic and observed request duration demonstrate that the operation is legitimate and exceeds the current limit. Otherwise, fix the slow query, external dependency, deadlock, or pool capacity issue.
Blank responses and 502 errors
A blank page is an outcome, not an error class. Check the HTTP status and the complete Nginx line. A 502 commonly accompanies a PHP-FPM connection failure, an invalid upstream response, or a fatal PHP error; the suffix distinguishes them. Also check whether application error display is disabled, which can make a fatal error appear blank to the browser while the server log contains the explanation.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Container, chroot, and multi-mount path traps
In a single host, /var/www/site/index.php may be the path both processes see. In containers, Nginx and PHP-FPM can mount the same files at different paths. For example, Nginx might construct /usr/share/nginx/html/index.php while PHP-FPM sees the shared volume at /var/www/html/index.php. The public URL can be identical, but SCRIPT_FILENAME must use the backend-visible path.
Apply the same check to chroots and symlinked release directories. Test the path from the PHP-FPM environment, not just from the host shell. A successful ls on the host does not prove that the worker’s namespace, mount, or chroot contains that file.
What not to change blindly
fastcgi_buffer_size, fastcgi_buffers, and fastcgi_read_timeout control response buffering and read timing. They do not correct PHP syntax, a wrong SCRIPT_FILENAME, or a permission denial. Change them only when the quoted diagnostic and measured response behavior indicate a genuine buffer or timeout problem.
Likewise, do not silence the message by disabling logging, broadly changing file modes, exposing the FPM port, or replacing a Unix socket with an arbitrary TCP address. Those changes can hide evidence or create a security vulnerability while leaving the underlying failure intact.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Choose a targeted fix by scope
| Observed scope | Best investigation order | Avoid first |
|---|---|---|
| One URL or one controller | Application log, named PHP file, extensions, route-specific configuration | Changing the global FPM endpoint or Nginx buffers |
| One virtual host or location | Its root/alias, PHP location, and SCRIPT_FILENAME |
Editing every server block |
| Every PHP site on the host | PHP-FPM service, pool loading, socket or port, and listener permissions | Rewriting individual application files |
| Only slow requests | Application timing, pool capacity, dependencies, then timeout policy | Raising timeouts without measurement |
Prevent repeat failures
- Keep Nginx and PHP-FPM endpoint names in deployment configuration instead of copying a socket path between PHP versions.
- Make the backend-visible document root explicit when using containers, chroots, symlinks, or separate mounts.
- Deploy source files with ownership and directory traversal permissions that match the PHP-FPM pool identity.
- Give write access only to the application directories that need it.
- Run an Nginx configuration test before every reload and perform one known PHP request afterward.
- Retain Nginx and PHP-FPM logs long enough to correlate a request, timestamp, upstream, and worker message.
- Protect the PHP-FPM socket or private TCP listener from untrusted networks.
Bottom line
Start with the quoted suffix, not the phrase “FastCGI sent in stderr.” Fix PHP code when the suffix names a parse or fatal error; fix endpoint and path mapping for connection or primary-script messages; fix the complete filesystem path and pool identity for permission errors; and investigate measured application or pool behavior for timeouts. Validate the configuration, reload safely, reproduce one request, and keep PHP-FPM inaccessible to untrusted clients.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
