Comment 13 for bug 1267255

So, I'd like to chime in here a bit.

As Ondřej mentioned earlier, php-fpm is known to be a more secure alternative to mod_php, and is recommended for secure setups. I recently contributed a decent default configuration for php-fpm for PHP 7.0, and I would support flipping libapache2-mod-php7.0 to universe and keep php7.0-fpm in main.

Critically, php-fpm can be used with any web server that supports FastCGI, whereas mod_php is Apache httpd specific. There is, of course, php-cgi, but it isn't recommended either, and I would suggest that it should be in universe as well.

I don't pretend to know the difficulty of maintaining the PHP stack, but I think that perhaps moving these two particular methods of using PHP from main to universe in exchange for php-fpm should be considered.