diff --git a/install/sql/incremental/upd_0087.sql b/install/sql/incremental/upd_0087.sql
new file mode 100644
index 0000000000000000000000000000000000000000..e1b35b038700dd6726e7af8fc956f7ca5e52a98a
--- /dev/null
+++ b/install/sql/incremental/upd_0087.sql
@@ -0,0 +1 @@
+ALTER TABLE `web_domain` ADD COLUMN `php_fpm_chroot` enum('n','y') NOT NULL DEFAULT 'n' AFTER `php_fpm_use_socket`;
diff --git a/interface/web/sites/form/web_vhost_domain.tform.php b/interface/web/sites/form/web_vhost_domain.tform.php
index be06d34634aa20251ac1c4cb66f53be1a1954b58..e7698cbe876cea2e5734c9f3be54845cf5d03e29 100644
--- a/interface/web/sites/form/web_vhost_domain.tform.php
+++ b/interface/web/sites/form/web_vhost_domain.tform.php
@@ -772,6 +772,12 @@ if($_SESSION["s"]["user"]["typ"] == 'admin'
 				'default' => 'n',
 				'value'  => array(0 => 'n', 1 => 'y')
 			),
+			'php_fpm_chroot' => array (
+				'datatype' => 'VARCHAR',
+				'formtype' => 'CHECKBOX',
+				'default' => 'n',
+				'value' => array(0 => 'n', 1 => 'y')
+			),
 			'pm' => array (
 				'datatype' => 'VARCHAR',
 				'formtype' => 'SELECT',
diff --git a/interface/web/sites/lib/lang/ar_web_vhost_domain.lng b/interface/web/sites/lib/lang/ar_web_vhost_domain.lng
index ff063e88c9ba226abb40ad9bbd1b0acc3a77bb8f..bfaf07f226f35f2aa838b3b07209a85242a2e090 100644
--- a/interface/web/sites/lib/lang/ar_web_vhost_domain.lng
+++ b/interface/web/sites/lib/lang/ar_web_vhost_domain.lng
@@ -80,6 +80,7 @@ $wb['seo_redirect_txt'] = 'SEO Redirect';
 $wb['non_www_to_www_txt'] = 'Non-www -> www';
 $wb['www_to_non_www_txt'] = 'www -> non-www';
 $wb['php_fpm_use_socket_txt'] = 'Use Socket For PHP-FPM';
+$wb['php_fpm_chroot_txt'] = 'Chroot PHP-FPM';
 $wb['error_no_sni_txt'] = 'SNI for SSL is not activated on this server. You can enable only one SSL certificate on each IP address.';
 $wb['python_txt'] = 'Python';
 $wb['pm_max_children_txt'] = 'PHP-FPM pm.max_children';
diff --git a/interface/web/sites/lib/lang/bg_web_vhost_domain.lng b/interface/web/sites/lib/lang/bg_web_vhost_domain.lng
index e1dce797cf0757a44a811262567964c11bc47e25..0c01cbfdaca6728e7df0fcab5467fa92bfdd4959 100644
--- a/interface/web/sites/lib/lang/bg_web_vhost_domain.lng
+++ b/interface/web/sites/lib/lang/bg_web_vhost_domain.lng
@@ -79,6 +79,7 @@ $wb['seo_redirect_txt'] = 'SEO редирект';
 $wb['non_www_to_www_txt'] = 'Non-www -> www';
 $wb['www_to_non_www_txt'] = 'www -> non-www';
 $wb['php_fpm_use_socket_txt'] = 'Използвай сокет за PHP-FPM';
+$wb['php_fpm_chroot_txt'] = 'Chroot PHP-FPM';
 $wb['error_no_sni_txt'] = 'SNI for SSL is not activated on this server. You can enable only one SSL certificate on each IP address.';
 $wb['python_txt'] = 'Python';
 $wb['pm_max_children_txt'] = 'PHP-FPM pm.max_children';
diff --git a/interface/web/sites/lib/lang/br_web_vhost_domain.lng b/interface/web/sites/lib/lang/br_web_vhost_domain.lng
index 171a34f95b19c12ddfa4658273dd822ab0cb6abd..413863f1ebbfa3d863413e1823e6be7426007f25 100644
--- a/interface/web/sites/lib/lang/br_web_vhost_domain.lng
+++ b/interface/web/sites/lib/lang/br_web_vhost_domain.lng
@@ -79,6 +79,7 @@ $wb['seo_redirect_txt'] = 'Redirecionamento SEO';
 $wb['non_www_to_www_txt'] = 'Diretivas Non-www -> www';
 $wb['www_to_non_www_txt'] = 'Diretivas www -> non-www';
 $wb['php_fpm_use_socket_txt'] = 'Usar soquete para o PHP-FPM';
+$wb['php_fpm_chroot_txt'] = 'Chroot PHP-FPM';
 $wb['error_no_sni_txt'] = 'O SNI para SSL não está ativo neste servidor. Você só pode habilitar um certificado para cada endereço IP.';
 $wb['python_txt'] = 'Python';
 $wb['pm_max_children_txt'] = 'Diretiva PHP-FPM pm.max_children';
diff --git a/interface/web/sites/lib/lang/ca_web_vhost_domain.lng b/interface/web/sites/lib/lang/ca_web_vhost_domain.lng
index c7cb4ac8490f8fe70ae5d89c9e24b6a528b1a45b..c9cdb68c9a4a320d728d74d1c8696995a4c24702 100644
--- a/interface/web/sites/lib/lang/ca_web_vhost_domain.lng
+++ b/interface/web/sites/lib/lang/ca_web_vhost_domain.lng
@@ -82,6 +82,7 @@ $wb['seo_redirect_txt'] = 'SEO Redirect';
 $wb['non_www_to_www_txt'] = 'Non-www -> www';
 $wb['www_to_non_www_txt'] = 'www -> non-www';
 $wb['php_fpm_use_socket_txt'] = 'Use Socket For PHP-FPM';
+$wb['php_fpm_chroot_txt'] = 'Chroot PHP-FPM';
 $wb['error_no_sni_txt'] = 'SNI for SSL is not activated on this server. You can enable only one SSL certificate on each IP address.';
 $wb['python_txt'] = 'Python';
 $wb['perl_txt'] = 'Perl';
diff --git a/interface/web/sites/lib/lang/cz_web_vhost_domain.lng b/interface/web/sites/lib/lang/cz_web_vhost_domain.lng
index 6353f713f02bddfcc1c0f0ecc2be433755227e89..9f40aaec6821d41035eca2446c2973c78a287276 100644
--- a/interface/web/sites/lib/lang/cz_web_vhost_domain.lng
+++ b/interface/web/sites/lib/lang/cz_web_vhost_domain.lng
@@ -83,6 +83,7 @@ $wb['seo_redirect_txt'] = 'SEO přesměrování';
 $wb['non_www_to_www_txt'] = 'Non-www -> www';
 $wb['www_to_non_www_txt'] = 'www -> non-www';
 $wb['php_fpm_use_socket_txt'] = 'Use Socket For PHP-FPM';
+$wb['php_fpm_chroot_txt'] = 'Chroot PHP-FPM';
 $wb['error_no_sni_txt'] = 'SNI for SSL is not activated on this server. You can enable only one SSL certificate on each IP address.';
 $wb['python_txt'] = 'Python';
 $wb['pm_max_children_txt'] = 'PHP-FPM pm.max_children';
diff --git a/interface/web/sites/lib/lang/de_web_vhost_domain.lng b/interface/web/sites/lib/lang/de_web_vhost_domain.lng
index bf29fb953fe0e2ddb0845c642b75749bf8e65de9..1b334bb298445b39816d243e594749eeac951900 100644
--- a/interface/web/sites/lib/lang/de_web_vhost_domain.lng
+++ b/interface/web/sites/lib/lang/de_web_vhost_domain.lng
@@ -82,6 +82,7 @@ $wb['seo_redirect_txt'] = 'SEO Redirect';
 $wb['non_www_to_www_txt'] = 'Nicht-www -> www';
 $wb['www_to_non_www_txt'] = 'www -> Nicht-www';
 $wb['php_fpm_use_socket_txt'] = 'Benutze Socket für PHP-FPM';
+$wb['php_fpm_chroot_txt'] = 'Chroot PHP-FPM';
 $wb['ipv6_address_txt'] = 'IPv6 Adresse';
 $wb['error_no_sni_txt'] = 'SNI für SSL ist auf diesem Server nicht aktiviert. Sie können daher nur ein SSL Zertifikat pro IP Adresse eintragen.';
 $wb['python_txt'] = 'Python';
diff --git a/interface/web/sites/lib/lang/dk_web_vhost_domain.lng b/interface/web/sites/lib/lang/dk_web_vhost_domain.lng
index c7cb4ac8490f8fe70ae5d89c9e24b6a528b1a45b..c9cdb68c9a4a320d728d74d1c8696995a4c24702 100644
--- a/interface/web/sites/lib/lang/dk_web_vhost_domain.lng
+++ b/interface/web/sites/lib/lang/dk_web_vhost_domain.lng
@@ -82,6 +82,7 @@ $wb['seo_redirect_txt'] = 'SEO Redirect';
 $wb['non_www_to_www_txt'] = 'Non-www -> www';
 $wb['www_to_non_www_txt'] = 'www -> non-www';
 $wb['php_fpm_use_socket_txt'] = 'Use Socket For PHP-FPM';
+$wb['php_fpm_chroot_txt'] = 'Chroot PHP-FPM';
 $wb['error_no_sni_txt'] = 'SNI for SSL is not activated on this server. You can enable only one SSL certificate on each IP address.';
 $wb['python_txt'] = 'Python';
 $wb['perl_txt'] = 'Perl';
diff --git a/interface/web/sites/lib/lang/el_web_vhost_domain.lng b/interface/web/sites/lib/lang/el_web_vhost_domain.lng
index 7de00581c7a65b5bd4acc58f8d1bea3ec639dc5d..1d238b64e9447ef181f2ecd7f5ba6e3a8f5f268e 100644
--- a/interface/web/sites/lib/lang/el_web_vhost_domain.lng
+++ b/interface/web/sites/lib/lang/el_web_vhost_domain.lng
@@ -80,6 +80,7 @@ $wb['seo_redirect_txt'] = 'Ανακατεύθυνση SEO';
 $wb['non_www_to_www_txt'] = 'Non-www -> www';
 $wb['www_to_non_www_txt'] = 'www -> non-www';
 $wb['php_fpm_use_socket_txt'] = 'Use Socket For PHP-FPM';
+$wb['php_fpm_chroot_txt'] = 'Chroot PHP-FPM';
 $wb['error_no_sni_txt'] = 'SNI for SSL is not activated on this server. You can enable only one SSL certificate on each IP address.';
 $wb['python_txt'] = 'Python';
 $wb['pm_max_children_txt'] = 'PHP-FPM pm.max_children';
diff --git a/interface/web/sites/lib/lang/en_web_vhost_domain.lng b/interface/web/sites/lib/lang/en_web_vhost_domain.lng
index b508e5783694e45719768daa959363d1ffbe6f40..97d1c932ca9361b016156842e02953f0cd891f3a 100644
--- a/interface/web/sites/lib/lang/en_web_vhost_domain.lng
+++ b/interface/web/sites/lib/lang/en_web_vhost_domain.lng
@@ -82,6 +82,7 @@ $wb['seo_redirect_txt'] = 'SEO Redirect';
 $wb['non_www_to_www_txt'] = 'Non-www -> www';
 $wb['www_to_non_www_txt'] = 'www -> non-www';
 $wb['php_fpm_use_socket_txt'] = 'Use Socket For PHP-FPM';
+$wb['php_fpm_chroot_txt'] = 'Chroot PHP-FPM';
 $wb['error_no_sni_txt'] = 'SNI for SSL is not activated on this server. You can enable only one SSL certificate on each IP address.';
 $wb['python_txt'] = 'Python';
 $wb['perl_txt'] = 'Perl';
diff --git a/interface/web/sites/lib/lang/es_web_vhost_domain.lng b/interface/web/sites/lib/lang/es_web_vhost_domain.lng
index 398aef500f5b4f2db224d369efeed874438f8fd3..8421966c0eec5f2635f69ab1be8ada3179a93243 100644
--- a/interface/web/sites/lib/lang/es_web_vhost_domain.lng
+++ b/interface/web/sites/lib/lang/es_web_vhost_domain.lng
@@ -78,6 +78,7 @@ $wb['seo_redirect_txt'] = 'Redirección SEO';
 $wb['non_www_to_www_txt'] = 'Non-www -> www';
 $wb['www_to_non_www_txt'] = 'www -> non-www';
 $wb['php_fpm_use_socket_txt'] = 'Usar Socket para PHP-FPM';
+$wb['php_fpm_chroot_txt'] = 'Chroot PHP-FPM';
 $wb['error_no_sni_txt'] = 'SNI para SSL no está activado en este servidor. Sólo es posible activar un certificado SSL en cada dirección IP.';
 $wb['python_txt'] = 'Python';
 $wb['pm_max_children_txt'] = 'PHP-FPM pm.max_children';
diff --git a/interface/web/sites/lib/lang/fi_web_vhost_domain.lng b/interface/web/sites/lib/lang/fi_web_vhost_domain.lng
index 94ba05bdd190650814a5d3e345c0acc92b8cc4f4..1a4d753b56ce47f6a552733a7d6db2ab59b2c9ec 100644
--- a/interface/web/sites/lib/lang/fi_web_vhost_domain.lng
+++ b/interface/web/sites/lib/lang/fi_web_vhost_domain.lng
@@ -79,6 +79,7 @@ $wb['seo_redirect_txt'] = 'SEO Redirect';
 $wb['non_www_to_www_txt'] = 'Non-www -> www';
 $wb['www_to_non_www_txt'] = 'www -> non-www';
 $wb['php_fpm_use_socket_txt'] = 'Use Socket For PHP-FPM';
+$wb['php_fpm_chroot_txt'] = 'Chroot PHP-FPM';
 $wb['error_no_sni_txt'] = 'SNI for SSL is not activated on this server. You can enable only one SSL certificate on each IP address.';
 $wb['python_txt'] = 'Python';
 $wb['pm_max_children_txt'] = 'PHP-FPM pm.max_children';
diff --git a/interface/web/sites/lib/lang/fr_web_vhost_domain.lng b/interface/web/sites/lib/lang/fr_web_vhost_domain.lng
index 97a0dd0ac06f1a530bc9455b1942fa126dac065f..ab34cdf35eeb8f7f362b61904ee3fca2ab7c1b8b 100644
--- a/interface/web/sites/lib/lang/fr_web_vhost_domain.lng
+++ b/interface/web/sites/lib/lang/fr_web_vhost_domain.lng
@@ -79,6 +79,7 @@ $wb['seo_redirect_txt'] = 'Redirection SEO';
 $wb['non_www_to_www_txt'] = 'Non-www -> www';
 $wb['www_to_non_www_txt'] = 'www -> non-www';
 $wb['php_fpm_use_socket_txt'] = 'Utiliser Socket pour PHP-FPM';
+$wb['php_fpm_chroot_txt'] = 'Chroot PHP-FPM';
 $wb['error_no_sni_txt'] = 'SNI pour SSL n\'est pas activé sur ce serveur. Vous ne pouvez activer qu\'un seul certificat SSL par adresse IP.';
 $wb['python_txt'] = 'Python';
 $wb['pm_max_children_txt'] = 'PHP-FPM pm.max_children';
diff --git a/interface/web/sites/lib/lang/hr_web_vhost_domain.lng b/interface/web/sites/lib/lang/hr_web_vhost_domain.lng
index 54d5e1f3bb9ae2a1deeb3943a5e11e8ea34fb7c3..0ef7e938518c2a8ef7cabe89e64161ae2d06c767 100644
--- a/interface/web/sites/lib/lang/hr_web_vhost_domain.lng
+++ b/interface/web/sites/lib/lang/hr_web_vhost_domain.lng
@@ -79,6 +79,7 @@ $wb['seo_redirect_txt'] = 'SEO redirekcija';
 $wb['non_www_to_www_txt'] = 'Non-www -> www';
 $wb['www_to_non_www_txt'] = 'www -> non-www';
 $wb['php_fpm_use_socket_txt'] = 'Koristi socket za PHP-FPM';
+$wb['php_fpm_chroot_txt'] = 'Chroot PHP-FPM';
 $wb['error_no_sni_txt'] = 'SNI za SSL nije aktiviran na ovom serveru. Možete omogućiti samo jedan SSL certifikat na svakoj IP adresi.';
 $wb['python_txt'] = 'Python';
 $wb['pm_max_children_txt'] = 'PHP-FPM pm.max_children';
diff --git a/interface/web/sites/lib/lang/hu_web_vhost_domain.lng b/interface/web/sites/lib/lang/hu_web_vhost_domain.lng
index 13e1c54b530a46c70314573c7767d59f0cf445ae..da4391a9269aea17233afa431082cc4c6a6e02a3 100644
--- a/interface/web/sites/lib/lang/hu_web_vhost_domain.lng
+++ b/interface/web/sites/lib/lang/hu_web_vhost_domain.lng
@@ -79,6 +79,7 @@ $wb['seo_redirect_txt'] = 'SEO Redirect';
 $wb['non_www_to_www_txt'] = 'Non-www -> www';
 $wb['www_to_non_www_txt'] = 'www -> non-www';
 $wb['php_fpm_use_socket_txt'] = 'Use Socket For PHP-FPM';
+$wb['php_fpm_chroot_txt'] = 'Chroot PHP-FPM';
 $wb['error_no_sni_txt'] = 'SNI for SSL is not activated on this server. You can enable only one SSL certificate on each IP address.';
 $wb['python_txt'] = 'Python';
 $wb['pm_max_children_txt'] = 'PHP-FPM pm.max_children';
diff --git a/interface/web/sites/lib/lang/id_web_vhost_domain.lng b/interface/web/sites/lib/lang/id_web_vhost_domain.lng
index 10b32ea1cc0edae509b912db3bb8155efeec51db..6d16061cfeacf4ebbefe5094de754cfb5b831ba6 100644
--- a/interface/web/sites/lib/lang/id_web_vhost_domain.lng
+++ b/interface/web/sites/lib/lang/id_web_vhost_domain.lng
@@ -79,6 +79,7 @@ $wb['seo_redirect_txt'] = 'SEO Redirect';
 $wb['non_www_to_www_txt'] = 'Non-www -> www';
 $wb['www_to_non_www_txt'] = 'www -> non-www';
 $wb['php_fpm_use_socket_txt'] = 'Use Socket For PHP-FPM';
+$wb['php_fpm_chroot_txt'] = 'Chroot PHP-FPM';
 $wb['error_no_sni_txt'] = 'SNI for SSL is not activated on this server. You can enable only one SSL certificate on each IP address.';
 $wb['python_txt'] = 'Python';
 $wb['pm_max_children_txt'] = 'PHP-FPM pm.max_children';
diff --git a/interface/web/sites/lib/lang/it_web_vhost_domain.lng b/interface/web/sites/lib/lang/it_web_vhost_domain.lng
index 831b29c5d04a9945cee5a912625f003e143ec03e..adb557f390919e09694dbfaa321730fffb4b43f7 100644
--- a/interface/web/sites/lib/lang/it_web_vhost_domain.lng
+++ b/interface/web/sites/lib/lang/it_web_vhost_domain.lng
@@ -80,6 +80,7 @@ $wb['seo_redirect_txt'] = 'SEO Redirect';
 $wb['non_www_to_www_txt'] = 'Non-www -> www';
 $wb['www_to_non_www_txt'] = 'www -> non-www';
 $wb['php_fpm_use_socket_txt'] = 'Use Socket For PHP-FPM';
+$wb['php_fpm_chroot_txt'] = 'Chroot PHP-FPM';
 $wb['error_no_sni_txt'] = 'SNI for SSL is not activated on this server. You can enable only one SSL certificate on each IP address.';
 $wb['python_txt'] = 'Python';
 $wb['pm_max_children_txt'] = 'PHP-FPM pm.max_children';
diff --git a/interface/web/sites/lib/lang/ja_web_vhost_domain.lng b/interface/web/sites/lib/lang/ja_web_vhost_domain.lng
index 8cf49718602ab7380c5c57f3fb59935df758e65f..9dd8cd7aff3800e91983e1ca20b1a5d529c65a72 100644
--- a/interface/web/sites/lib/lang/ja_web_vhost_domain.lng
+++ b/interface/web/sites/lib/lang/ja_web_vhost_domain.lng
@@ -79,6 +79,7 @@ $wb['seo_redirect_txt'] = 'SEO Redirect';
 $wb['non_www_to_www_txt'] = 'Non-www -> www';
 $wb['www_to_non_www_txt'] = 'www -> non-www';
 $wb['php_fpm_use_socket_txt'] = 'Use Socket For PHP-FPM';
+$wb['php_fpm_chroot_txt'] = 'Chroot PHP-FPM';
 $wb['error_no_sni_txt'] = 'SNI for SSL is not activated on this server. You can enable only one SSL certificate on each IP address.';
 $wb['python_txt'] = 'Python';
 $wb['pm_max_children_txt'] = 'PHP-FPM pm.max_children';
diff --git a/interface/web/sites/lib/lang/nl_web_vhost_domain.lng b/interface/web/sites/lib/lang/nl_web_vhost_domain.lng
index 1952769faf9ba2bd8bed8814030a69ef421fb586..1301001bd1399a5e77ef930f68d08c993b0dfef7 100644
--- a/interface/web/sites/lib/lang/nl_web_vhost_domain.lng
+++ b/interface/web/sites/lib/lang/nl_web_vhost_domain.lng
@@ -79,6 +79,7 @@ $wb['seo_redirect_txt'] = 'SEO Redirect';
 $wb['non_www_to_www_txt'] = 'Non-www -> www';
 $wb['www_to_non_www_txt'] = 'www -> non-www';
 $wb['php_fpm_use_socket_txt'] = 'Use Socket For PHP-FPM';
+$wb['php_fpm_chroot_txt'] = 'Chroot PHP-FPM';
 $wb['error_no_sni_txt'] = 'SNI for SSL is not activated on this server. You can enable only one SSL certificate on each IP address.';
 $wb['python_txt'] = 'Python';
 $wb['pm_max_children_txt'] = 'PHP-FPM pm.max_children';
diff --git a/interface/web/sites/lib/lang/pl_web_vhost_domain.lng b/interface/web/sites/lib/lang/pl_web_vhost_domain.lng
index f3aa864f69257a51952881dfa15d16c99558259f..e6fd6011250457b83e155398535ed9cd84b393dd 100644
--- a/interface/web/sites/lib/lang/pl_web_vhost_domain.lng
+++ b/interface/web/sites/lib/lang/pl_web_vhost_domain.lng
@@ -79,6 +79,7 @@ $wb['seo_redirect_txt'] = 'Przekierowanie SEO';
 $wb['non_www_to_www_txt'] = 'bez www -> www';
 $wb['www_to_non_www_txt'] = 'www -> bez www';
 $wb['php_fpm_use_socket_txt'] = 'Użyj gniazda dla PHP-FPM';
+$wb['php_fpm_chroot_txt'] = 'Chroot PHP-FPM';
 $wb['error_no_sni_txt'] = 'SNI dla SSL nie jest aktywowane na tym serwerze. Możesz utworzyć tylko jeden certyfikat SSL dla jednego adresu IP.';
 $wb['python_txt'] = 'Python';
 $wb['pm_max_children_txt'] = 'PHP-FPM pm.max_children';
diff --git a/interface/web/sites/lib/lang/pt_web_vhost_domain.lng b/interface/web/sites/lib/lang/pt_web_vhost_domain.lng
index dcbdf40864dbe4ccda4fc648362f74b7db89c749..a33ac11fc1e35b104bfea81e0743a9725b615f26 100644
--- a/interface/web/sites/lib/lang/pt_web_vhost_domain.lng
+++ b/interface/web/sites/lib/lang/pt_web_vhost_domain.lng
@@ -79,6 +79,7 @@ $wb['seo_redirect_txt'] = 'SEO Redirect';
 $wb['non_www_to_www_txt'] = 'Non-www -> www';
 $wb['www_to_non_www_txt'] = 'www -> non-www';
 $wb['php_fpm_use_socket_txt'] = 'Use Socket For PHP-FPM';
+$wb['php_fpm_chroot_txt'] = 'Chroot PHP-FPM';
 $wb['error_no_sni_txt'] = 'SNI for SSL is not activated on this server. You can enable only one SSL certificate on each IP address.';
 $wb['python_txt'] = 'Python';
 $wb['pm_max_children_txt'] = 'PHP-FPM pm.max_children';
diff --git a/interface/web/sites/lib/lang/ro_web_vhost_domain.lng b/interface/web/sites/lib/lang/ro_web_vhost_domain.lng
index d93152e24e69034a9a9ad5ebc9350ed4076c5517..cb5fc4d82b1551d56e856e6429f4aab8fcdaa1a8 100644
--- a/interface/web/sites/lib/lang/ro_web_vhost_domain.lng
+++ b/interface/web/sites/lib/lang/ro_web_vhost_domain.lng
@@ -80,6 +80,7 @@ $wb['seo_redirect_txt'] = 'SEO Redirect';
 $wb['non_www_to_www_txt'] = 'Non-www -> www';
 $wb['www_to_non_www_txt'] = 'www -> non-www';
 $wb['php_fpm_use_socket_txt'] = 'Use Socket For PHP-FPM';
+$wb['php_fpm_chroot_txt'] = 'Chroot PHP-FPM';
 $wb['error_no_sni_txt'] = 'SNI for SSL is not activated on this server. You can enable only one SSL certificate on each IP address.';
 $wb['python_txt'] = 'Python';
 $wb['pm_max_children_txt'] = 'PHP-FPM pm.max_children';
diff --git a/interface/web/sites/lib/lang/ru_web_vhost_domain.lng b/interface/web/sites/lib/lang/ru_web_vhost_domain.lng
index f525fe2025aa23749ca468d76d387c5c665365fc..b8a3b41759a8a96567c957d382af69f5acb71bc0 100644
--- a/interface/web/sites/lib/lang/ru_web_vhost_domain.lng
+++ b/interface/web/sites/lib/lang/ru_web_vhost_domain.lng
@@ -79,6 +79,7 @@ $wb['seo_redirect_txt'] = 'SEO редирект';
 $wb['non_www_to_www_txt'] = 'Без-www -> www';
 $wb['www_to_non_www_txt'] = 'www -> без-www';
 $wb['php_fpm_use_socket_txt'] = 'Использовать сокет для PHP-FPM';
+$wb['php_fpm_chroot_txt'] = 'Chroot PHP-FPM';
 $wb['error_no_sni_txt'] = 'SNI для SSL не активирован на этом сервере. Вы можете включить только один SSL сертификат на каждом IP-адресе.';
 $wb['python_txt'] = 'Python';
 $wb['pm_max_children_txt'] = 'PHP-FPM pm.max_children';
diff --git a/interface/web/sites/lib/lang/se_web_vhost_domain.lng b/interface/web/sites/lib/lang/se_web_vhost_domain.lng
index d8b671daea9e7e86598d5bc8fdde97536389ec73..2a67966577d55621181e4c2c7a23369a5691d9fd 100644
--- a/interface/web/sites/lib/lang/se_web_vhost_domain.lng
+++ b/interface/web/sites/lib/lang/se_web_vhost_domain.lng
@@ -80,6 +80,7 @@ $wb['seo_redirect_txt'] = 'SEO Redirect';
 $wb['non_www_to_www_txt'] = 'Non-www -> www';
 $wb['www_to_non_www_txt'] = 'www -> non-www';
 $wb['php_fpm_use_socket_txt'] = 'Use Socket For PHP-FPM';
+$wb['php_fpm_chroot_txt'] = 'Chroot PHP-FPM';
 $wb['error_no_sni_txt'] = 'SNI for SSL is not activated on this server. You can enable only one SSL certificate on each IP address.';
 $wb['python_txt'] = 'Python';
 $wb['pm_max_children_txt'] = 'PHP-FPM pm.max_children';
diff --git a/interface/web/sites/lib/lang/sk_web_vhost_domain.lng b/interface/web/sites/lib/lang/sk_web_vhost_domain.lng
index cdb1c2627fd413fb69b051b5628c7b44a6ed0f56..2d354ce9dcc7f76f1f42661ce7a97bb916235f97 100644
--- a/interface/web/sites/lib/lang/sk_web_vhost_domain.lng
+++ b/interface/web/sites/lib/lang/sk_web_vhost_domain.lng
@@ -79,6 +79,7 @@ $wb['seo_redirect_txt'] = 'SEO Redirect';
 $wb['non_www_to_www_txt'] = 'Non-www -> www';
 $wb['www_to_non_www_txt'] = 'www -> non-www';
 $wb['php_fpm_use_socket_txt'] = 'Use Socket For PHP-FPM';
+$wb['php_fpm_chroot_txt'] = 'Chroot PHP-FPM';
 $wb['error_no_sni_txt'] = 'SNI for SSL is not activated on this server. You can enable only one SSL certificate on each IP address.';
 $wb['python_txt'] = 'Python';
 $wb['pm_max_children_txt'] = 'PHP-FPM pm.max_children';
diff --git a/interface/web/sites/lib/lang/tr_web_vhost_domain.lng b/interface/web/sites/lib/lang/tr_web_vhost_domain.lng
index 52b86ba657b32c6f923191a3b02feed1ca46396d..8a04a244e67f0b96056dfc4f5b0ee504f78b4af5 100644
--- a/interface/web/sites/lib/lang/tr_web_vhost_domain.lng
+++ b/interface/web/sites/lib/lang/tr_web_vhost_domain.lng
@@ -81,6 +81,7 @@ $wb['seo_redirect_txt'] = 'AMD Yönlendirme';
 $wb['non_www_to_www_txt'] = 'Non-www -> www';
 $wb['www_to_non_www_txt'] = 'www -> non-www';
 $wb['php_fpm_use_socket_txt'] = 'PHP-FPM İçin Soket Kullanılsın';
+$wb['php_fpm_chroot_txt'] = 'Chroot PHP-FPM';
 $wb['error_no_sni_txt'] = 'Bu sunucuda SSL için SNI etkinleştirilmemiş. Bir IP adresi için yalnız bir SSL sertifikası etkinleştirebilirsiniz.';
 $wb['python_txt'] = 'Python';
 $wb['perl_txt'] = 'Perl';
diff --git a/interface/web/sites/templates/web_vhost_domain_advanced.htm b/interface/web/sites/templates/web_vhost_domain_advanced.htm
index 1def0ecb65ce82c16b117358f857114507ac6ff1..0b5ddfbd8bfb1bf818d433940f2fcee0c638f180 100644
--- a/interface/web/sites/templates/web_vhost_domain_advanced.htm
+++ b/interface/web/sites/templates/web_vhost_domain_advanced.htm
@@ -57,6 +57,12 @@
                         {tmpl_var name='php_fpm_use_socket'}
                     </div>
                 </div>
+                <div class="form-group">
+                    <label class="col-sm-3 control-label">{tmpl_var name='php_fpm_chroot_txt'}</label>
+                    <div class="col-sm-9">
+                        {tmpl_var name='php_fpm_chroot'}
+                    </div>
+                </div>
                 <div class="form-group">
                     <label for="pm" class="col-sm-3 control-label">{tmpl_var name='pm_txt'}</label>
                     <div class="col-sm-9"><select name="pm" id="pm" class="form-control">
diff --git a/server/conf/nginx_vhost.conf.master b/server/conf/nginx_vhost.conf.master
index 1fd98a58997efee0f00e9daf2f59df08bd5810a0..7a4e743797c0a2fed90162bd08c32fa5f1b7170e 100644
--- a/server/conf/nginx_vhost.conf.master
+++ b/server/conf/nginx_vhost.conf.master
@@ -173,7 +173,13 @@ server {
             fastcgi_pass unix:<tmpl_var name='fpm_socket'>;
 </tmpl_if>
             fastcgi_index index.php;
+<tmpl_if name='php_fpm_chroot' op='==' value='y'>
+            fastcgi_param DOCUMENT_ROOT /web;
+            fastcgi_param HOME /web;
+            fastcgi_param SCRIPT_FILENAME /web$fastcgi_script_name;
+<tmpl_else>
             fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+</tmpl_if>
             #fastcgi_param PATH_INFO $fastcgi_script_name;
             fastcgi_intercept_errors on;
         }
@@ -184,7 +190,13 @@ server {
 				include /etc/nginx/fastcgi_params;
 				fastcgi_pass unix:/var/run/hhvm/hhvm.<tmpl_var name='system_user'>.sock;
 				fastcgi_index index.php;
+<tmpl_if name='php_fpm_chroot'>
+				fastcgi_param DOCUMENT_ROOT /web;
+				fastcgi_param HOME /web;
+				fastcgi_param SCRIPT_FILENAME /web$fastcgi_script_name;
+<tmpl_else>
 				fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+</tmpl_if>
 				#fastcgi_param PATH_INFO $fastcgi_script_name;
 				fastcgi_intercept_errors on;
 				error_page 500 501 502 503 = @phpfallback;
@@ -200,7 +212,13 @@ server {
 				fastcgi_pass unix:<tmpl_var name='fpm_socket'>;
 </tmpl_if>
 				fastcgi_index index.php;
+<tmpl_if name='php_fpm_chroot'>
+				fastcgi_param DOCUMENT_ROOT /web;
+				fastcgi_param HOME /web;
+				fastcgi_param SCRIPT_FILENAME /web$fastcgi_script_name;
+<tmpl_else>
 				fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+</tmpl_if>
 				#fastcgi_param PATH_INFO $fastcgi_script_name;
 				fastcgi_intercept_errors on;
 			}
@@ -220,7 +238,13 @@ server {
             gzip off;
             fastcgi_pass  unix:/var/run/fcgiwrap.socket;
             fastcgi_index index.cgi;
+<tmpl_if name='php_fpm_chroot'>
+            fastcgi_param DOCUMENT_ROOT /web;
+            fastcgi_param HOME /web;
+            fastcgi_param SCRIPT_FILENAME /web$fastcgi_script_name;
+<tmpl_else>
             fastcgi_param SCRIPT_FILENAME  $document_root$fastcgi_script_name;
+</tmpl_if>
             fastcgi_intercept_errors on;
         }
 </tmpl_if>
diff --git a/server/conf/php_fpm_pool.conf.master b/server/conf/php_fpm_pool.conf.master
index fd7e996a76ce3088eb202413087e7d1387b1b84f..8081c994aebc99eff12e740e280e583fb6f50411 100644
--- a/server/conf/php_fpm_pool.conf.master
+++ b/server/conf/php_fpm_pool.conf.master
@@ -27,6 +27,11 @@ pm.process_idle_timeout = <tmpl_var name='pm_process_idle_timeout'>s;
 pm.max_requests = <tmpl_var name='pm_max_requests'>
 
 chdir = /
+<tmpl_if name='php_fpm_chroot'>
+chroot = <tmpl_var name='php_fpm_chroot_dir'>
+php_admin_value[doc_root] = /web
+php_admin_value[cgi.fix_pathinfo] = 0
+</tmpl_if>
 
 env[HOSTNAME] = $HOSTNAME
 env[TMP] = <tmpl_var name='document_root'>/tmp
diff --git a/server/conf/vhost.conf.master b/server/conf/vhost.conf.master
index a6fd2f95b108743e98421dda32c1a6591674ed13..1426961bb3dad69e89af5c91f96a2b4fab8acd35 100644
--- a/server/conf/vhost.conf.master
+++ b/server/conf/vhost.conf.master
@@ -377,6 +377,12 @@
 </tmpl_if>
 		</IfModule>
 		<IfModule mod_proxy_fcgi.c>
+<tmpl_if name='php_fpm_chroot' op='==' value='y'>
+			ProxyFCGISetEnvIf "true" DOCUMENT_ROOT "/web"
+			ProxyFCGISetEnvIf "true" CONTEXT_DOCUMENT_ROOT "%{reqenv:DOCUMENT_ROOT}"
+			ProxyFCGISetEnvIf "true" HOME "%{reqenv:DOCUMENT_ROOT}"
+			ProxyFCGISetEnvIf "true" SCRIPT_FILENAME "%{reqenv:DOCUMENT_ROOT}%{reqenv:SCRIPT_NAME}"
+</tmpl_if>
 <tmpl_if name='use_tcp'>
 			#ProxyPassMatch ^/(.*\.php[345]?(/.*)?)$ fcgi://127.0.0.1:<tmpl_var name='fpm_port'><tmpl_var name='web_document_root'>/$1
 			<Directory {tmpl_var name='web_document_root'}>
diff --git a/server/plugins-available/apache2_plugin.inc.php b/server/plugins-available/apache2_plugin.inc.php
index bfa4526fc359aa482f1bfe82dfabfe27f34234db..dad2a26f3ebdb9c1a8df254d6c7cf5f069ac0d26 100644
--- a/server/plugins-available/apache2_plugin.inc.php
+++ b/server/plugins-available/apache2_plugin.inc.php
@@ -1580,6 +1580,7 @@ class apache2_plugin {
 		}
 		$tpl->setVar('use_tcp', $use_tcp);
 		$tpl->setVar('use_socket', $use_socket);
+		$tpl->setVar('php_fpm_chroot', $data['new']['php_fpm_chroot']);
 		$fpm_socket = $socket_dir.$pool_name.'.sock';
 		$tpl->setVar('fpm_socket', $fpm_socket);
 		$tpl->setVar('fpm_port', $web_config['php_fpm_start_port'] + $data['new']['domain_id'] - 1);
@@ -3110,6 +3111,14 @@ class apache2_plugin {
 			$tpl->setVar('enable_php_open_basedir', ';');
 		}
 
+		// Chrooted PHP-FPM
+		if ($data['new']['php_fpm_chroot'] === 'y') {
+			$tpl->setVar('php_fpm_chroot', $data['new']['php_fpm_chroot']);
+			$tpl->setVar('php_fpm_chroot_dir', $data['new']['document_root']);
+			$tpl->setVar('php_open_basedir', str_replace($tpl->getVar('document_root'), '', $tpl->getVar('php_open_basedir')));
+			$tpl->setVar('document_root', '');
+		}
+
 		// Custom php.ini settings
 		$final_php_ini_settings = array();
 		$custom_php_ini_settings = trim($data['new']['custom_php_ini']);
diff --git a/server/plugins-available/nginx_plugin.inc.php b/server/plugins-available/nginx_plugin.inc.php
index 4df2f843171754d3ce5206187e5300d1ab20f0ea..fb9712b1e60d351eaf17e3183805a3810d5a5934 100644
--- a/server/plugins-available/nginx_plugin.inc.php
+++ b/server/plugins-available/nginx_plugin.inc.php
@@ -1041,6 +1041,7 @@ class nginx_plugin {
 		}
 		$tpl->setVar('use_tcp', $use_tcp);
 		$tpl->setVar('use_socket', $use_socket);
+		$tpl->setVar('php_fpm_chroot', $data['new']['php_fpm_chroot']);
 		$fpm_socket = $socket_dir.$pool_name.'.sock';
 		$tpl->setVar('fpm_socket', $fpm_socket);
 		$tpl->setVar('rnd_php_dummy_file', '/'.md5(uniqid(microtime(), 1)).'.htm');
@@ -2743,6 +2744,14 @@ class nginx_plugin {
 			$tpl->setVar('enable_php_open_basedir', ';');
 		}
 
+		// Chrooted PHP-FPM
+		if ($data['new']['php_fpm_chroot'] === 'y') {
+			$tpl->setVar('php_fpm_chroot', $data['new']['php_fpm_chroot']);
+			$tpl->setVar('php_fpm_chroot_dir', $data['new']['document_root']);
+			$tpl->setVar('php_open_basedir', str_replace($tpl->getVar('document_root'), '', $tpl->getVar('php_open_basedir')));
+			$tpl->setVar('document_root', '');
+		}
+
 		// Custom php.ini settings
 		$final_php_ini_settings = array();
 		$custom_php_ini_settings = trim($data['new']['custom_php_ini']);