diff --git a/configs/shared-vhost-template.tpl b/configs/shared-vhost-template.tpl
index 521ae07..2334437 100644
--- a/configs/shared-vhost-template.tpl
+++ b/configs/shared-vhost-template.tpl
@@ -27,11 +27,17 @@
     SSLCertificateFile /etc/pki/tls/certs/localhost.crt
     SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
 
-    # Proxy PHP requests to FPM with the correct filesystem path.
-    # Apache serves static files directly from /mnt/users/ (read-only mount),
-    # but PHP-FPM has files at /home/{user}/public_html/ (its own mount).
-    # ProxyPassMatch maps .php URLs directly to the FPM container's path.
-    ProxyPassMatch "^/(.*\.php(/.*)?)$" "fcgi://~~fpm_host~~:~~fpm_port~~/home/~~user~~/public_html/$1"
+    <FilesMatch \.php$>
+        SetHandler "proxy:fcgi://~~fpm_host~~:~~fpm_port~~"
+    </FilesMatch>
+
+    # The shared httpd serves files from /mnt/users/{user}/{domain}/public_html
+    # but the FPM container has them at /home/{user}/public_html.
+    # Override both DOCUMENT_ROOT and SCRIPT_FILENAME so PHP sees the
+    # correct paths (required for plugins like WordFence that use
+    # $_SERVER['DOCUMENT_ROOT'] to locate config files).
+    ProxyFCGISetEnvIf "true" DOCUMENT_ROOT "/home/~~user~~/public_html"
+    ProxyFCGISetEnvIf "true" SCRIPT_FILENAME "/home/~~user~~/public_html%{reqenv:SCRIPT_NAME}"
 
     DirectoryIndex index.php index.html index.htm