What is Redis? How it speeds up your applications and how to set it up on your server

A visitor opens a product page in an online shop, and the site runs dozens of database queries to show the price, the photos, the reviews and the cart. A second later another visitor opens the same page, and the site runs the same queries again to get the same results. That repetition is what Redis was made to cut out: a data store that lives in the server’s memory, keeps ready-made results and returns them, usually in under a millisecond, so the database carries less load and the site gets faster. WordPress, Laravel, Magento and many others use it for caching, sessions and job queues. This article covers what Redis is and how it works, what it offers your application and when it is the wrong tool, then how to install it on a Linux server and set up its security, memory, disk persistence and the system around it, and how to connect your application, monitor it and keep it updated.

01What Redis is and how it works

The name Redis stands for REmote DIctionary Server. The Italian programmer Salvatore Sanfilippo started it to carry the load of a tool he was building for real-time log analysis, then released it as an open-source project that spread through web applications around the world. It is an in-memory data store: it keeps all its data in the server’s RAM and uses the disk only to save and restore. That is why it reads and writes far faster than a database that reads from disk, at the price of a data set limited by the size of the memory.

Everything in Redis is keys and values: you write a value under a name, such as product:1042, then read it back by the same name. But a value is not just text; it is a data structure with its own commands:

Since Redis 8, more types are part of the open-source edition itself, among them JSON, time series, search and the vector sets that AI applications need.

Any key can carry a time to live: you give it a number of seconds, and Redis deletes the key on its own when they run out. All caching rests on this: a ready copy lives for a few minutes and then disappears, and the application fetches a fresh one from the database.

Redis runs commands one after another on a single main thread, so two commands never interleave: if two clients increment the same counter at the same moment with INCR, it goes up twice, not once. This does not slow it down as one might think, because its work in memory never waits for the disk, and its documentation says a single instance on an ordinary Linux server serves about a million requests a second when commands are sent in batches. It also needs less memory than many expect: a million small keys with string values take about 85 MB.

02What Redis offers your application

Redis is used above all to take load off the main database, whether MariaDB, MySQL or PostgreSQL, but it offers more than that:

• Caching query results: The application looks for the result in Redis first; if it is not there, it asks the database and stores the answer with a time to live. This is the cache-aside pattern, the simplest way to speed up heavy pages.
• Object caching in WordPress: Page caching does nothing for a logged-in visitor, the cart or the dashboard, so WordPress keeps its query results and settings in Redis instead of repeating them on every request, as we explained in our guide to optimised WordPress hosting.
• User sessions: The login session and the cart are kept in Redis, so they survive an application restart, work across several application servers at once, and expire on their own.
• Job queues: Sending email, resizing images and generating invoices go into a queue in Redis, so the site answers the visitor at once and a background worker finishes the job moments later. Laravel queues and tools such as Sidekiq and BullMQ work this way.
• Counters and rate limits: INCR increments a counter in one step that never interleaves, so you can count failed logins from each IP address and stop them past a threshold, or cap the requests to your API per minute.
• Leaderboards: A sorted set keeps its items ordered by score at all times, so you can show “best sellers this week” without the database working it out on every visit.
• Real-time messages: With publish/subscribe (Pub/Sub) or Streams you pass notifications between the parts of your application, such as a “new order” message that appears in the shop’s dashboard the moment payment goes through.
• Locks between processes: SET with the NX option writes only if the key does not exist, which stops two workers from running the same job twice.

All of this takes short commands. Here is a redis-cli session for a sweet shop in Riyadh that keeps a product page for ten minutes, counts failed logins and ranks its products by sales:

# A ready product page, kept for ten minutes and then deleted on its ownSET page:product:1042 "<html>…</html>" EX 600TTL page:product:1042# (integer) 600# A failed login from one address; the counter resets after a quarter of an hourINCR login:fail:198.51.100.7EXPIRE login:fail:198.51.100.7 900 NX# This week’s best sellersZINCRBY top:week 3 "product:1042"ZREVRANGE top:week 0 4 WITHSCORES

Cache-aside in PHP

This is how the pattern looks in PHP code with the phpredis extension, and it looks much the same in any language:

$redis = new Redis();$redis->connect("127.0.0.1", 6379);$redis->auth(["app", getenv("REDIS_PASSWORD")]);$key = "product:1042";$product = $redis->get($key);if ($product === false) {    // Not in Redis: ask the database and keep the answer for ten minutes    $product = json_encode(loadProductFromDatabase(1042));    $redis->setex($key, 600, $product);}

The part people forget: when the price changes in the database, delete the key with DEL product:1042, or accept that visitors see the old price until it expires. Choose each time to live by what that kind of data can bear: seconds for stock levels, hours for the About page.

03When Redis is the wrong tool

Redis is a powerful tool, but it is not the answer to everything:

• Data larger than memory: All of Redis’s data sits in RAM, so if your data runs to tens of gigabytes, memory will cost you far more than disk.
• The only copy of data you cannot lose: Redis complements your database rather than replacing it. Orders, invoices and user accounts belong in MariaDB or PostgreSQL; Redis holds copies of them, or data that can be rebuilt.
• Complex queries and reports: Redis has no tables, no joins and no SQL. Reports that aggregate, filter and join belong in a relational database.
• A small site that page caching already serves: If your site is mostly static pages served by LiteSpeed Cache, Redis may make little difference. Measure first, then add it where the site is slow.

04Installing Redis on a Linux server

If your application runs on a server you manage yourself, such as a VPS server, installing Redis takes minutes.

On Ubuntu and Debian

The distribution’s repositories include Redis, but their version may be older than the latest release. For the latest version, add Redis’s official repository:

sudo apt-get install lsb-release curl gpgcurl -fsSL https://packages.redis.io/gpg | sudo gpg --dearmor -o /usr/share/keyrings/redis-archive-keyring.gpgsudo chmod 644 /usr/share/keyrings/redis-archive-keyring.gpgecho "deb [signed-by=/usr/share/keyrings/redis-archive-keyring.gpg] https://packages.redis.io/deb $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/redis.listsudo apt-get updatesudo apt-get install redis# Redis starts on its own after the install, so check that it answersredis-cli ping

The last command should answer PONG. The service is called redis-server, and its configuration file is /etc/redis/redis.conf.

On AlmaLinux and Rocky Linux

In version 9 you will find Redis in the AppStream repository. Version 10, like Red Hat Enterprise Linux 10, ships Valkey instead of Redis, and it is compatible:

# AlmaLinux or Rocky 9sudo dnf install redissudo systemctl enable --now redisredis-cli ping# AlmaLinux or Rocky 10: the tool is valkey-cli, the configuration /etc/valkey/valkey.confsudo dnf install valkeysudo systemctl enable --now valkeyvalkey-cli ping

Check the version with redis-server --version. The version a distribution ships may be older than the latest release, so make sure the distribution still sends it security fixes.

05Secure it before anything else

Redis was designed to be reached by trusted clients on a trusted network, not to be opened to the internet. Even so, in October 2025 the company Wiz found about 330,000 Redis instances exposed on the internet, about 60,000 of them with no password at all. Anyone who reaches an open Redis can wipe all its data with a single command, or exploit a flaw in it to run code on the server.

The good news is that the redis.conf file that comes with Redis is fairly safe: it listens on 127.0.0.1 only, and its “protected mode” is on, so it refuses connections from outside the server as long as there is no password. The danger begins when someone changes that to connect from another server. So keep these lines:

# /etc/redis/redis.conf# Listen on this server onlybind 127.0.0.1 -::1protected-mode yesport 6379# If the application is on the same server, a socket is faster and closes the network entirely:# port 0# unixsocket /run/redis/redis.sock# unixsocketperm 770

With a socket, add the web server’s user to the redis group so it can connect, for example: sudo usermod -aG redis www-data.

Passwords and permissions

Since Redis 6, passwords are managed through access control lists: named users, each with a password and the commands and keys it may use. Create a strong password with ACL GENPASS, which gives you 64 random characters, then define the users in the configuration file:

# A long random password. Run it twice, and put the two results in place of APP_PASSWORD and ADMIN_PASSWORDredis-cli ACL GENPASS# In /etc/redis/redis.conf:# The default user logs in with no password, so disable ituser default off# The application: every command except the admin commands and wiping all databasesuser app on >APP_PASSWORD ~* &* +@all -@admin -flushall# The administrator: for you alone, from the terminaluser admin on >ADMIN_PASSWORD ~* &* +@all

Then restart Redis, and from then on log in with a user name: redis-cli --user admin --askpass. If your application does not send a user name, keep the default user enabled and give it a password with the older requirepass line, which is enough for a single application.

Three more rules:

• Do not run it as root: The official packages run it as the redis user, so keep it that way.
• Do not open port 6379 to the world: If another server needs to reach it, make it listen on the private network’s address, allow only that server’s address in the firewall, and turn on TLS if the data crosses a network you do not trust.
• Keep the protected settings locked: Since Redis 7, the enable-protected-configs setting, off by default, blocks changing the save folder and file name while Redis runs. That is the trick attackers once used to write SSH keys onto the server, so leave it off.

Then check the result: the first command should show Redis listening on 127.0.0.1 only, and the second should be refused with a NOAUTH error:

# Which address is Redis listening on?sudo ss -ltnp | grep 6379# With no user and password it should be refusedredis-cli ping

06Set the memory ceiling and eviction policy

If you give Redis no ceiling, it will take whatever memory it wants: on 64-bit systems there is no limit by default, until the system kills it when memory runs out. So give it a ceiling with the maxmemory setting, and leave headroom below it: the Redis documentation says that if you have 10 GB free you should set the ceiling to 8 or 9, because Redis needs memory beyond its data, and its needs can double while it saves to disk in a write-heavy application.

Then choose the eviction policy, that is, what Redis does when it reaches the ceiling:

The volatile policies only delete a key that has a time to live, so if Redis holds no such key, they behave like noeviction and refuse writes.

# In redis.confmaxmemory 512mbmaxmemory-policy allkeys-lru# Or while it runs, then save the change to the configuration fileredis-cli --user admin --askpass CONFIG SET maxmemory 512mbredis-cli --user admin --askpass CONFIG REWRITE

The rule of thumb: do not mix caching with data you cannot lose in one instance. Run one instance for caching with allkeys-lru and another for sessions and queues with noeviction, so eviction never deletes a customer’s session to make room for a cached page.

07Does Redis save its data to disk

Redis’s data lives in memory, but it can save it to disk to restore after a restart, in two ways:

• RDB snapshots: Redis writes a full copy of its data into one compact file every so often. The suggested setting in redis.conf saves after an hour if one key changed, after 5 minutes if 100 changed and after a minute if 10,000 changed, so the last few minutes may be lost if it stops suddenly. The file is excellent for backups.
• The AOF log: Redis writes every command that changes the data into a log it replays at startup. With appendfsync everysec, the suggested setting, you lose at most one second of writes.

You can combine the two, or turn persistence off entirely for a pure cache that is rebuilt from scratch. Choose by what you store:

# Pure cache: no snapshots and no logsave ""appendonly no# Sessions and queues: snapshots, plus a log written to disk every secondsave 3600 1 300 100 60 10000appendonly yesappendfsync everysec

An RDB file is safe to copy while Redis runs, because it is written under a temporary name and then replaces the old one in a single step, so copy it off the server every day. Since Redis 8.10, the BACKUP commands take a full backup that includes the latest writes without stopping them.

08Tune the system around Redis

Three Linux settings the Redis documentation recommends; Redis writes a warning in its log when it finds some of them wrong:

• vm.overcommit_memory = 1: To save in the background, Redis copies itself into a child process. With the default setting, Linux may refuse the copy if free memory is not enough for a full copy, and the save fails. The value 1 solves this.
• Transparent Huge Pages: A kernel feature that adds latency and memory use. Recent Redis turns it off for its own process with the disable-thp setting, and its documentation recommends turning it off system-wide if the warning appears.
• Swap: The documentation recommends having it, so that if Redis outgrows memory it slows down rather than being killed by the system, and you notice and act.

# Always, and it survives a server rebootecho "vm.overcommit_memory = 1" | sudo tee /etc/sysctl.d/90-redis.confsudo sysctl --system# If the THP warning appears in the log (resets after a server reboot)echo never | sudo tee /sys/kernel/mm/transparent_hugepage/enabled# Then restart Redis and read its logsudo systemctl restart redis-serversudo tail -n 30 /var/log/redis/redis-server.log

09Connect your application to Redis

Your application’s language needs a library that talks to Redis. In PHP it is the phpredis extension, called redis in the list of extensions, so make sure it is enabled for the PHP version your site runs on.

WordPress

Install the Redis Object Cache plugin, then add the connection settings to wp-config.php, above the line that says stop editing:

define( "WP_REDIS_HOST", "127.0.0.1" );define( "WP_REDIS_PORT", 6379 );// The user name and password from the ACL setupdefine( "WP_REDIS_PASSWORD", [ "app", "APP_PASSWORD" ] );define( "WP_REDIS_DATABASE", 0 );// A prefix that tells this site’s keys apart if other sites share Redisdefine( "WP_REDIS_PREFIX", "tumoor-alqassim:" );

Then enable it from the plugin’s page in the dashboard, or with wp redis enable and wp redis status in WP-CLI.

Laravel

In the .env file:

REDIS_CLIENT=phpredisREDIS_HOST=127.0.0.1REDIS_PORT=6379REDIS_USERNAME=appREDIS_PASSWORD=APP_PASSWORD# Cache, sessions and queues all on RedisCACHE_STORE=redisSESSION_DRIVER=redisQUEUE_CONNECTION=redis

Then clear the cached configuration with php artisan config:clear. Laravel puts cache keys in database 1, away from the queues in database 0, so php artisan cache:clear does not wipe your pending jobs. With a Unix socket, set REDIS_HOST to the socket’s path and REDIS_PORT to zero.

Node.js

import { createClient } from "redis";// Such as redis://app:[email protected]:6379/0const redis = createClient({ url: process.env.REDIS_URL });redis.on("error", (err) => console.error("Redis:", err));await redis.connect();await redis.set("visits:today", "0", { EX: 86400 });await redis.incr("visits:today");

10Monitor Redis and measure its effect

The most important number for a Redis used as a cache is the hit ratio: how many times in every hundred attempts the application found what it asked for in Redis. You work it out from INFO stats by dividing keyspace_hits by the sum of keyspace_hits and keyspace_misses. The following commands cover most checks:

redis-cli --user admin --askpass# Memory used, the ceiling and the fragmentation ratioINFO memory# Hits and misses, and keys deleted by eviction or expiryINFO stats# The ten slowest commands (anything over 10 milliseconds by default)SLOWLOG GET 10# Latency and memory diagnosis in plain wordsLATENCY DOCTORMEMORY DOCTOR

From the terminal, redis-cli --bigkeys looks for the largest keys, and redis-cli --latency measures response time continuously. If the hit ratio is lower than you expect, look at evicted_keys: a large number means memory is too small or the policy does not suit how the data is read. If it is small and expired_keys is large, the time to live is shorter than it should be.

ProblemOOM command not allowed when used memory > maxmemory

FixRedis reached its ceiling and its policy is noeviction. Raise the ceiling, or choose allkeys-lru if the instance is a cache, and look for large keys with --bigkeys.

ProblemMISCONF Redis is configured to save RDB snapshots…

FixSaving to disk failed, so Redis stopped writes to protect your data. Read its log: a full disk, the save folder’s permissions, or vm.overcommit_memory.

ProblemNOAUTH Authentication required or WRONGPASS

FixThe application does not send the password, or sends it without the user name. Check the connection settings in the application.

ProblemRedis slows down suddenly now and then

FixKEYS on a large database stops everything until it finishes, so use SCAN instead. Also check SLOWLOG and the times of background saves.

ProblemPermission denied on a Unix socket

FixThe web server’s user is not in the redis group, or the socket permissions in unixsocketperm are tighter than needed.

11Update Redis and follow its vulnerabilities

On 3 October 2025 Redis fixed a flaw its discoverers at Wiz named “RediShell”, CVE-2025-49844: a bug in the Lua engine about 13 years old, rated 10 out of 10, that lets anyone able to run a Lua script run code on the server. The fix is in versions 8.2.2, 8.0.4, 7.4.6, 7.2.11 and 6.2.20, and Valkey released its own fix the same day. The fixes did not stop there: in May 2026, version 8.6.3 closed five flaws that could lead to remote code execution, among them CVE-2026-23631, again in Lua, and more security fixes followed in July and August.

Most of these flaws need the attacker to connect to Redis first, which is why the network and password settings in this article protect you from most of them. But they are no substitute for updating:

• Know your version: With redis-server --version, or INFO server inside redis-cli.
• Update from your source: sudo apt-get update then sudo apt-get upgrade on Ubuntu and Debian, or sudo dnf upgrade on AlmaLinux and Rocky, then restart the service.
• Stay on a supported branch: The latest stable release today is 8.10, from July 2026, and the 8.2 to 8.8 branches still receive fixes. Distribution versions get their fixes from the distribution itself.

12A short checklist before you start

1. 01Measure first: Know your slowest pages and queries before you add Redis, so you know what it will speed up.
2. 02Lock it to the server: bind to 127.0.0.1 or a Unix socket, with protected mode on.
3. 03A user and a password: Disable the default user, and give your application a user without admin commands.
4. 04A memory ceiling: maxmemory with headroom, and an eviction policy that suits what you store.
5. 05Persistence as needed: None for a pure cache, AOF for queues and sessions.
6. 06Monitor and update: The hit ratio and evicted keys every so often, and every security release as soon as it is out.

13Redis free with Illevante’s shared hosting

Everything above is what you need when you run your own server. If your site is on Illevante’s shared hosting, Redis is included free in every cPanel hosting plan: a private instance for your account that you manage from cPanel without writing a single line of configuration:

• One-click start: You enable, start and stop Redis from cPanel, and see its state at a glance: running, stopped, or high on memory.
• An isolated instance for your account: Each account has its own Redis instance with its own password, kept hidden until you ask to reveal it, and your site connects to it from the same server.
• One-click presets: For WordPress, Laravel, Magento and user sessions, or a generic setup. Each one sets the memory policy and the options that suit its use.
• Advanced settings: The memory ceiling, eviction policy, number of databases, connection timeout, number of connections and disk persistence, within your plan’s limits.
• It recognises your application: It scans your site’s folder and detects WordPress, with LiteSpeed Cache, Laravel and Magento, and gives you your account’s connection settings ready to paste into WordPress, Laravel, Magento, PHP, Node.js, Python and LiteSpeed Cache.
• A health score and checklist: A score out of 100 that sums up Redis’s state, and a checklist that confirms it is enabled, running and password-protected, with a hint for fixing each item.
• Live monitoring: Charts of memory and its peak, connections, hit ratio, latency and command activity, with history for the last 24 hours and the last 7 days.
• Backups and restore: You take a backup of your Redis data whenever you like and restore it from cPanel, and the system keeps a snapshot of the current data before any restore.
• A diagnostics report for support: You export it as JSON with the passwords masked, so you can attach it to your ticket safely.

Because the web server in our hosting is LiteSpeed, you get LiteSpeed Cache and Redis together in all three plans: the first caches whole pages, the second keeps objects and query results for the pages that are not cached. Remember to enable the redis extension for your PHP version in Select PHP Version in cPanel. If your application runs on CoreVPS, you have full root access, so set Redis up as this article shows. And our technical support team is with you around the clock if you need help connecting your site to Redis.