It's not easily defeated by the default setup. Quite the contrary, the default setups are great. Typical apache + mod_php is the easiest to exploit. For example:
- Docker image `php:8.5.11-apache` is easy to exploit.
- Or the WordPress blog I installed with Digital Ocean template in 2023.
But apache + mod_php hasn't been the default setup for a very long time, that's what people are trying to tell you. Given your expertise, you must know that already. So I have to conclude that you're arguing in bad faith because it's the only setup you can break.
When I installed my WordPress blog with DigitalOcean template in 2023, it was Apache + mod_php.
Official WordPress docs mentions Apache before nginx: https://developer.wordpress.org/advanced-administration/serv...
Official php install instructions for Linux uses Apache + mod_php: https://www.php.net/manual/en/install.unix.debian.php