I think using the php built-in webserver is not an option for a production setting.

Correct. From the documentation:

Warning: This web server is designed to aid application development. It may also be useful for testing purposes or for application demonstrations that are run in controlled environments. It is not intended to be a full-featured web server. It should not be used on a public network.

The built-in web server can only process one request at a time.

The built in web server is awful on its own. Forget production usage, it’s hard to even use for a quick bit of E2E testing.

Unfortunately it has some really opinionated routing rules with certain file extensions, preventing you from having a dynamic URL with something like a .json or a .xml extension. Instead it will always try to look up a static file of that and serve it instead.

I can’t find the bug tracker issue for it but it was closed out with a message along the lines of “don’t use the built in web server for anything besides a toy”.

Luckily there are plenty of PHP Cli based web servers now that some other commenters have mentioned.

You can take full control over the routing using router script, then none of the default rules will apply. To be honest, I really dislike how many applications are wired around some Apache configuration or at least assume some specific hostname or path to be used for no reason. If it works with the built-in webserver, then it will work just as well with pretty much any SAPI.

the embedded server is great for dev, but useless for production. for example any url that contains a dot "." is considered to be a static file. so for example this path does not do what it's spposed to do /login.php?token=fghjjbjkkooll.rfcgg