PHP Script not timing out while using curl_exec( )

This isn’t really a PHP timeout issue — it’s a kernel/network stack blocking issue.

When the server is under stress (like during a TCP reset after a DDoS), the hang usually happens inside a blocking system call (DNS resolution, TCP SYN retries, routing, etc.). In that state:

• CURLOPTTIMEOUT and CURLOPTCONNECTTIMEOUT are not always enforced

• PHP doesn’t regain control to apply the timeout

• The process just waits until the OS networking layer gives up (which can take minutes)

So your observation is correct: curl isn’t “ignoring” the timeout — it simply never gets a chance to enforce it.

Things you should still do

Make sure you have these set (they help in many cases, but won’t fix kernel-level blocking):

curlsetopt($ch, CURLOPTNOSIGNAL, 1);
curlsetopt($ch, CURLOPTTIMEOUTMS, 10000);
curlsetopt($ch, CURLOPTCONNECTTIMEOUTMS, 5000);
curlsetopt($ch, CURLOPTLOWSPEEDLIMIT, 1);
curlsetopt($ch, CURLOPTLOWSPEEDTIME, 10);

Also test removing:

curlsetopt($ch, CURLOPTINTERFACE, OPERATING_IP);

Binding to a specific interface can make things worse during network instability.

The important part

There is no fully reliable way in PHP/cURL alone to guarantee a hard timeout if the OS is stuck in a blocking network call.

The only robust solution is to enforce a timeout outside the process, e.g.:

timeout 10s php yourscript.php

or by spawning a separate worker process and killing it if it exceeds a limit.

Bottom line

• Your setup is correct

• The behavior is expected under network stack issues

• Application-level timeouts are not absolute in these cases

If you need strict guarantees, you have to enforce the timeout at the process/OS level, not just inside cURL.

This isn’t really a PHP timeout issue — it’s a kernel/network stack blocking issue.

When the server is under stress (for example during TCP resets), the hang can occur inside a blocking system call (DNS resolution, TCP retries, routing, etc.). In that state:

• CURLOPTTIMEOUT and CURLOPTCONNECTTIMEOUT may not be enforced

• PHP does not regain control to apply the timeout

• The process waits until the OS networking layer times out (which can take minutes)

So curl isn’t ignoring the timeout — it simply never gets control back to enforce it.

Things you should still do

curlsetopt($ch, CURLOPTNOSIGNAL, 1);
curlsetopt($ch, CURLOPTTIMEOUTMS, 10000);
curlsetopt($ch, CURLOPTCONNECTTIMEOUTMS, 5000);
curlsetopt($ch, CURLOPTLOWSPEEDLIMIT, 1);
curlsetopt($ch, CURLOPTLOWSPEEDTIME, 10);

Also test removing:

curlsetopt($ch, CURLOPTINTERFACE, OPERATING_IP);

Binding to a specific interface can make things worse during network instability.

Important point

There is no fully reliable way in PHP/cURL alone to guarantee a hard timeout if the OS is stuck in a blocking network call.

The only robust solution is to enforce a timeout outside the process, for example:

timeout 10s php yourscript.php

Bottom line

• Your setup is correct

• The behavior is expected under network issues

• Application-level timeouts are not absolute

If you need strict guarantees, enforce the timeout at the OS/process level.