Turns out this is a SELinux problem, I turned it off ("permissive" instead of "enforcing") and it works. So now I just need to figure all that out :/

Update: OK so what seems to have done the trick is changing the context role on my website folder in /var/www to system_u (instead of unconfined_u)

This is along with other changes i.e. setting httpd_sys_content_t as the context on everything in that folder, except cgi-bin which I've set to httpd_sys_script_exec_t