Server Requirements & Deployment

For the setup wizard itself, see Installing Your Site. This page is the technical checklist for whoever provisions the server.

Server requirements

Requirement	Minimum	Notes
Web server	Apache 2.2+	Nginx works but needs manual config — see below
PHP	8.3	Raised from 7.4 in 1.3.6 — earlier versions can crash silently on profile saves and extension updates
Database	—	None. Flat-file JSON architecture

Required PHP extensions

json, mbstring, hash, session, pcre, filter, fileinfo.

Required for image features

gd, with JPEG and PNG support compiled in (verify via phpinfo() → GD section).

Optional extensions

GD with WebP support (gracefully disabled if absent), zip/ZipArchive (needed for theme/plugin ZIP upload and ZIP backups — relevant admin pages warn if missing).

Browser (admin panel)

Chrome/Edge 80+, Firefox 75+, Safari 13.1+. Internet Explorer is not supported.

Filesystem permissions

Writable by the PHP process:

Path	Required for
`/` (root)	`config.json`, `install.lock` at setup time
`/data/`	All content read/write, including `/data/drafts/`, per-item `.trash/` and `.revisions/`
`/files/`	Media uploads
`/bckps/`	Full-site backups, update safety snapshots, Template Editor file backups
`/private/`	Per-install secrets, rate-limit stores, `users.json`, activity log
`/cache/`	Compiled locale and index caches (auto-rebuilds if missing)
`/theme/`, `/plugins/`	ZIP upload

Recommended: 755 for directories, 644 for files.

Apache configuration

Required modules: mod_rewrite, mod_authz_core. Required directive on the document root:

AllowOverride All

Without it, every .htaccess in the project is silently ignored.

RewriteEngine On
# If installed in a subdirectory:
# RewriteBase /your-subdir/

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php [QSA,L]

Nginx (not officially supported)

.htaccess has no effect on nginx — replicate its rules manually. A ready-to-adapt nginx.conf.example ships with the release. Minimum equivalent:

location / {
    try_files $uri $uri/ /index.php?$query_string;
}

location ~ ^/(data|bckps|private)/ {
    deny all;
}

location ~ (config\.json|admin-credentials\.php)$ {
    deny all;
}

The dashboard's System Information check also warns if /data/ is publicly reachable — common on nginx installs missing this block.

Pre-flight checklist

[ ] Apache 2.2+ with mod_rewrite enabled (or the nginx.conf.example rules applied)
[ ] AllowOverride All set on the document root
[ ] PHP 8.3 or higher
[ ] PHP extensions: json, mbstring, hash, session, pcre, filter, fileinfo
[ ] PHP GD with JPEG and PNG support
[ ] ZipArchive (recommended — needed for theme/plugin ZIP upload and ZIP backups)
[ ] Root .htaccess in place and not overridden
[ ] Write permissions on: /, /data/, /files/, /bckps/, /private/, /cache/, /theme/, /plugins/