Install Zen Cart on a Linux VPS by matching your server software to the exact Zen Cart release, creating the domain and database first, uploading and verifying the official archive, then running the browser installer. For most first-time deployments, Apache 2.4 is the easier choice because Zen Cart’s supplied .htaccess protections work with it. Nginx is supported, but you must reproduce directory-security rules yourself.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
After the installer finishes, the store is not ready until you protect both configuration files, remove zc_install, set a strong administrator password, and enable HTTPS. The steps below cover a clean manual installation and the decisions that commonly cause failed or insecure deployments.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Check compatibility before provisioning the VPS
Zen Cart requirements vary by release branch. Do not choose PHP or a database image first and hope it works; identify the Zen Cart version you intend to run, then provision versions listed for that release. The official server-requirements page was last modified April 25, 2026, and explicitly warns that compatibility changes by branch.
| Zen Cart documentation reference | PHP | Database | Web server |
|---|---|---|---|
| v2.2.x requirements | PHP 8.2 through 8.5 | Preferred: MySQL 8.x/9.x or MariaDB 11.x; supported: MySQL 5.7.8+ or MariaDB 10.2.7+ | Linux with Apache or Nginx |
| Download-page summary for v2.1+ | PHP 8.1–8.3+ | MySQL 5.7+ or MariaDB | Apache or Nginx |
The two summaries cover different release ranges, so treat the exact release page as authoritative. If a hosting image offers PHP 8.1 only, it may suit a v2.1 release but not v2.2.x. Conversely, selecting PHP 8.5 for an older branch without checking its support statement can create plugin or extension incompatibilities.
#1 Best Overall
Required PHP extensions and settings
Enable the extensions Zen Cart checks during its pre-flight test:
bcmathctypecurlcompiled with OpenSSLfileinfoGDandgetimagesizeiconvintl(required since v2.0.0)JSONmbstring(required since v2.2.0)mysqliandPDO MySQLPCREzipzlib
Set PHP memory_limit to at least 128 MB. A 256 MB or 512 MB limit is useful when the VPS has sufficient RAM, particularly during image processing, administration tasks, or extension-heavy stores. Keep allow_url_include disabled. The core documentation also advises disabling passthru, system, and shell_exec unless a specific, trusted plugin requires one of them.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose Apache or Nginx
| Decision point | Apache 2.4 | Nginx |
|---|---|---|
| Documentation status | Primary documented web server | Supported |
| Configuration model | Uses Zen Cart’s distributed .htaccess protections |
Requires equivalent directory-security rules in the server configuration |
| Important setup requirement | AllowOverride must be All or at least Limit Indexes Options |
Rules that would have come from .htaccess do not apply automatically |
| Recommended capabilities | rewrite, ssl, http2, headers, expires, env, alias, deflate, mime, plus the PHP module |
Use the PHP integration supported by your distribution and explicitly deny access to protected Zen Cart directories |
| Best fit | Most straightforward first installation | Administrators already comfortable translating Apache security rules |
Windows/IIS is not supported. Whichever server you select, reserve enough RAM and storage for the operating system, PHP workers, the database, product images, logs, and backups rather than sizing the VPS to the application files alone.
Provision the VPS and point the domain
- Select a Linux VPS image. Use a currently supported Linux distribution and obtain root or equivalent administrative access. Confirm that the image can install the PHP branch, extensions, web server, and MySQL-compatible database required by your Zen Cart release.
- Install the web stack. Install Apache 2.4 or Nginx, the matching PHP runtime and extensions, and MySQL or MariaDB. Keep package versions within the release’s compatibility range; do not mix a newer PHP branch with an older Zen Cart release without checking its documentation.
- Create DNS records. Point the store’s domain (and any intended
wwwhostname) to the VPS address. Wait for DNS to resolve before testing the installer. If you plan to force HTTPS, make sure both the certificate and DNS are ready so the installer’s SSL choice matches the final URL. - Create a dedicated document root. Use a clean directory such as the virtual host’s
public_html,www, orhtmldirectory. Avoid placing the archive in a shared directory containing unrelated applications. - Configure the virtual host. Set the domain’s document root, enable the PHP handler, and, with Apache, permit the required overrides. Keep the database service reachable only as needed by the application; do not expose its administrative port publicly.
Before uploading Zen Cart, verify the active PHP version and extensions from the VPS control panel or a temporary diagnostic page, then remove that diagnostic page. The browser installer’s pre-flight screen is the final authority because it tests the environment from the application’s point of view.
Rank #2
- Used Book in Good Condition
Create the database and account first
The installer expects an empty database and credentials that can create and modify Zen Cart tables. Create them in your hosting control panel or equivalent database-management interface before opening the store URL.
Use a separate database user
- Create a database dedicated to this Zen Cart store.
- Create a separate database user with a long, unique password.
- Grant that user the permissions required for the Zen Cart database, rather than using the server’s global administrator account.
- Record the database name, username, password, host name, and port exactly as displayed by the VPS provider. A database host may be
localhost, a private address, or a managed-database endpoint.
Do not preload tables or import sample data unless you know the release expects it. During installation, Zen Cart can create its schema and can optionally load demonstration data.
Download, verify and upload Zen Cart
- Download the official release archive. Use the project’s official download source and select the version whose requirements you confirmed. Avoid repackaged archives from unknown mirrors.
- Verify the published hash. The project’s installation instructions tell operators to check the published MD5 or SHA1 value. Compare the hash of your downloaded archive with the value published for that exact release; a mismatch means you should discard the file and download it again.
- Extract locally or on the VPS. Unzip the verified archive. The extracted directory may contain a top-level folder; upload the contents inside it, not an extra nested directory, unless you deliberately want the store below a subpath.
- Upload every extracted file. The official instructions state that everything inside the unzipped folder belongs on the web server, for example in
public_html,www, orhtml. Preserve directory names and hidden files, including.htaccessfiles when using Apache.
If the store should open at https://example.invalid/, the Zen Cart files belong directly in that virtual host’s document root. If it should open at https://example.invalid/shop/, upload them into the shop subdirectory and use that path consistently when the installer asks for the catalog URL.
Prepare configuration files and writable directories
Zen Cart ships a distribution configuration file that must be converted for the installation. In the extracted files, rename includes/dist-configure.php to includes/configure.php. The repository instructions also require the installer to be able to write this file temporarily.
Rank #3
- Rename
includes/dist-configure.phptoconfigure.php. - Make
includes/configure.phpwritable by the web server for the duration of setup. - Make the
cacheandlogsdirectories writable by the web server account. - Leave other directories at restrictive permissions unless the pre-flight screen specifically reports that one needs attention.
- Check ownership as well as mode bits. A file set to writable but owned by the wrong account can still produce a permission error.
The detailed installation guide lists additional directories when a particular release needs them. Follow the installer’s red and warning indicators rather than making the entire document root world-writable.
Run the browser installer
- Open the store URL. Browse to the domain or subdirectory where you uploaded Zen Cart. A new installation should redirect to the installer.
- Resolve every red pre-flight error. The pre-flight page checks PHP version, extensions, writable paths, and related requirements. Do not continue while a red error remains. Warnings may be informational, but read each one before proceeding.
- Complete system setup. Enter the server and path settings requested by the installer. Choose the SSL option to match the URL you will use. If the certificate is already installed, use the HTTPS catalog and administration URLs rather than planning to switch later.
- Enter database settings. Supply the database host, port if nonstandard, database name, user, and password created earlier. A connection failure is usually caused by a typo, a wrong host value, a blocked database service, or a user lacking privileges.
- Choose demonstration data. Select demo products only if you want sample catalog content. For a production store, start with the clean schema unless you intentionally need the examples.
- Create administrator credentials. Use a unique administrator name and a long password that is not reused elsewhere. Save the credentials in a password manager.
- Save and test both interfaces. Confirm that the catalog loads and that the administration URL accepts the new credentials. Complete this test before changing permissions, because you need to know whether a later hardening change caused a problem.
Common installer failures
- PHP version rejected: install a release-compatible PHP branch or select a Zen Cart version supported by the PHP already available on the VPS.
- Missing extension: install the named extension, restart the PHP handler or web server as required by your distribution, and reload the pre-flight page.
- Configuration file not writable: check ownership, temporary mode bits, and whether PHP runs under a different account than the file owner.
- Database connection refused: verify host, port, credentials, service status, and firewall rules; then test again without changing unrelated settings.
- Blank page or server error: inspect the web-server and PHP error logs, confirm the PHP handler is active for the virtual host, and verify that all archive files uploaded correctly.
Harden the installation immediately
Manual installation is the official recommendation because it lets you build a secure, optimized, current system. Treat the following work as part of installation, not as optional cleanup.
Lock the generated configuration files
After the installer has written its settings, change permissions on both includes/configure.php and admin/includes/configure.php. The installation guide lists 644 or 444 depending on the server. Use the most restrictive value that still allows the application to run; verify the catalog and administration pages afterward.
Remove the installer
Delete the entire /zc_install directory from the web root once setup succeeds. Leaving it available can expose installation functions or allow someone to re-run setup.
Secure administration
- Change the administrator password immediately if it was temporary or shared during setup.
- Use a long, unique password and store it outside the server.
- Restrict administrative access at the network or web-server layer when your operating environment permits it.
- Review current Zen Cart security recommendations and apply updates compatible with your release and plugins.
Enable HTTPS everywhere
Zen Cart’s documentation says stores should always use HTTPS with an SSL certificate. Install a certificate for every hostname customers and administrators will use, set the installer’s secure URLs correctly, and redirect plain HTTP traffic to HTTPS at the web-server layer. Test login, checkout, image loading, and any payment callback after the redirect is enabled.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Review PHP exposure
Keep allow_url_include off. Disable passthru, system, and shell_exec for the core unless a specific, trusted plugin genuinely requires them. If you enable one for an extension, document why and limit access to the smallest practical scope.
Nginx-specific security work
With Apache, Zen Cart’s distributed .htaccess files can enforce protections when AllowOverride is configured correctly. Nginx does not read those files, so an apparently working store can still expose directories or files that Apache would block.
- Translate the release’s Apache protection requirements into Nginx server rules before going live.
- Explicitly deny web access to configuration, logs, cache, and other private directories identified by the Zen Cart documentation.
- Prevent direct execution or download of files that should only be processed internally.
- Reload Nginx and test protected paths from a separate browser session. A protected path should return a denial or a controlled not-found response, not directory contents.
If you are unfamiliar with Nginx location precedence, Apache is the safer first choice for this application because its default protection model is documented alongside the distribution.
Best Value
Backups, updates and operational checks
A VPS gives control, but it also leaves patching and recovery to you unless your provider manages those tasks. Before accepting orders, establish:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Scheduled database backups with a tested restore procedure.
- File backups that include product images, uploaded media, plugins, and both generated configuration files.
- Operating-system, PHP, web-server, and database security updates compatible with your Zen Cart branch.
- Monitoring for disk space, memory pressure, failed services, certificate expiry, and repeated authentication failures.
- A written record of the PHP branch, database version, enabled extensions, document root, administrator URL, and any non-default security rule.
Take a backup before changing Zen Cart core files, PHP versions, database engines, or plugins. Test a restore on a separate location instead of assuming that a successful backup job is usable.
How to evaluate a Zen Cart-compatible VPS
There is no single VPS specification that fits every catalog. Compare offers against the requirements and responsibilities that affect this installation:
Quick Recap
| Evaluation axis | What to confirm |
|---|---|
| Runtime support | The provider offers the PHP branch and extensions required by your chosen Zen Cart release. |
| Database choices | MySQL or MariaDB versions fall within the release’s supported range, with a practical backup and restore method. |
| Web-server control | You can configure Apache 2.4 or Nginx, virtual hosts, rewrites, HTTPS, and directory protections. |
| HTTPS automation | The service can issue, install, renew, and monitor an SSL certificate for every store hostname. |
| Resources | RAM and storage leave headroom above PHP’s 128 MB minimum memory setting and the database, media, logs, backups, and operating system. |
| Administration | You receive the root or administrative access needed to patch packages, change PHP settings, and inspect logs. |
| Security responsibility | The contract makes clear who handles firewall rules, operating-system patches, database backups, and incident response. |
| Application support | Support staff understand PHP, MySQL/MariaDB, Apache or Nginx, and Zen Cart rather than offering only generic VPS assistance. |
Final launch checklist
- The VPS runs a Linux release and PHP/database versions supported by the exact Zen Cart branch.
- All required PHP extensions are enabled, with
memory_limitat least 128 MB. - The domain resolves to the VPS and the virtual host points to the correct document root.
- The official archive was hash-verified before upload.
includes/configure.phpwas created fromdist-configure.php, and required writable directories work.- The pre-flight page shows no red errors.
- The catalog and administration area both load using the intended HTTPS URLs.
- Database credentials use a dedicated account, not a global administrator account.
- Both generated configuration files have been restricted to 644 or 444 as appropriate for the server.
zc_installhas been deleted.- The administrator password is unique and stored securely.
- Apache
.htaccessrules are active, or equivalent Nginx rules have been implemented and tested. - Backups, patching, certificate renewal, and monitoring are documented.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
