Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →To self-host phpList, rent a VPS with a PHP-capable web server, a MySQL-compatible database, enough storage for the application and subscriber data, and a domain that resolves to the server. Install the web stack, upload phpList’s lists directory, create a dedicated database and user, enter those credentials in lists/config/config.php, initialize the database at /lists/admin, configure an external SMTP server, and turn off phpList’s default test mode before sending to real subscribers.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The software is straightforward to deploy, but operating it is not a “set and forget” task. You are responsible for Linux updates, PHP and database compatibility, administrator access, backups, bounce processing, firewall rules, and email reputation. This guide lays out the installation sequence, the settings that matter, hardening steps, troubleshooting checks, and the point at which a managed installation is the better choice.
As an Amazon Associate I earn from qualifying purchases.
What a phpList VPS installation needs
A VPS is only the server rental. phpList still needs a complete application environment and a reachable address. Confirm these requirements before uploading any files.
Core server components
- Operating system: use a supported Linux image and check the phpList release documentation for the exact PHP and database versions it supports. Compatibility can change between releases.
- Web server and PHP: install a PHP-capable web server and the PHP extensions required by the selected phpList release.
- Database: provide a MySQL-compatible database. Create a separate database and database user for phpList rather than sharing credentials with another application.
- Storage: reserve disk space for the application, configuration, logs, subscriber data, queued messages, and backups. The right amount depends on list size and retention, so measure growth rather than choosing a figure blindly.
- Domain and HTTPS: point a domain or subdomain at the VPS and terminate HTTPS at the web server or a reverse proxy before inviting administrators or subscribers to use the site.
- Administration access: keep SSH or another administration path available, but do not expose services you do not use.
Network and DNS checks
Before installation, verify that the domain resolves to the VPS and that the web server can answer requests for it. Decide which ports are needed for HTTP, HTTPS, SSH, and any provider-specific administration service. The firewall should allow only those services. Outbound SMTP access may also be restricted by some VPS providers, so confirm that your chosen mail relay is reachable before production sending.
#1 Best Overall
Plan the deployment before touching phpList
Write down the values you will need during setup: the domain, document root, database host, database name, database username, database password, SMTP host, SMTP username, SMTP password, SMTP port, and TLS mode. Use a password manager for secrets; do not put credentials in shell history or share them in support tickets.
Download the phpList release you intend to run from its official distribution channel and read that release’s manual first. The installation flow below is the documented manual process, while package names, PHP modules, and command-line options can vary by release.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Step 1: Provision and prepare the VPS
Install the web stack
Choose a supported Linux image, then install the web server, the compatible PHP runtime and extensions, and a MySQL-compatible database server or a database service reachable from the VPS. Keep the database on the same machine only when that fits your backup and scaling plan; a separate database host changes the database host value you will enter later.
Enable HTTPS before exposing the administration interface. The certificate and web-server configuration are outside phpList itself, but an unencrypted administrator login can compromise every list and credential on the installation.
Apply the first security controls
- Apply current operating-system and web-stack security updates.
- Create an unprivileged deployment or administration account and use root only for tasks that require it.
- Set a firewall policy that permits only necessary services and ports.
- Record where web-server logs, PHP logs, database backups, and phpList files will live.
Step 2: Download and place phpList
The manual installation starts by downloading phpList, unzipping it, and uploading the lists folder to the web root. On a VPS, SSH, SCP, or an equivalent deployment method is preferable to FTP because it avoids leaving an additional file-transfer service exposed.
- Download the release archive on a trusted workstation or directly on the VPS.
- Verify that the archive is complete, then unpack it into a temporary directory.
- Place the resulting
listsdirectory under the virtual host’s document root. - Set ownership and permissions so the web-server account can read the application and write only to directories that phpList explicitly needs.
- Open the site over HTTPS and confirm that the expected phpList files are present before continuing.
Do not make the entire document root writable by the web-server account. Broad write access turns a vulnerable plugin, upload path, or stolen credential into a much larger compromise.
Step 3: Create a dedicated database and user
Create a database, a database user, and a strong password specifically for this phpList installation. The resulting database name, username, password, and host are the values phpList needs in its configuration.
Grant the account only the permissions required by the application on its own database. Keep the database password out of public repositories and outside downloadable backups. If the database is on another host, allow connections only from the VPS address and use the provider’s recommended encrypted connection method.
Step 4: Edit lists/config/config.php
Open lists/config/config.php in a plain-text editor. Enter the database connection values supplied by your database server:
// Set these to the values created for this installation
$database_host = 'database-host';
$database_name = 'database-name';
$database_user = 'database-user';
$database_password = 'use-a-long-unique-password';The exact variable names and surrounding file structure belong to the phpList release you downloaded, so edit the existing settings rather than replacing the file with a snippet from another version. The manual notes that localhost or 127.0.0.1 may work for a local database, but the correct host is provider-specific.
Free tools Windows power users keep installed
One-click scans. No signup required.
Save the file without changing its encoding or adding stray characters. A single typo, trailing space, wrong quote, or incorrect host can prevent the installer from connecting.
Step 5: Initialize phpList’s database
- Browse to
/lists/adminon the HTTPS domain. - Choose the option to initialize or create the phpList database tables.
- Complete the form using the database values from
config.php. - Continue through the setup screens until the administrator interface loads.
- Change the initial administrator password immediately and store the new credential securely.
For phpList versions after 3.6.6, the manual also documents command-line database initialization. Use the command and options documented for your exact release rather than copying a command from an older installation. Command-line setup is useful for scripted deployments, but it does not remove the need to secure the web interface.
Step 6: Configure SMTP for reliable delivery
phpList can call PHP’s built-in mail() function, but the manual says an external mail server is often needed or preferred. A dedicated SMTP relay gives you explicit authentication, encryption, sending limits, and delivery records instead of relying on whatever local mail service happens to be installed on the VPS.
SMTP settings to collect
| Setting | What to enter | Important qualification |
|---|---|---|
| SMTP host | The hostname supplied by your mail provider | Use the provider’s current hostname; do not assume it matches your website domain. |
| SMTP username | The account or mailbox authorized to relay | Some services use a generated credential rather than a mailbox password. |
| SMTP password | The relay credential | Store it as a secret and rotate it if exposed. |
| Port | 587 for the manual’s STARTTLS example |
Your provider may require a different port; follow its current documentation. |
| TLS mode | tls for standard STARTTLS in the example |
Match the provider’s encryption mode and certificate requirements. |
Enter the mail configuration
Set phpList’s PHPMAILERHOST, SMTP credentials, PHPMAILERPORT, and PHPMAILER_SECURE values in the configuration area documented for your release. The standard STARTTLS example uses port 587 and PHPMAILER_SECURE set to tls.
Send a controlled test to an address you own before importing a large list. Confirm that the message arrives, that the From and Reply-To identities are correct, and that the relay accepts the connection without certificate warnings.
Do not disable TLS verification casually
Some setup examples show how to turn off certificate peer and name verification for a self-signed certificate. That weakens TLS authentication and can allow an attacker to impersonate the SMTP server. Leave verification enabled unless you have a controlled, documented reason to use a private certificate authority and understand the trust implications.
Step 7: Turn off phpList test mode
New installations have test mode enabled. In the configuration file, change:
define("TEST",1);to:
define("TEST",0);Do this before real sending. While test mode remains enabled, messages are not sent to subscribers and subscribers cannot complete the confirmation process because confirmation emails are not delivered. Treat the setting as a production-release checkpoint: verify your SMTP test first, review the list and consent data, then change the value and send to a small, controlled segment.
Step 8: Harden the application and VPS
Protect the administration area
- Keep phpList’s supplied
.htaccessprotections active unless your web server requires an equivalent configuration. - Add an additional password layer to the admin directory where practical.
- Use HTTPS for every administrative session.
- Change the default administrator password immediately.
- Remove unused administrator accounts and review permissions regularly.
Limit process privileges
Run the web server with an account that has no unnecessary write permissions. Keep register_globals off, as recommended by phpList’s security guidance. Make only the directories that require runtime writes writable, and review those permissions after upgrades.
Restrict the firewall
Allow only the web ports, the administration path you actually use, and other services required by your architecture. Do not expose the database port publicly when the database is local. Restrict SSH by key-based access and, where your environment permits, by source network.
Back up what you would need to rebuild
A usable backup includes the database, lists/config/config.php, uploaded assets, and the deployment notes needed to recreate the web server and PHP environment. Test a restore on a separate system; a file copy that has never been restored is not a proven backup.
Recommended Free Tools
Step 9: Schedule sending and maintenance
For recurring campaigns, use phpList’s cron or command-line sending workflow so queued messages are processed predictably rather than relying on a browser tab. The exact command and supported runtime are version-specific; copy them from the manual for the release you installed.
Monitor queue growth, SMTP responses, bounces, complaint signals, and disk usage. Keep the operating system, PHP, web server, database, and phpList updated on a planned schedule. Read upgrade notes before changing PHP or the database engine, because a runtime change can expose deprecated modules or configuration directives.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshooting common installation failures
“Cannot connect to database” or an empty installer
- Recheck the host, database name, username, and password in
config.php. - Confirm that the database user is allowed to connect from the web server’s host.
- Check for stray spaces, invisible characters, or mismatched quotation marks; the manual warns that even stray spaces can break the connection.
- Test the credentials with the database client from the VPS, not only from a local computer.
MySQL errors after a PHP upgrade
Newer PHP environments may require the mysqli.inc database module instead of the deprecated mysql.inc module. Check the phpList release requirements and installed PHP extensions, then select the module supported by that release. Do not enable a deprecated module merely to silence an error without checking compatibility.
HTTP 500 after enabling the site
A web-server 500 error can result from unsupported .htaccess directives, including php_value settings. Review the web-server error log, then remove or comment out the problematic directive as the official troubleshooting guidance recommends. Preserve the security behavior with an equivalent server-level setting where possible.
SMTP connection or TLS failure
- Confirm the SMTP hostname and port from the relay provider.
- Check that outbound connections to the selected port are permitted by the VPS firewall and provider.
- Verify the username and password independently.
- Match
PHPMAILER_SECUREto the relay’s expected mode; the documented STARTTLS example usestlson port587. - Fix certificate trust rather than disabling peer or name verification.
Subscribers cannot confirm their subscriptions
First check whether test mode is still enabled. With define("TEST",1), confirmation mail is not sent. If test mode is off, inspect the SMTP result, relay logs, bounce mailbox, and the subscriber’s spam quarantine.
REST API will not work
The documentation requires PHP 7 for the REST API and, on Apache, .htaccess support plus mod_rewrite. Enabling the API also requires configuration changes and clearing the cache directory. Treat API enablement as a separate change: verify the runtime, web-server overrides, rewrite rules, and cache state before debugging application code.
Self-hosted phpList versus phpList Hosted
Self-hosting gives you control over the server, configuration, database, update timing, and custom integrations. It also makes you the operator responsible for Linux and PHP patching, database backups, admin security, bounce handling, SMTP configuration, blacklist monitoring, and sender reputation.
| Decision factor | Self-hosted on a VPS | phpList Hosted |
|---|---|---|
| Operational responsibility | You provision and maintain the web server, PHP runtime, database, backups, and security controls. | The service provider manages the underlying installation and server operations. |
| Control and customization | Direct access to files, configuration, database, scheduling, and network policies. | Convenience in exchange for the limits and settings of the managed service. |
| Email deliverability work | You choose the SMTP relay, process bounces, protect credentials, and build sender reputation. | The managed offering is intended to reduce server, blacklist, bounce, and deliverability work. |
| Recurring cost | VPS, backups, SMTP, domain, and your administration time. | A recurring service fee instead of direct server maintenance. |
phpList is open-source software published under the AGPLv3 license. Choose a VPS when you can maintain Linux, PHP, database backups, security updates, and sending reputation. Choose the hosted option when reducing operational work is worth its service fee and the managed environment’s limits fit your needs.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Production readiness checklist
- Supported Linux, PHP, database, and phpList versions confirmed.
- Domain resolves correctly and HTTPS works.
- Firewall exposes only necessary services.
- Dedicated database, user, and strong password created.
config.phpcontains the correct host, name, user, and password with no stray characters.- Database initialized successfully.
- Administrator password changed and admin directory protected.
- SMTP host, credentials, port, and TLS tested with a real message to a controlled address.
define("TEST",0)set only after the test and consent checks are complete.- Backups include the database, configuration, and assets, and a restore has been tested.
- Cron or command-line sending follows the exact instructions for the installed release.
- Bounce monitoring, queue monitoring, updates, and reputation checks have an owner.
Bottom line
Self-hosting phpList on a VPS is a practical choice when you want control and can operate a small web application securely. Follow the sequence—supported stack, uploaded lists directory, dedicated database, edited configuration, database initialization, authenticated SMTP, disabled test mode, and hardened server—then keep maintenance and deliverability on your regular operations calendar. If those responsibilities are the part you are trying to avoid, a managed phpList installation is the more predictable option.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
