iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
To self-host phpList, provision a VPS with a PHP-capable web server and MySQL-compatible database, publish the required lists directory behind HTTPS, create a dedicated database, configure lists/config/config.php, initialize the application at /lists/admin, connect a reliable SMTP server, and disable test mode before sending to real subscribers. You also become responsible for server patching, backups, bounce processing, and deliverability.
What self-hosting phpList involves
phpList is open-source software released under the AGPLv3 license. A self-hosted installation runs on infrastructure that you administer rather than on a managed phpList service. The application needs four things from that infrastructure: a web server that can execute a compatible PHP release, a MySQL-compatible database, persistent storage for the application and its data, and a domain name or other reachable URL.
The exact PHP, database, and web-server compatibility depends on the phpList release you select. Check that release’s manual before provisioning the VPS; do not assume that a version that worked on an older server will work unchanged on a current PHP installation.
Choose the VPS before installing anything
Minimum platform components
| Component | What it must provide | Decisions to make |
|---|---|---|
| Operating system | A supported Linux image that you can patch and administer. | Choose a distribution supported by your VPS provider and compatible with the PHP version required by your phpList release. |
| Web server | HTTP and HTTPS service with PHP integration. | Use the web server you can secure and maintain; confirm that required rewrite and directory-protection features are available. |
| PHP | A release and extensions supported by the selected phpList version. | Verify compatibility before installing. An upgrade of PHP can expose deprecated database modules or configuration directives. |
| Database | MySQL or a compatible server, with a separate database and login for phpList. | Use a dedicated database account with only the permissions the application needs. |
| Storage | Space for application files, configuration, logs, queued messages, subscriber data, and backups. | Allow headroom for growth and for temporary files during upgrades and exports. |
| Network access | A stable public address or hostname, HTTPS termination, and administrative access such as SSH. | Point a domain or subdomain at the VPS and decide how you will restrict administrative access. |
Check email policy first
Many VPS providers restrict outbound mail on port 25 or require a support request before permitting it. For production, plan to use an external SMTP server unless you have a specific reason to operate your own mail transport. Confirm the relay’s authentication, TLS, sending limits, abuse policy, and geographic or regulatory requirements before committing to it.
Prepare DNS and HTTPS
Create the DNS record for the hostname that will serve phpList and wait for it to resolve to the VPS. Put the site behind a valid HTTPS certificate before exposing the administrator interface or collecting subscriber information. Redirect plain HTTP to HTTPS and make sure the certificate renewal process is automated or documented.
Provision and lock down the VPS
- Deploy the supported Linux image and create an administrative account that is not used for routine web-server work.
- Apply operating-system updates before installing phpList. Enable automatic security updates when they fit your maintenance policy.
- Install the web server, a compatible PHP runtime and required extensions, and a MySQL-compatible database server. Use the phpList release manual to confirm the supported versions and modules.
- Configure the virtual host for the phpList hostname, set the document root you will use for the application, and enable HTTPS.
- Configure the VPS firewall to expose only the services you actually need. Normally that means HTTPS, optionally HTTP for certificate redirects, and a restricted administration path for SSH or an equivalent management service. Do not leave database ports publicly reachable unless there is a documented, secured reason.
- Set the server time zone and time synchronization correctly. Consistent time is important for scheduled sends, logs, TLS validation, and audit trails.
Keep database and operating-system administration separate from the web-server account. The web process should not have broad write access to the whole filesystem, and it should not run with unnecessary privileges.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Download phpList and publish the files
The manual deployment sequence starts with downloading phpList, unzipping the archive, and uploading the lists directory to the web root. On a VPS, use SSH, SCP, a deployment system, or another authenticated transfer method instead of relying on an unauthenticated FTP workflow.
- Download the release archive from the official phpList distribution channel that corresponds to the version you intend to run.
- Verify the archive before extracting it if the project publishes a checksum or signature for that release.
- Unpack the archive in a staging location, then place the complete
listsdirectory under the virtual host’s document root. - Set ownership so the web-server account can read the application and write only to directories that phpList explicitly needs to write. Do not make the entire document root world-writable.
- Leave the project’s
.htaccessfiles active when using Apache. They provide important directory protections; disabling them without replacing their rules can expose configuration or data files.
Record the release number and the filesystem location. You will need both when applying updates or diagnosing a PHP compatibility problem.
Create a dedicated database and account
Create a new database solely for this phpList installation, a separate database user, and a long unique password. Use the database server’s local administrative interface or a secured control panel; do not send the password through email or place it in shell history unnecessarily.
Write down the four values phpList will need:
- Database host name. This may be
localhost,127.0.0.1, or a provider-specific hostname. - Database name.
- Database user name.
- Database password.
Grant the account the permissions required by the phpList schema and application. If your provider separates database and web servers, allow connections only from the web server’s private address and protect the database connection with the provider’s recommended TLS or network controls.
Recommended Free Tools
Configure lists/config/config.php
Open lists/config/config.php in a plain-text editor. Set the database host, database name, database user, and database password to the values created in the previous step. Use the host supplied by your provider; although localhost or 127.0.0.1 commonly works on a single VPS, neither is universal.
Check the file for accidental spaces, quotation changes, or invisible characters. The phpList manual notes that even stray spaces can cause a database connection failure. Keep the file readable by the application but inaccessible to untrusted users, and never commit it to a public source repository because it contains credentials.
Keep a protected copy of the original configuration outside the web root. That copy is useful when upgrading or rebuilding the VPS, but it must be stored with the same care as a database password.
Initialize the phpList database
Browser-based initialization
- Open the installation’s
/lists/adminpath over HTTPS. - Select the option to initialize or create the database when phpList presents the setup screen.
- Complete the requested form fields and allow phpList to create its tables.
- Continue through the remaining setup screens and confirm that the administrator interface loads without database errors.
Use the administrator URL only during setup if possible, and restrict access by IP, VPN, an additional web-server password, or another control that fits your organization.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchCommand-line initialization
phpList documentation also describes command-line initialization for versions after 3.6.6. The command and arguments are version-specific, so use the procedure in the manual for the exact release you installed rather than copying a command from an unrelated version. Run it as the appropriate application or web-server user and verify the resulting schema before opening the admin interface.
Configure SMTP instead of relying on local mail
phpList can call PHP’s built-in mail() function, but an external SMTP server is often required or preferred for dependable production delivery. A relay gives you authenticated submission, encrypted transport, clearer rejection messages, and a reputation-management process that is separate from the VPS’s IP address.
Values to obtain from the SMTP provider
| Setting | Purpose |
|---|---|
| SMTP host | The relay’s server name. |
| SMTP username | The account or token used to authenticate. |
| SMTP password or token | The secret paired with the username; store it as carefully as the database password. |
| Port | The submission port. The phpList manual’s STARTTLS example uses 587. |
| TLS mode | Use the provider’s required encryption mode. Standard STARTTLS is represented by tls in the documented example. |
| Envelope and From policy | The addresses and domains the relay permits, including any required domain verification. |
Enter the transport settings
In phpList’s mail configuration, set PHPMAILERHOST to the relay host, provide the SMTP credentials, set PHPMAILERPORT to the provider’s submission port, and set PHPMAILER_SECURE to tls when using STARTTLS as in the manual example. Match the relay’s authentication requirements exactly, including whether it expects a full email address as the username.
Do not casually copy examples that disable certificate peer or name verification. Turning off those checks weakens TLS authentication and should be considered only for a controlled, understood situation; the normal production configuration should validate the relay’s certificate.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Verify delivery with a small test
- Send a test message to an address you control on a different mail provider.
- Confirm that the message passes SPF, DKIM, and DMARC checks when those controls are configured for your sending domain.
- Inspect phpList’s send log and the SMTP provider’s event log for accepted, deferred, or rejected deliveries.
- Test an invalid recipient so you can confirm that bounces are reported and processed rather than silently accumulating.
Disable test mode before real sending
phpList enables test mode by default. In the configuration, change define("TEST",1) to define("TEST",0) before production sending. While test mode remains enabled, messages are not sent to subscribers and subscribers cannot complete confirmation because confirmation emails are not delivered.
Make this change only after SMTP testing is complete, then send a controlled campaign to internal addresses before importing or activating a large list. Keep a record of who approved the switch so an administrator does not accidentally re-enable or disable it during troubleshooting.
Secure the administrator interface and application
Security is part of the deployment, not a later cleanup task. Apply the protections recommended in phpList’s security guidance:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Keep the supplied
.htaccessprotections active where Apache is used, and test that sensitive files cannot be downloaded. - Add a second password layer to the administrator directory or restrict it by network, VPN, or IP allowlist.
- Change the initial phpList administrator password immediately. Use a unique password stored in an approved password manager.
- Run the web-server account with least privilege. It should not have unnecessary shell access, database administration rights, or write permission across the application tree.
- Ensure PHP’s
register_globalssetting is off where the runtime exposes it, as recommended by the project’s security documentation. - Restrict the firewall to necessary services and review the rules after every infrastructure change.
- Protect configuration backups, database dumps, SMTP credentials, and subscriber exports with encryption and access controls.
- Enable logging and keep enough history to investigate authentication events, failed sends, bounces, and configuration changes without retaining sensitive data longer than necessary.
Schedule queue processing and manage bounces
phpList queues messages and needs a repeatable sending workflow for newsletters and scheduled campaigns. Use phpList’s cron or command-line sending method rather than relying on an administrator to keep a browser tab open. The exact command and supported runtime can change between releases, so copy the procedure from the manual for your installed version and run it under the least-privileged account that can execute the application.
Start with a conservative batch size and interval. Watch CPU, memory, database load, SMTP responses, and the provider’s rate limits before increasing throughput. A queue that is technically fast enough can still harm deliverability if it triggers provider throttling or generates a high complaint rate.
Configure a return-path or bounce mailbox that your relay and domain support, then process bounces regularly. Remove or suppress repeatedly failing addresses, honor unsubscribe requests promptly, and investigate sudden increases in hard bounces or complaints. Deliverability is an ongoing operational responsibility when you self-host; installing phpList does not create a sending reputation for you.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Backups, updates, and recovery
What to back up
- The phpList database, including subscriber, campaign, queue, and configuration data stored there.
- The application files and any local customizations, especially
lists/config/config.php. - Uploaded assets, templates, attachments, and logs that your retention policy requires.
- Infrastructure definitions and DNS or certificate configuration needed to rebuild the service.
Keep at least one backup off the VPS, encrypt it, restrict access, and test a restore on a separate environment. A backup that has never been restored is only an assumption.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteUpdate safely
- Read the release notes and compatibility requirements for the target phpList version, PHP runtime, database server, and extensions.
- Take a verified database and file backup.
- Pause scheduled sending so a queue is not modified while files or schema are being replaced.
- Stage the new release, preserve the configuration, and follow the version-specific upgrade instructions.
- Run any required database upgrade, then test login, list management, confirmation, SMTP delivery, unsubscribe handling, and bounce processing.
- Resume the scheduler only after those checks succeed, and monitor logs closely during the first production run.
Troubleshoot the common installation failures
Database connection errors
Recheck the host, database name, user, and password in lists/config/config.php. Confirm that the database account is allowed to connect from the web server and that the database service is running. Remove stray spaces or invisible characters in the configuration; the manual specifically warns that they can break a connection.
MySQL module errors on a newer PHP system
Older phpList configurations may reference the deprecated mysql.inc module. On newer PHP environments, the supported database module may be mysqli.inc. Follow the instructions for your phpList release and installed PHP version rather than enabling an obsolete extension.
HTTP 500 after enabling the site
Inspect the web-server error log first. A 500 response can result from an unsupported .htaccess directive, including php_value directives that the chosen server or PHP integration does not permit. The official troubleshooting guidance recommends removing or commenting out the problematic directive, then reloading the configuration and testing again. Do not permanently remove all directory protections without replacing them with equivalent server rules.
SMTP authentication or TLS failures
- Verify the host, port, username, password or token, and encryption mode character for character.
- Confirm that the VPS can reach the relay port and that the provider has authorized the sending address or domain.
- Check the server clock; an incorrect clock can invalidate TLS certificates.
- Read both phpList’s log and the relay’s event log to distinguish a connection failure from an authentication rejection or a policy block.
- Do not solve certificate errors by globally disabling peer or hostname verification.
Subscribers cannot confirm
Check that test mode is disabled with define("TEST",0), that SMTP accepts messages, and that confirmation mail is not being rejected or quarantined. In test mode, phpList intentionally does not send confirmation messages to subscribers.
REST API does not work
The documented REST API requirements include PHP 7 and, for Apache, working .htaccess support and mod_rewrite. Enabling the API also requires configuration changes and clearing the cache directory. Verify those prerequisites for the installed release, clear the cache after changing the settings, and protect API credentials as carefully as administrator credentials.
Self-hosted phpList or phpList Hosted?
The choice is primarily about operational responsibility, not whether the application can send a campaign.
| Consideration | Self-hosted on a VPS | phpList Hosted |
|---|---|---|
| Server operations | You provision and patch Linux, PHP, the web server, the database, certificates, firewall, backups, and monitoring. | The managed service handles the underlying hosting operations described by the project. |
| Control and customization | You control the filesystem, deployment schedule, integrations, network rules, and configuration, subject to your technical ability. | You accept the service’s available settings and operating boundaries in exchange for less infrastructure work. |
| Email deliverability | You choose and configure SMTP, manage bounces, protect sending reputation, and respond to blocks or throttling. | The project overview presents the service as a way to avoid managing servers, blacklisting, bounces, and deliverability. |
| Cost model | You pay for the VPS, backups, SMTP or mail service, monitoring, and your own maintenance time. | You pay the managed-service fee instead of operating the complete stack yourself. |
| Best fit | Teams that can maintain Linux, PHP, databases, backups, security updates, and email reputation. | Teams that value reduced operations and accept a recurring service charge and the provider’s constraints. |
Choose the VPS route only if someone is accountable for patching, restore tests, bounce handling, and deliverability metrics. If that responsibility would otherwise be neglected, the managed option is safer even when the VPS appears cheaper on paper.
Quick Recap
Production readiness checklist
- Selected phpList release compatibility has been checked against the installed PHP, database, and web server.
- The hostname resolves correctly and HTTPS is valid and renewing.
- The
listsdirectory is deployed with least-privilege ownership and permissions. - A dedicated database and account are configured, and credentials are protected.
lists/config/config.phphas the correct host, database name, user, and password.- The database has been initialized through
/lists/adminor the documented command-line method for the installed release. - The administrator password and administrator-directory protection are in place.
- SMTP authentication, TLS, test delivery, rejection handling, and bounce processing have been verified.
- Test mode has been changed from
define("TEST",1)todefine("TEST",0). - Queue processing is scheduled with the version-appropriate cron or command-line workflow.
- Firewall rules expose only necessary services, and database access is not unnecessarily public.
- Backups cover the database, configuration, files, and rebuild information; a restore test has succeeded.
- Logs, resource usage, bounces, complaints, and delivery rates have an owner and review schedule.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
