Installing a self-hosted PHP CMS means preparing a server with a supported PHP version, a database and a web server, pointing a domain with HTTPS at it, running the installer, then hardening permissions and setting up tested backups. Exact version minimums change, so read the vendor's current requirements page first.
Installing a CMS you host yourself is not difficult, but it is more than uploading files. You are taking on the server, its software versions, security and backups, which a hosted product would otherwise handle. This guide describes the work in general terms and cites each project’s own documentation for version numbers. It is a description of what the vendors say, not a record of installs by Word & Press.
The cost guide shows what this work costs in time and money, and the licensing guide explains what you may do with the code once it is running.
What do I need before I start?
- A hosting plan or server where you can run PHP and a database
- A domain name you control, with access to its DNS settings
- A way to transfer files (SFTP or a Git deployment) and ideally shell access
- A mail setup so the CMS can send password resets and notifications
- A plan for backups before you put anything in the system
What are the server requirements?
Requirements are set by each project and change with every major release, so read the current page for the version you intend to install.
| CMS | PHP | Database | Web server | Source |
|---|---|---|---|---|
| Drupal 11 | 8.3 or later | MySQL 8.0+, MariaDB 10.6+, PostgreSQL 16+, SQLite 3.45+ | Apache 2.4.7+ or Nginx 1.1+; no IIS support from 11.0.0 | Drupal system requirements |
| Joomla 6.x | 8.3.0 minimum, 8.4 recommended | MySQL 8.0.13+, MariaDB 10.4+, PostgreSQL 12.0+ | Apache 2.4, Nginx, IIS 10 | Joomla manual |
| WordPress | 8.3 or greater recommended | MariaDB 10.11+ or MySQL 8.0+ | Apache or Nginx | WordPress requirements page |
Notice that the minimums differ and that “supported” is not the same as “recommended”. Drupal 10, for instance, still requires at least PHP 8.1 according to the Drupal page. WordPress says older PHP and MySQL versions technically work but have reached end of life and may expose a site to security vulnerabilities. Pick a version the project lists as supported from the start.
PHP extensions matter too. Drupal core needs the PDO extension with a database connector, the XML extension, an image library such as GD, and JSON, with mbstring needed for multilingual sites and OpenSSL recommended. Joomla lists json, simplexml, dom, zlib and gd among its required modules. A host that disables these will fail the installer, so check before you buy.
How do I set up the domain and SSL?
Point the domain’s DNS at the server, then obtain a TLS certificate so the site runs over HTTPS. Many hosts issue certificates automatically; on your own server a free certificate authority and an automatic renewal tool are the usual route. Redirect the plain HTTP address to HTTPS and choose one canonical hostname, with or without “www”, so search engines see a single address. Do this before installation, because the CMS often stores the site address in its configuration.
What are the general installation steps?
The details differ, but most PHP systems follow the same outline.
- Download the release from the project’s own site or repository, not a third-party mirror.
- Create a database and a dedicated database user with only the privileges that site needs. WordPress’s guide describes creating a database and a MySQL or MariaDB user with all privileges for it.
- Upload or build the files. Some systems are a zip file you upload. Drupal’s documentation says the required PHP libraries must be installed with Composer after updating the codebase, so it is usually set up from the command line or built locally.
- Set file permissions so the web server can write only where it must, such as the uploads directory.
- Run the installer in the browser. WordPress’s guide lists running the installation script as the final step, after the files are in place and the database details are ready.
- Create the administrator account with a unique, long password and a real email address.
- Remove or lock installer files if the system leaves them behind.
- Test: log in over HTTPS, publish a draft, upload an image, send a test email.
How do I harden a new installation?
WordPress’s hardening guide offers advice that applies to any PHP CMS. Keep the software up to date, because older versions are not maintained with security updates. Limit which accounts can write to files, so a compromised web process cannot alter the core code. Move or protect the configuration file that contains database credentials. Require HTTPS for administration. And back up the database and the installation regularly.
Beyond that, apply common sense measures: use unique admin usernames, enable two-factor sign-in where the system supports it, give editors the lowest role that lets them work, delete unused themes and plugins, and take extensions only from sources you trust. Subscribe to the project’s security announcements so you hear about fixes quickly.
What backups do I need?
Back up both parts of the site: the database, which holds articles, users and settings, and the files, which hold uploads and any customised themes. Keep copies off the server, in a different account or location, and keep more than one generation. Then test a restore on a spare site. A news archive is your most valuable asset and the hardest to rebuild.
If you want to practise before touching a live domain, our guide to trialling a CMS describes a local or test-server approach. Use the feature checklist to decide whether the system is worth hosting yourself, and see the self-hosted section for further guides.
Questions people ask
Which PHP version should I install a CMS on?
Use the newest version your chosen CMS supports and recommends. Drupal 11 supports PHP 8.3 and later, Joomla 6 lists 8.3.0 as its minimum and 8.4 as recommended, and WordPress recommends 8.3 or greater, according to each project's documentation. Check the current page, since these move.
Do I need root access to install a CMS?
Not always. Shared hosting with file access and a database lets you install most PHP systems. Systems installed with Composer, such as Drupal, need command-line access or a local build that you upload. A virtual server with root gives full control but makes you responsible for patching.
Do I need HTTPS from the start?
Yes. The login form and admin area handle passwords and session cookies, and WordPress's hardening guide recommends requiring HTTPS for administration. Most hosts issue certificates automatically, so set it up before the first login.
How often should I back up a CMS?
At least as often as you publish content you cannot recreate. A news site updated daily needs daily database backups at minimum, stored away from the server, and a restore test every few months. A backup you have never restored is an assumption.
What is the difference between installing and deploying?
Installing sets up the software on a server. Deploying is the repeatable process of moving changes, such as a theme or configuration, from a test site to the live one. Publishers who outgrow a one-off install usually add a staging site and version control.
Sources
- Drupal 11 core requires PHP 8.3 or later, and Drupal 10.5 requires PHP 8.1 or later, according to the version constraints in Drupal core's composer.json. — source, checked 10 October 2026.
- Drupal core requires the PHP PDO extension with a database connector, the XML extension, an image library such as GD, and JSON; mbstring is required for multilingual sites and OpenSSL is recommended. — source, checked 10 October 2026.
- Drupal 11 database requirements are MySQL 8.0+, MariaDB 10.6+, PostgreSQL 16+ (with the pg_trgm extension) and SQLite 3.45+. — source, checked 10 October 2026.
- Drupal requires Apache 2.4.7 or greater or Nginx 1.1 or greater; clean URLs depend on Apache mod_rewrite, and as of Drupal 11.0.0 Drupal does not support Microsoft IIS. — source, checked 10 October 2026.
- Drupal's installation documentation says that after updating the codebase, the required PHP libraries must be installed with Composer. — source, checked 10 October 2026.
- The Joomla manual's technical requirements for Joomla 6.x list PHP 8.3.0 as minimum and 8.4 as recommended, MySQL 8.0.13 minimum, MariaDB 10.4 minimum, PostgreSQL 12.0 minimum, Apache 2.4, Nginx and IIS 10 as supported web servers, and the PHP modules json, simplexml, dom, zlib and gd. — source, checked 10 October 2026.
- WordPress recommends PHP 8.3 or greater, MariaDB 10.11 or greater or MySQL 8.0 or greater, Apache or Nginx, and HTTPS support, and notes PHP 7.4+ and MySQL 5.5.5+ still work but have reached end of life. — source, checked 10 October 2026.
- WordPress's installation guide lists the steps as download and unzip, create a database and a MySQL or MariaDB user with all privileges, optionally configure wp-config.php, upload the files, and run the installation script in a browser. — source, checked 10 October 2026.
- WordPress's hardening guide advises keeping up to date with the latest version, restricting file ownership and write permissions, moving wp-config.php above the web root, backing up the database and installation regularly, and requiring HTTPS for administration. — source, checked 10 October 2026.