Free tools Windows power users keep installed
One-click scans. No signup required.
To self-host phpList, provision a VPS with a PHP-capable web server, a MySQL-compatible database, storage for the application, and a domain that resolves to the server. Upload phpList’s lists directory, create a dedicated database and user, enter those credentials in lists/config/config.php, initialize the database at /lists/admin, configure an external SMTP server, and turn off phpList’s default test mode before sending to real subscribers.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The software is open source, but the VPS is not a hands-off mail service. You remain responsible for operating-system updates, PHP and database security, backups, bounce processing, queue scheduling, and email deliverability. The procedure below separates installation from the production checks that prevent a working demo from becoming an unsafe or undeliverable mailing system.
As an Amazon Associate I earn from qualifying purchases.
What a phpList VPS must provide
phpList is a web application, so the server needs more than disk space and an IP address. The basic stack is a web server that can execute PHP, a MySQL-compatible database, persistent storage for the application and its data, and a reachable hostname. Check the compatibility requirements for the specific phpList release you select; PHP and database support can change between releases.
| Component | Requirement | Practical decision |
|---|---|---|
| Operating system | A supported Linux image or another platform supported by your chosen release | Use a current, maintained image and keep its security updates enabled. |
| Web server | A PHP-capable web server serving the phpList files over HTTPS | Terminate HTTPS at the web server or at a trusted reverse proxy. |
| PHP | A version compatible with the selected phpList release | Confirm the release-specific requirement before installing or upgrading PHP. |
| Database | MySQL or a compatible implementation | Create a separate database and account instead of reusing an application-wide administrator account. |
| Storage | Space for the lists directory, configuration, logs, subscriber data, and backups |
Leave headroom for message queues and database growth. |
| Network | A DNS name that reaches the VPS and outbound connectivity to your mail relay | Do not expose the database publicly unless your architecture specifically requires it. |
| Administration | SSH or an equivalent deployment and maintenance path | Restrict administrative access through the VPS firewall and strong authentication. |
Plan the deployment before installing
Choose the hostname and HTTPS arrangement
Point a dedicated hostname or subdomain at the VPS before opening the installer. Decide whether the web server will terminate TLS directly or whether a reverse proxy will do so. The administration area and subscriber forms should not be operated over plain HTTP. Test that the hostname resolves correctly from outside the VPS and that the certificate covers the exact name people will use.
#1 Best Overall
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
Confirm release compatibility
Download a phpList release that matches the PHP and database versions you can maintain. Do not assume that a configuration written for an older release is valid on a newer one. The project documentation also describes command-line database initialization for versions after 3.6.6, while the browser-based initializer remains the straightforward path when available.
Decide how mail will leave the server
phpList can call PHP’s built-in mail() function, but an external SMTP server is commonly needed or preferred for production. Select the relay before installation so you know its hostname, credentials, port, and TLS requirements. Your relay may impose sending limits or compliance rules; those are separate from phpList’s installation requirements and must be followed.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Prepare a recovery plan
Record the VPS provider’s recovery method, database backup destination, and the location of the phpList configuration. A deployment is not complete until you can restore the database and application files. Keep backups away from the VPS so a compromised server cannot erase both the live data and its only backup.
Install phpList on the VPS
1. Provision the web and database stack
Create the VPS from a maintained Linux image. Install and configure a web server, a PHP runtime supported by your phpList release, and a MySQL-compatible database. Create the intended document root and make sure PHP is actually executed there; a server that downloads PHP source instead of running it is not ready for the installer.
Configure the firewall before publishing the site. Allow only the web ports and the administration path you genuinely use. Keep the database listening on the private interface whenever possible, and limit SSH or another management service to trusted networks or an access gateway. The phpList security guidance specifically recommends a firewall that allows only necessary services.
2. Download, unpack, and place the application
Obtain the phpList archive for the release you selected, unpack it on the VPS or on a deployment workstation, and locate the directory named lists. The manual installation sequence uploads that directory into the web root. On a VPS, SSH, SCP, or an equivalent deployment tool is preferable to FTP because it avoids an additional credentialed service.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteRank #2
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (4GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- CanaKit Mega Heat Sink - Black Anodized
After copying the files, verify the resulting path. If the document root is /var/www/example, the application should be reachable under a URL whose path ends in /lists, and the administration endpoint should therefore be /lists/admin. Do not accidentally create a nested path such as /lists/lists. Set ownership so the web-server account can read the application and write only the directories that the release explicitly requires.
3. Create a dedicated database and account
Create a database, a user dedicated to phpList, and a long random password. A typical MySQL session looks like this; adjust names and privileges to your database version and deployment policy:
CREATE DATABASE phplist;
CREATE USER 'phplist_user'@'localhost' IDENTIFIED BY 'replace-with-a-long-random-password';
GRANT ALL PRIVILEGES ON phplist.* TO 'phplist_user'@'localhost';
FLUSH PRIVILEGES;Use a database host that matches the account definition. If the database is on another machine, the host part of the account and the firewall rules must permit that connection, and the traffic should be protected according to your database provider’s guidance. Never paste the database password into a public issue, shell history that other users can read, or a configuration backup stored without access controls.
4. Edit lists/config/config.php
Open lists/config/config.php in a plain-text editor. Replace the existing database settings with the host, database name, database user, and database password you just created. Preserve the variable names and quoting style already present in the file; do not introduce smart quotes or invisible characters. The manual notes that localhost or 127.0.0.1 may work, but the correct value is provider-specific.
Recommended Free Tools
Check the file character by character after saving. A stray space, an unmatched quote, or a line copied with hidden formatting can produce a database connection error that looks like a server failure. Keep the file outside public download paths if your web-server configuration would otherwise serve raw PHP files, and ensure its permissions do not grant write access to unrelated users.
5. Initialize the phpList database
Open the administration path in a browser: /lists/admin. Choose the database initialization option, enter the requested values, and continue through the setup screens. The initializer creates the tables and prepares the application for administration. If you are using a release that documents command-line initialization, you can use that method instead, but follow the command and options for that exact release rather than copying a command from an older installation.
Rank #3
- CanaKit Raspberry Pi 5 Essentials Starter Kit
When initialization finishes, sign in and change the initial administrator password immediately. Confirm that the administrator area loads over HTTPS and that the application can read its configuration without exposing it as downloadable text.
Configure SMTP for reliable sending
For production, configure an external SMTP relay unless you have a specific, tested reason to use PHP’s local mail() function. A relay separates application delivery from the VPS’s local mail configuration and gives you a defined authentication and transport path.
Enter the relay settings
In phpList’s mail settings, provide the values required by your relay:
| Setting | What to enter |
|---|---|
| SMTP host | The relay’s hostname, exactly as supplied by the provider. |
| Username | The SMTP account or API-style username required for authenticated submission. |
| Password | The corresponding secret, stored with the same care as the database password. |
| Port | The submission port specified by the relay. The manual’s STARTTLS example uses 587. |
| TLS/security | Set the secure transport option to tls for standard STARTTLS when that is what the relay documents. |
Send a controlled test to an address you operate, then inspect both phpList’s result and the relay’s event log. A successful SMTP login does not guarantee inbox placement, so continue monitoring bounces and delivery behavior after launch.
Do not disable certificate verification casually
Some examples show how to connect to a server with a self-signed certificate by disabling peer and name verification. That weakens TLS validation and should not be copied as a normal fix. Use such a setting only for a controlled, understood trust arrangement; the safer solution is to use a relay with a certificate your system can validate.
Turn off test mode before real mail
New phpList installations have test mode enabled. In lists/config/config.php, find:
Rank #4
- Includes Raspberry Pi 5 16GB with 2.4Ghz 64-bit quad-core CPU (16GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
define("TEST",1);Change it to:
define("TEST",0);Save the file and verify the setting before scheduling any production queue. While test mode remains enabled, phpList does not send confirmation messages, so subscribers cannot complete the confirmation process. A site can therefore appear to be functioning while every new subscription remains unconfirmed.
Harden the VPS and phpList installation
Keep the supplied access protections active
Do not remove phpList’s .htaccess files merely because the application appears to work without them. They can contain directory and file protections expected by the project. If your web server does not support those files, reproduce the intended restrictions in the server’s native configuration instead of leaving sensitive paths open.
Add a second barrier around administration
Protect the admin directory with an additional web-server password or an equivalent access control, then use phpList’s own administrator authentication inside that boundary. This layered approach reduces the impact of a stolen phpList password or an exposed login form. Change the administrator password immediately after the first login and remove unused administrator accounts.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Run with least privilege
The web-server account should not have broad write access to the entire VPS. Grant write permission only where phpList needs it, and keep configuration and backup files readable by as few accounts as practical. The security guidance also calls for register_globals to be off; verify that obsolete PHP settings are not being enabled by an inherited configuration.
Restrict the firewall
Allow the web ports, your chosen administration service, and any other service required by the deployment—nothing more. Do not open the database port to the public internet just to make initial setup easier. Review the rules after installation because temporary troubleshooting access is easy to forget.
Protect secrets and backups
Limit access to config.php, database dumps, SMTP credentials, and server keys. Encrypt backups in transit and at rest where your operating environment supports it. Test a restore periodically; an untested archive is not a recovery plan.
Best Value
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
- Includes 32GB EVO+ Micro SD Card pre-loaded with 64-bit Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit 45W PD Power Supply for the Raspberry Pi 5
- Display Cable - 6 foot (Supports up to 4K 60p)
Operate the sending queue after installation
phpList is useful only when queued messages are processed consistently. Use its cron or command-line sending workflow for repeatable queue processing rather than relying on an administrator remembering to press a button. The exact command and runtime options vary by release, so use the version-specific manual when creating the scheduled job.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Run the job under the least-privileged account that can execute phpList and read its configuration. Capture exit status and logs so a failed run is visible. Avoid overlapping workers unless your release and mail relay explicitly support that arrangement; duplicate workers can compete for the same queue or create confusing delivery records.
Make bounce handling part of the operating routine. Review bounce reports, remove or suppress persistently failing addresses according to your list policy, and watch the relay’s delivery and complaint signals. A technically correct SMTP connection does not protect a sender reputation if invalid addresses and complaints are ignored.
Schedule operating-system, PHP, database, and phpList updates. Read the release notes before changing PHP or the database engine, take a backup, and test the application and a controlled message afterward. Keep a written rollback plan for both application files and the database schema.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot the common failure points
| Symptom | Likely cause | Action |
|---|---|---|
| Database connection error during initialization | A wrong host, database name, username, password, or an invisible space in config.php |
Recheck every value character by character, confirm the database account’s host restriction, and test a connection with the same credentials from the VPS. |
| MySQL errors after a PHP upgrade | The configuration is trying to use the deprecated mysql.inc module |
Use the mysqli.inc database module required by newer PHP environments, following the release’s documented configuration. |
| HTTP 500 after enabling the site | An unsupported .htaccess directive, including a php_value line |
Inspect the web-server error log and remove or comment out the problematic directive as recommended by the project’s troubleshooting guidance. Move the setting into the server or PHP configuration where appropriate. |
| Subscribers never receive confirmation messages | Test mode is still enabled or the SMTP transport is not working | Confirm define("TEST",0), send a controlled test, and inspect SMTP and application logs. |
| SMTP authentication or TLS failure | Wrong host, credentials, port, security mode, or certificate trust | Copy the relay’s settings exactly, use port 587 with tls when the relay specifies STARTTLS, and do not bypass certificate verification as a casual workaround. |
| REST API does not work | Missing PHP 7 support, Apache rewrite support, or required configuration/cache changes | The documentation requires PHP 7 and, with Apache, .htaccess support and mod_rewrite. Apply the documented configuration changes and clear the cache directory before retesting. |
When the REST API is part of the design
The REST API is not required for a basic mailing-list installation. If another application must call it, treat it as an additional deployment surface. The project documentation specifies PHP 7 and, for Apache, support for .htaccess and mod_rewrite. Enabling the API also involves configuration changes and clearing phpList’s cache directory. Confirm those requirements against the release you installed, then protect API credentials and restrict access just as you would for the administration area.
Self-hosting versus phpList Hosted
Self-hosting trades operational work for control. A hosted deployment is the managed alternative described by the project and is intended for operators who do not want to maintain a mail server environment.
| Consideration | Self-hosted on a VPS | phpList Hosted |
|---|---|---|
| Operational responsibility | You maintain Linux, PHP, the database, backups, updates, security, queue scheduling, and monitoring. | The service provider manages the underlying service, so there is less server administration for you. |
| Control and customization | You control the server configuration, deployment timing, file access, and network policy. | You work within the service’s supported configuration and account boundaries. |
| Email deliverability work | You are responsible for SMTP selection, bounce handling, reputation, and troubleshooting. | The managed offering is designed to reduce the work around servers, blacklisting, bounces, and deliverability. |
| Cost model | You pay for the VPS and any external SMTP service, plus the time and expertise to operate them. | You pay a recurring service fee instead of running the application stack yourself; the current fee depends on the provider’s offering. |
| License | phpList is open-source software published under the AGPLv3 license. | You consume the managed service while the underlying project remains AGPLv3 software. |
Choose a VPS when
- You can apply Linux, PHP, and database security updates promptly.
- You need control over configuration, deployment timing, or network placement.
- You can maintain tested backups and a recovery procedure.
- You are prepared to monitor bounces, complaints, queue failures, and delivery reputation.
Choose the hosted option when
- You want to avoid administering a public-facing web and database stack.
- Your team does not have dependable capacity for security updates and incident response.
- Reducing deliverability and bounce-management work is worth the recurring service fee.
Production go-live checklist
Use this checklist immediately before allowing real subscribers or campaigns:
- The selected phpList release is compatible with the installed PHP and database versions.
- The hostname resolves to the VPS and the site loads over HTTPS.
- The
listsdirectory is in the intended web root, with no accidental nested copy. - A dedicated database and least-privileged database account are configured.
lists/config/config.phpcontains the correct host, database name, username, and password, with no stray spaces or formatting characters.- The database has been initialized and the administrator password has been changed.
- The SMTP host, credentials, port, and TLS mode have been tested with a controlled message.
define("TEST",0)is present before production sending begins.- phpList’s
.htaccessprotections are active or equivalent web-server rules are in place. - The admin directory has an additional access barrier where feasible.
- The web-server account has no unnecessary write permissions and obsolete
register_globalsbehavior is disabled. - The firewall exposes only the required web and administration services.
- Backups include both application files and the database, and a restore has been verified.
- A cron or command-line queue workflow is scheduled according to the installed release’s instructions.
- Someone is assigned to review bounces, delivery signals, logs, updates, and security alerts.
The practical verdict
A VPS is a good fit for phpList when you want control and are willing to operate the complete stack. The safest path is to install the application with a dedicated database account, use an authenticated external SMTP relay, leave the supplied file protections in place, lock down administration and the firewall, and verify test mode is disabled before sending. If maintaining those responsibilities is not realistic, the hosted option removes much of the server and deliverability work in exchange for its recurring service model.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
