How to Install OpenCart 4 (and the Steps Most Guides Skip)

Installing OpenCart takes about ten minutes. We build and fix OpenCart stores for a living, and almost none of the support tickets we get are about the install itself. They are about what people skipped right after it: the install folder left sitting on the server, the storage directory still in the web root, a PHP version that does not match. So this guide covers the install properly, then spends most of its time on the steps that decide whether your store is actually safe to take orders on.

Check the requirements before you download anything

OpenCart 4, the current line, needs PHP 8.0 or higher and a MySQL or MariaDB database. It also wants a handful of PHP extensions turned on: cURL, GD, mbstring, ZIP, and a few others. Most shared hosts have these, but “most” is the word that creates support tickets.

The version that bites people is PHP. Run PHP 7.4 and OpenCart 4 will not install. Run PHP 8.3 with an old extension or theme and something will break in a way that is hard to trace later. Pick PHP 8.1 or 8.2 for a new OpenCart 4 store and you avoid both ends of that. Set it in your hosting panel before you start, not after the white screen appears.

Two ways to install, and when each makes sense

You have two real options. A one-click installer like Softaculous in cPanel, or the manual route where you upload the files yourself.

Our honest take: if this is a store you plan to run as a business, install it manually. You control the version, you see exactly what is on the server, and you are forced to do the security steps a one-click installer often hides from you. Softaculous is fine for a throwaway test or a demo you will delete next week.

The manual install, step by step

1. Download the latest OpenCart 4 zip from opencart.com and unzip it on your computer. The store files live inside the upload folder, not at the top of the archive. That trips people on the first try.
2. Create a MySQL database and a user, and give that user full rights on the database. Write down the name, user, and password. You will need all three in a minute.
3. Rename two files: config-dist.php to config.php, and admin/config-dist.php to admin/config.php. Skip this and the installer cannot save anything.
4. Upload the contents of the upload folder to your web root, usually public_html, with FTP or your host’s file manager.
5. Open your domain in a browser. The web installer loads, checks requirements, and asks for the database details and an admin login. Fill those in and let it run.
6. Delete the install folder. This is not optional, and we explain why below.

The three steps people skip, in order of how much they hurt

This is the part the host tutorials rush past. Get these wrong and your store either gets compromised or behaves strangely for months.

Delete the install folder

OpenCart will not let you reach the storefront until you remove the install directory, and there is a good reason for the nagging. Left in place, it is a known, public path that attackers scan for. Deleting it is one click in your file manager. Do it the moment the installer finishes, before you do anything else.

Move the storage folder out of the web root

This is the OpenCart 4 step that did not exist in version 3, and the one almost nobody knows about. The installer offers to move the storage directory above your public_html folder, where the public web server cannot reach it. Say yes. That folder holds your cache, logs, downloads, and uploaded session data. Leaving it inside the web root means a determined visitor can poke at files that were never meant to be public. If you missed the prompt during setup, you can still move it from the admin dashboard afterward.

Set your store URL and SSL before you add products

Install your SSL certificate, then set the store URL in the admin to the https version. Doing this on day one means every product image, link, and checkout step is built on the right address from the start. Do it after you have 200 products and a few orders, and you spend an afternoon chasing mixed-content warnings and broken image paths that you created yourself.

When the install fails

Two errors cover most of what we see. A blank white page almost always means a PHP version or extension problem, so check the PHP version first and turn on error display to read the real message. A database error during setup almost always means the database user does not have full rights, or you typed the host as something other than localhost when your host needs a different value. Neither is a deep problem. Both look scary if the screen just goes white and says nothing.

Installed and now wondering if OpenCart was the right pick

A fair number of people install OpenCart, look around, and start asking whether they should have used something else. If that is you, we wrote an honest comparison in OpenCart versus WooCommerce that lays out where each one wins. OpenCart is a lean store builder with no monthly platform fee, which is its real strength. It is also a smaller ecosystem with fewer developers, which is the trade-off you are accepting.

If the install went sideways, or you would rather hand the whole thing to someone who has done it a few hundred times, that is what our OpenCart development team is for. And if you just want to understand the platform before you commit, start at our OpenCart overview. Either way, get the install folder deleted and the storage directory moved first. Those two take five minutes and save the worst kind of bad day.

Once your store is running, custom features are best built so they survive the next update. Here is how we approach OpenCart module development.