PHP Ledger hosting requirements

Which requirements are hard gates?

Verify the database, PHP runtime and private web-root controls before attempting installation.

The table does not certify a hosting vendor. MariaDB 10.4 or newer is supported alongside MySQL 8.4; MySQL 8.0 and earlier are not supported yet. A database described simply as “MySQL compatible” is not enough evidence. Ask the provider for the actual server version and database privileges. If those answers are unavailable, stop before uploading business data. A panel’s PHP selector cannot compensate for a database version that the installer does not support. On MySQL 8 with binary logging, which is the default, the installing account must also be allowed to create triggers: that needs either the SUPER or SET_USER_ID privilege or log_bin_trust_function_creators = 1 on the server. Setup reports this at the database connection check, before anything is written, and names the setting to change.

How do you check PHP without exposing configuration?

The browser installer checks PHP, extensions and the database for you. With terminal access, you can also inspect CLI PHP privately and run the package’s preflight using the same configured runtime.

php -v
php -m
php www/phpledger/install/preflight.php

The first command identifies the binary executing in the terminal. The second lists its loaded extensions. Neither proves that the web server uses the same binary or configuration. Ask the host to confirm the domain’s handler and version, and verify the web journey after installation. Do not leave a public diagnostic page displaying the full environment. Such output can reveal paths, settings and operational details that strangers do not need.

BCMath preserves decimal calculations without passing money through binary floats. PDO and PDO MySQL provide the database connection, mbstring handles text, and the package also requires curl, OpenSSL and fileinfo. PHP sessions need a writable private location. A missing extension is an installation issue to resolve with the host; disabling checks or editing the dependency platform guard does not add the missing capability.

What database privileges are required?

Migrations create tables, indexes, triggers and views; normal runtime access must be verified separately.

Use a dedicated account scoped to the application database. Do not configure the running application with MySQL root. Installation needs sufficient rights to apply the supplied statements and record their checksums. After installation, a host may separate migration privileges from normal runtime privileges, but it must test the real application flows under that restricted account. This guide does not claim one minimal grant list has been proven for every host.

The 0.3.0 effective-source views use a stable database definer: the account that creates them. Keep that account valid with access to the underlying tables, and verify that the runtime account can select the views. Restoration into a different database needs the same review. A view that exists but cannot execute is not a completed restore. The restore guide explains how source rows and their dependencies fit this check.

Which files may the web server serve?

Only the application’s public directory may be reachable from the web.

phpledger/
  index.php
  .htaccess
  vendor/
  resources/
  tools/
  www/phpledger/includes/
  www/phpledger/install/
  www/phpledger/templates/
  www/phpledger/public/

The directories above public contain dependencies, internal PHP functions and operator tools. They remain outside public routing. Preserve their relative layout because bootstrap and resources depend on it. When the whole folder sits inside a public website, the package-root .htaccess and index.php keep those directories private, and the installer checks through the site’s own address that private files cannot be downloaded before it creates any secret. On a server that ignores .htaccess, such as Nginx, point the document root at www/phpledger/public instead. Disabling directory listing alone is insufficient: a person who knows a private filename may still request it directly.

Protect database configuration and any OAuth keys using the host’s ownership and file-permission model. Application code can remain read-only to the web process. The package does not require making the whole tree writable. Test denied private paths and working public assets after routing changes; a rule that blocks everything is not a successful security configuration.

How much memory and disk are enough?

No measured universal minimum is published; capacity must be checked against the intended workload.

PHP and MySQL share resources with the operating system, control panel, backups and other applications. A small VPS may be a useful evaluation environment, but its advertised memory is not a guarantee for a busy accountancy practice. Test realistic company and history sizes in staging, then observe response times, process memory and available disk. Include month-end reports and backup extraction, which can behave differently from opening a dashboard.

Keep enough free space for two release directories and a private backup during an upgrade. Decide where backup copies leave the server and how their integrity is checked. A provider snapshot can be helpful, but you still need to know what it contains and how to recover a compatible application/database pair. Read the VPS procedure for the installation order and the shared-hosting guide for provider questions.

What counts as a completed preflight?

A successful preflight confirms prerequisites and recognized schema state; it does not certify accounting use.

1. Record the selected package and PHP and database versions.
2. Resolve every missing prerequisite before running migrations.
3. After migration, rerun preflight and retain a current-schema result.
4. Sign in, post fictional entries and reconcile their reports.
5. Check recovery with the matching release and private configuration.

The /health endpoint checks database connectivity only. It does not prove account creation, authorization, views, balanced postings or recovery. Treat health as one signal in a larger acceptance record. If the package detects unknown or interrupted migrations, investigate rather than deleting receipts.

When should you reject a hosting plan?

Reject a plan that cannot meet a hard requirement or provide a workable recovery route.

What should you do next?

An unsupported database, blocked trigger/view creation, or a server that ignores .htaccess while its public root cannot be changed each prevents installation. A provider can sometimes supply an operator-assisted solution; get that arrangement in writing before a pilot. If the application’s missing invoicing or tax workflows are the obstacle, changing hosts will not solve it. Choose another currently suitable accounting product or wait for the relevant feature’s acceptance.

Questions before you continue

Check these boundaries before applying the procedure to a business installation.

Sources and next steps

Technical references and project behavior were checked on 16 September 2026; hosting access remains plan-specific.

• Package installation instructions
• PHP supported-version dates
• Package upgrade and recovery instructions

The linked project files describe the current release. Follow the instructions inside your exact downloaded package if a later release changes a command. Technical testing does not establish statutory compliance or independent accounting acceptance. See the project and preview limits.

• Compare PHP availability and runtime evidence
• Follow the VPS installation sequence