Install OpenCart on Ubuntu: Nginx, PHP and SEO URLs

OpenCart is a lightweight, open-source PHP shopping cart. It’s simpler than Magento or PrestaShop, runs comfortably on a small VPS, and has a large marketplace of extensions and themes. It’s a good fit for small stores that want a straightforward admin and low hosting requirements. This guide installs OpenCart 4 on Ubuntu 24.04 with Nginx, PHP-FPM and MySQL.

Requirements

PHP 8.0 or newer (check the release notes of your version), with curl, gd, zip, mbstring, xml and mysqli.
MySQL or MariaDB.
1–2 GB RAM for a small store.

1. Install the stack

sudo apt update
sudo apt install -y nginx mysql-server unzip \
  php8.3-fpm php8.3-mysql php8.3-curl php8.3-gd php8.3-zip php8.3-mbstring php8.3-xml php8.3-opcache

See installing PHP and MySQL.

2. Database

sudo mysql <<'SQL'
CREATE DATABASE opencart CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
CREATE USER 'opencart'@'localhost' IDENTIFIED BY 'StrongPassword!';
GRANT ALL PRIVILEGES ON opencart.* TO 'opencart'@'localhost';
SQL

3. Download and place the files

Download the latest release from OpenCart’s GitHub releases page. The zip contains an upload/ folder, and its contents go into the web root:

cd /tmp
wget -O opencart.zip https://github.com/opencart/opencart/releases/download/4.1.0.3/opencart-4.1.0.3.zip   # use the current version
unzip opencart.zip -d opencart
sudo mkdir -p /var/www/opencart
sudo cp -r opencart/opencart-*/upload/. /var/www/opencart/     # path inside the zip may differ by version
cd /var/www/opencart
sudo mv config-dist.php config.php
sudo mv admin/config-dist.php admin/config.php
sudo chown -R www-data:www-data /var/www/opencart

4. Nginx with SEO URLs

server {
    listen 80;
    server_name shop.example.com;
    root /var/www/opencart;
    index index.php;
    client_max_body_size 32M;

    location / {
        try_files $uri $uri/ @opencart;
    }
    location @opencart {
        rewrite ^/(.+)$ /index.php?_route_=$1 last;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
    }

    location ~ /\.(?!well-known) { deny all; }
    location ~* \.(tpl|twig|ini|log|sql)$ { deny all; }
    location ^~ /system/storage/ { deny all; }
}

sudo nginx -t && sudo systemctl reload nginx
sudo certbot --nginx -d shop.example.com

The @opencart rewrite powers SEO URLs (/laptops/macbook instead of index.php?route=product/product&product_id=43). Enable them later in the admin. See Let’s Encrypt with Certbot on Nginx.

5. Run the installer

Open https://shop.example.com/install/, accept the licence, check that all requirements are green, enter the database details and admin account, and finish. Or use the CLI installer:

cd /var/www/opencart/install
sudo -u www-data php cli_install.php install \
  --username admin --password 'AdminPass123!' --email [email protected] \
  --http_server https://shop.example.com/ \
  --db_driver mysqli --db_hostname localhost --db_username opencart \
  --db_password 'StrongPassword!' --db_database opencart --db_port 3306 --db_prefix oc_

6. Post-install hardening

sudo rm -rf /var/www/opencart/install

At the first admin login, OpenCart 4 offers to:

move the storage folder outside the web root (do it, e.g. /var/www/storage/);
rename the admin folder (do it, so the admin isn’t at the obvious /admin/).

Then, in System → Settings → your store → Server:

enable Use SEO URLs;
enable SSL where available;
set error display off (log errors instead).

Configure mail with SMTP (System → Settings → Mail), so order confirmations reach customers. See SMTP ports 25, 465 and 587.

Performance

Enable PHP OPcache. See PHP OPcache.
Compress and resize product images (WebP where your theme supports it). See WebP and AVIF.
Nginx gzip/Brotli and browser caching for static files. See HTTP caching headers.
Limit extensions: each one adds queries and potential conflicts.

Security and maintenance

Install extensions only from trusted developers, and keep them updated.
Use strong admin passwords, a renamed admin folder, and IP restrictions for the admin if possible.
Back up the database, image/ and the storage folder daily. See database backup automation.
Firewall everything except 80, 443 and SSH. See UFW firewall.

Quick reference

Task	Where
Config files	`config.php`, `admin/config.php`
SEO URLs	Settings → Server, plus the Nginx `@opencart` rewrite
Storage	Move outside the web root
Extensions	Extensions → Installer / Extensions
Cache	Dashboard → gear icon → refresh cache

E-Commerce
OpenCart
PHP