phpBB is one of the longest-running open-source forum packages: classic boards with categories, topics, private messages, user groups, moderation tools and a large library of extensions and styles. It’s lightweight, runs on basic PHP hosting or any small VPS, and suits communities that like the traditional forum format.

For a modern, discussion-style forum, see Discourse and Flarum.

Requirements

  • PHP 8.x supported by your phpBB version (phpBB 3.3.x), with mysqli, mbstring, xml, gd, zip, json and intl.
  • MySQL/MariaDB (PostgreSQL and SQLite are also supported).
  • Nginx with PHP-FPM, and HTTPS.
sudo apt install nginx mariadb-server php-fpm php-mysql php-mbstring php-xml php-gd php-zip php-intl unzip

See Nginx with PHP-FPM.

1. Database

CREATE DATABASE phpbb CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'phpbb'@'localhost' IDENTIFIED BY 'a-strong-password';
GRANT ALL PRIVILEGES ON phpbb.* TO 'phpbb'@'localhost';

2. Download and permissions

Get the latest phpBB 3.3.x package from phpbb.com:

cd /tmp && wget https://download.phpbb.com/pub/release/3.3/3.3.14/phpBB-3.3.14.zip
unzip phpBB-*.zip && sudo mv phpBB3 /var/www/forum
sudo chown -R www-data:www-data /var/www/forum/{cache,files,store,images/avatars/upload}
sudo chown www-data:www-data /var/www/forum/config.php

(Use the current release number.)

3. Nginx

server {
    server_name forum.example.com;
    root /var/www/forum;
    index index.php index.html;
    client_max_body_size 20M;

    location / {
        try_files $uri $uri/ @rewriteapp;
    }
    location @rewriteapp {
        rewrite ^(.*)$ /app.php/$1 last;
    }

    # deny access to internal directories
    location ~ /(config\.php|common\.php|cache|files|store|includes|phpbb|vendor|config|db)(/|$) {
        deny all;
        internal;
    }
    location ~ /\.ht { deny all; }

    location ~ \.php(/|$) {
        include fastcgi.conf;
        fastcgi_split_path_info ^(.+\.php)(/.*)$;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        try_files $uri $uri/ /app.php$is_args$args;
    }

    location /install/ {
        try_files $uri $uri/ @rewrite_installapp;
        location ~ \.php(/|$) {
            include fastcgi.conf;
            fastcgi_split_path_info ^(.+\.php)(/.*)$;
            fastcgi_param PATH_INFO $fastcgi_path_info;
            fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
            fastcgi_pass unix:/run/php/php8.3-fpm.sock;
            try_files $uri $uri/ /install/app.php$is_args$args;
        }
    }
    location @rewrite_installapp {
        rewrite ^(.*)$ /install/app.php/$1 last;
    }
}

phpBB ships a sample Nginx config in docs/nginx.sample.conf. Compare with it for your version. Add HTTPS with Certbot. See Let’s Encrypt.

4. Run the installer

Open https://forum.example.com/install/: requirements check, admin account, database details (with a custom table prefix), email settings and board name. After installation, delete the install/ directory:

sudo rm -rf /var/www/forum/install
sudo chmod 640 /var/www/forum/config.php

5. Fight spam from day one

Forums attract spam bots immediately. In the Administration Control Panel (ACP):

  • Spambot countermeasures: enable a CAPTCHA, such as reCAPTCHA, or the Q&A plugin with questions bots can’t answer;
  • Account activation: by email, or by admin for small communities;
  • newly registered users group, with restricted permissions (moderated posts, no links or signatures until established);
  • the Stop Forum Spam extension;
  • Fail2Ban or rate limiting on registration and login endpoints. See Fail2Ban for Nginx.

Email

Configure SMTP in ACP → General → Client communication → Email settings, for activation and notifications. See transactional email services and email deliverability.

Extensions and styles

Download extensions from the official Customisation Database, upload them to ext/vendor/name, and enable them in ACP → Customise. Styles go in styles/. Stick to validated, maintained extensions.

Backups and updates

  • ACP → Maintenance → Backup, or better, automated dumps:
mysqldump --single-transaction phpbb | gzip > /backups/phpbb-db-$(date +%F).sql.gz
tar -czf /backups/phpbb-files-$(date +%F).tar.gz -C /var/www forum/files forum/images/avatars/upload forum/config.php forum/ext

See backup strategy.

  • Updates: use the “automatic update package”, or the full package plus database updater, following the official upgrade instructions. Disable extensions before major updates. See updating self-hosted apps.

Quick reference

Item Value
Admin panel ACP link in the board footer (/adm/)
Writable dirs cache, files, store, images/avatars/upload
After install Delete install/, then chmod 640 config.php
Anti-spam CAPTCHA/Q&A, activation, newly registered users group

Related: MySQL performance tuning and Discourse.

  • Self-Hosting
  • Community
  • PHP