Softaculous Apps Installer

Softaculous installs and updates hundreds of web apps (WordPress, Joomla, Drupal, PrestaShop, OpenCart, Moodle and many more) in one click. NexPanel installs it on a server and adds a Softaculous Apps Installer tile to the customer panel.

Install it on a server#

1. Open Hosting › Softaculous in the admin panel.
2. Enter the email address that should receive Softaculous notices, then click Install next to the server. It takes a few minutes; the page shows when it is done.

NexPanel installs PHP 8.3 with the ionCube loader (Softaculous needs it) next to the server's other PHP versions, downloads Softaculous's panel-independent package, and sets up its daily update job. Reinstall repairs an installation; Remove takes Softaculous off the server, while the sites customers installed with it keep working.

License#

Softaculous works without a license as its free edition, with a smaller set of popular apps. For the full catalogue, buy a Softaculous license for the server's main IP address at softaculous.com. Softaculous picks the license up by itself within a day, or right away when you click Reinstall. The admin page shows whether a license was found and how many apps are available.

For customers#

Customers click Softaculous Apps Installer in the Software section of their dashboard (or search for it). It opens in a new tab, already signed in. From there they choose an app, a domain and a folder, and Softaculous creates the files, the database and any cron job the app needs.

Installed WordPress sites also appear in the WordPress Manager.

How it stays safe#

• It runs as the customer. Softaculous runs as the customer's own account, inside its isolated environment and resource limits. It can only write to that account's home folder, never as root.
• Databases and cron through the API. Softaculous creates databases, database users and cron jobs through the customer's API with a token that only works for that account and expires after 12 hours. Database names get the account's prefix, and the package's database limit applies.
• One-time sign in. The panel asks the server for a sign-in link that works once, within two minutes. The session is a secure, HTTP-only cookie limited to /softaculous/ and ends after 8 hours of inactivity, when the customer signs out, or at once when the account is suspended or removed.
• Only Softaculous's own pages are served: the panel never serves other files from the Softaculous folder.