This guide covers a manual, self-hosted HostBill installation. Use the vendor's separate automated installer instructions when that is the method supplied for your deployment. Keep the installation private until the default access, configuration file and installer have been secured.
IN THIS ARTICLE
01 Prepare the server and installation address
Confirm the target release requirements for PHP, ionCube, database settings and extensions. Configure HTTPS for your billing address, such as billing.example.com, and check that its document root is the intended empty application directory. Have a current licence activation code available through your HostBill customer account.
Create a dedicated database and database user. Grant that user the privileges required on this application's database rather than giving it unrestricted access to every database on the server. Record the database hostname, database name and username in your secure operations record.
02 Install the application
- Download the appropriate release package from the authenticated HostBill client portal. Upload and extract it into the intended web directory. Check that the application files are not accidentally nested one directory deeper.
- Rename
includes/config.php.exampletoincludes/config.php. Set ownership and temporary permissions so the installer can write the configuration and required runtime directories. Use the least permissions that work with your PHP execution model. - Open the HTTPS installation address followed by
/install/index.php. Choose Standard Installation, review the terms and enter the dedicated database connection details. - Use Check to validate the database connection. If it fails, correct the host, credentials or database privileges before continuing. Do not create another installation over a partly populated production database.
- Complete the installation, enter the License Activation Code and activate the licence.
- Sign in immediately and use My Account to replace any installer-provided administrator credentials with your own strong, unique credentials. Keep public access restricted until this is complete.
03 Secure and validate the result
Remove the installation directory. Protect includes/config.php against unnecessary modification and prevent direct access to configuration or backup copies. Preserve its generated $ccEncryptionHash in an encrypted backup: replacing it can make stored passwords unreadable.
Move private attachments, downloads and compiled templates outside the public document root as described in the security guide. Configure both automation jobs using the installation owner's account and the correct PHP binary. Set the business identity, currency, approved tax configuration and outgoing mail before publishing order links. Treat an offered country profile as a starting configuration that still needs review.
Test administrator access, client registration, a draft billing workflow, a support attachment and both cron processes. Begin with controlled test data and test gateway credentials so installation checks do not provision unwanted paid resources.
Common questions
Why does the installer work while cron fails?
The web server and scheduler can use different PHP versions, permissions or configuration files. Check the actual command-line binary and run the documented job as the application owner.
Should I make the whole installation writable to fix an error?
No. Identify the specific path and process that needs access. Correct ownership or that directory's permissions, then repeat the failed operation. Broad write access can hide the original ownership problem and leave application files exposed to modification.