OpenCart Installation and Configuration: Server, Security, Optimization

server { listen 443 ssl http2; server_name localhost www.localhost; root /var/www/opencart/public_html; index index.php; ssl_certificate /etc/ssl/certs/localhost.crt; ssl_certificate_key /etc/ssl/private/localhost.key; location / { try_files $uri $uri/ @opencart; } location @opencart { rewrite ^/(.+)$ /index.php?_route_=$1 last; } location ~ ^/(system|admin/config\.php|config\.php) { deny all; } location ~ \.php$ { fastcgi_pass unix:/run/php/php8.2-fpm.sock; fastcgi_index index.php; include fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_read_timeout 300; } location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff2)$ { expires 30d; add_header Cache-Control "public, no-transform"; } } server { listen 80; server_name localhost www.localhost; return 301 https://localhost$request_uri; } 

This configuration enforces HTTPS, blocks access to sensitive paths, and sets aggressive caching for static assets.

How to Move Storage Outside the Web Root?

Moving storage outside the web root eliminates the possibility of direct access to log and cache files via URL. We recommend moving the folder immediately after installation.

Download and unpack the distribution, copy files to the public directory. Create a database and user. Then move the storage folder outside the web root.

cd /var/www/opencart wget https://github.com/opencart/opencart/releases/download/4.0.2.3/opencart-4.0.2.3.zip unzip opencart-4.0.2.3.zip cp -r upload/* public_html/ cd public_html cp config-dist.php config.php cp admin/config-dist.php admin/config.php chmod 775 system/storage/cache/ system/storage/logs/ system/storage/download/ system/storage/upload/ image/ image/cache/ chmod 664 config.php admin/config.php chown -R www-data:www-data /var/www/opencart/public_html/ # Create database mysql -e "CREATE DATABASE opencart CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;" mysql -e "CREATE USER 'opencart_user'@'localhost' IDENTIFIED BY 'strong_password';" mysql -e "GRANT ALL PRIVILEGES ON opencart.* TO 'opencart_user'@'localhost'; FLUSH PRIVILEGES;" # Move storage mv public_html/system/storage/ /var/www/opencart/storage/ 

In config.php and admin/config.php:

define('DIR_STORAGE', '/var/www/opencart/storage/'); 

Why is Setting Permissions Important?

After installation, delete the install folder: rm -rf public_html/install/. Incorrect permissions are a common cause of 500 errors. Ensure config.php and admin/config.php have 664, and writable directories have 775. Permissions 664 on config.php prevent accidental configuration changes via the web.

How to Secure the OpenCart Admin?

• Rename /admin/ to an unpredictable name (e.g., /store-control-9x7k/).
• Set up HTTP Basic Auth on the admin folder.
• Update paths in admin/config.php.
• Add an nginx block location /store-control-9x7k { auth_basic ...; }.
• Install a two-factor authentication extension.
• Enable captcha on the login page.

How We Install OpenCart in 1 Day (Real Case Example)

One of our recent projects was launching an electronics online store with a catalog of 5000 products. The client provided a dedicated server with nginx and MySQL. We performed:

1. Server audit (discovered an outdated MySQL version).
2. Configuration of PHP 8.2 with opcache and redis.
3. Installation of OpenCart 4.0.2.3.
4. Moving storage outside the web root.
5. Renaming admin and setting up HTTP Basic Auth.
6. SSL configuration via Let's Encrypt.
7. Speed optimization: gzip, caching, Redis.

The whole process took 1 day. After launch, the store showed LCP 1.5 sec, meeting Core Web Vitals. The client saved an estimated $3,000 in development costs compared to hiring separate specialists.

What's Included

• Audit of the current server (or hosting selection assistance).
• Configuration of PHP 8.2+ with opcache and redis.
• Nginx setup with SSL certificate (Let's Encrypt).
• Installation of OpenCart 4.x with database migration.
• Moving storage outside the web root.
• Basic security measures (rename admin, HTTP Basic Auth).
• Speed optimization: gzip, caching, Redis.
• Delivery of documentation with access and instructions.
• 1 hour of online training on working with the admin panel.
• 2 weeks of support after launch (consultations on content).

Typical cost for this turnkey installation is $500, saving you up to $200 compared to individual component setup.

Comparison of OpenCart and Magento 2

Contact us to get a consultation on turnkey OpenCart installation. We guarantee stable operation of your store after configuration. Order installation — get a store ready for content in 1–2 days. The cost is calculated individually after a server audit.