4.1.15 Installing Subrion CMS on hosting and server

Subrion CMS is a free CMS and PHP/MySQL framework for websites of any type: from blogs and directories to complex portals with paid subscriptions and an advanced system of permissions and packages. The project is distributed under the GPLv3 license and supports plugins, templates, and a flexible user access model.
This guide uses the classic installation from the Subrion archive, configuration of the Nginx + PHP-FPM + MySQL/MariaDB stack on Ubuntu 24.04 LTS, and subsequent launch of the web installer.
Preparation
Requirements
Environment variables
DOMAIN_NAME— your domain nameSERVER_IP— the public IP address of the serverDB_NAME,DB_USER,DB_PASSWORD— database parameters for SubrionSUBRION_PATH— path to the project directory, for example/var/www/subrionPHP_FPM_SOCKET— path to the PHP-FPM socket, for example/run/php/php8.2-fpm.sock
Installing Subrion CMS on hosting
- Download the stable version of Subrion CMS from the official Subrion CMS website.
- Upload the archive to the hosting account via the file manager or over FTP.
- Create a user and a database. Save
DB_HOST,DB_NAME,DB_USER,DB_PASSWORD. - Run the installer in a browser. Open
http://DOMAIN_NAMEand follow the installation wizard:
- Check that the technical requirements are met;

- Accept the license agreement;

- Fill in the parameters of the previously created database (
DB_HOST,DB_NAME,DB_USER,DB_PASSWORD) and administrator;

- If necessary, download the configuration file;

Installing Subrion CMS on a server
sudo apt update && sudo apt -y upgrade
sudo apt -y install curl gnupg2 software-properties-common unzip ca-certificates
This updates system packages and installs utilities required for downloading archives and working with repositories.
Install PHP-FPM and required extensions
sudo apt -y install php8.2 php8.2-fpm php8.2-cli \
php8.2-mbstring php8.2-xml php8.2-gd php8.2-zip \
php8.2-curl php8.2-mysql php8.2-intl php8.2-opcache
php -v
Subrion runs on a modern PHP version; this set of modules covers the requirements for working with the database, images, archives, and locales. The php -v command confirms the installed PHP version.
Install Nginx
sudo apt -y install nginx
sudo systemctl enable --now nginx
Nginx will handle HTTP requests and pass PHP scripts to PHP-FPM.
Install and prepare the DBMS (MySQL/MariaDB)
sudo apt -y install mysql-server
mysql --version
Create a database and user for Subrion:
sudo mysql <<SQL
CREATE DATABASE DB_NAME CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'DB_USER'@'localhost' IDENTIFIED BY 'DB_PASSWORD';
GRANT ALL PRIVILEGES ON DB_NAME.* TO 'DB_USER'@'localhost';
FLUSH PRIVILEGES;
SQL
The utf8mb4 encoding is used for full Unicode support and emojis in site content.
Download and deploy Subrion
Subrion is distributed as a zip archive; installation is performed from the official project archive. Download the stable version of Subrion CMS from the official Subrion CMS website.
sudo mkdir -p SUBRION_PATH
cd SUBRION_PATH
wget https://tools.subrion.org/get/latest.zip
unzip latest.zip
rm latest.zip
The latest.zip archive contains the current 4.2.x branch release; after extraction, the application files are ready for launching the installer.
Permissions and project owner
sudo chown -R www-data:www-data SUBRION_PATH
sudo find SUBRION_PATH -type d -exec chmod 755 {} \;
sudo find SUBRION_PATH -type f -exec chmod 644 {} \;
The www-data owner (web server and PHP-FPM user) ensures correct writing of temporary files, cache, and uploaded files.
Nginx configuration for Subrion
Below is an example of an Nginx virtual host adapted for Subrion and a PHP-FPM socket. The configuration is based on a working example for Subrion on Nginx with correct handling of SEO URLs and the installer.
server {
listen 80;
server_name DOMAIN_NAME;
root SUBRION_PATH;
index index.php;
location = /favicon.ico {
log_not_found off;
access_log off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
location / {
try_files $uri $uri/ /index.php?q=$uri&$args;
}
error_page 404 /404.html;
location = /404.html {
root /usr/share/nginx/html;
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/share/nginx/html;
}
location ~ \.php$ {
include fastcgi_params;
fastcgi_pass unix:PHP_FPM_SOCKET;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
}
location /install/ {
rewrite ^/install/(.*)$ /install/index.php?_p=$1;
}
location ~ /\.ht {
deny all;
}
location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
expires max;
log_not_found off;
}
}
Activate the site and reload Nginx:
sudo ln -s /etc/nginx/sites-available/subrion.conf /etc/nginx/sites-enabled/subrion.conf
sudo nginx -t
sudo systemctl reload nginx
The try_files directive forwards requests to index.php with the q parameter, as expected by Subrion, and the separate location /install/ block ensures correct operation of the web installer.
Attention! After completing the installation, be sure to delete the /install/ directory, change the default URL of the admin panel, restrict access to the admin area by IP or HTTP authentication, and regularly update the core and plugins. For version 4.2.1, vulnerabilities related to file uploads (for example, CVE-2018-19422) were previously published, so do not use test demo login/password values and disable unused packages.
Configuring additional Subrion features
SSL certificate (HTTPS)
For operation over the secure HTTPS protocol, use Let’s Encrypt or a commercial SSL certificate.
PHP caching and performance
Enable and configure opcache to speed up Subrion:
opcache.enable=1
opcache.enable_cli=1
opcache.memory_consumption=256
opcache.max_accelerated_files=20000
opcache.interned_strings_buffer=16
opcache.validate_timestamps=1
opcache.revalidate_freq=60
Restart PHP-FPM:
sudo systemctl restart php8.2-fpm
Image and media processing
Subrion actively uses images in templates and content; the GD library is sufficient for processing them, but Imagick can be additionally enabled if needed.
sudo apt -y install php8.2-gd imagemagick php8.2-imagick
sudo systemctl restart php8.2-fpm
Recommendation. For typical sites, php8.2-gd is sufficient. Enable php8.2-imagick if you need to work with large images, TIFF/WEBP, or advanced effects. You can check the presence of modules with the command php -m | grep -E 'gd|imagick'.
Verifying operation
-
Go to
http://DOMAIN_NAME/and make sure the Subrion start page opens without PHP errors. -
Log in to the admin panel (
http://DOMAIN_NAME/panel/or the renamed URL) and verify:- the dashboard operation,
- creation and publication of a test page,
- file uploads in the content section.
Common issues
| Error / Symptom | Cause | Solution |
|---|---|---|
| 502 Bad Gateway when opening the site | Incorrect PHP_FPM_SOCKET in the Nginx configuration or PHP-FPM is not running |
Verify the socket path (/run/php/php8.2-fpm.sock), restart php8.2-fpm and nginx |
The installer loops on /install/ or redirects to /install/install/ |
Incorrect location / block or missing location /install/ rule in Nginx |
Apply the configuration from the example (try_files $uri $uri/ /index.php?q=$uri&$args; line and the location /install/ block), then reload Nginx |
Access denied for user 'DB_USER'@'localhost' during installation |
Incorrect DB_USER/DB_PASSWORD or missing privileges on DB_NAME |
Recreate the user with the required password and grant GRANT ALL PRIVILEGES ON DB_NAME.* |
| Blank page or HTTP 500 after installation | Fatal PHP error (incompatible extension, outdated module, or plugin error) | Enable error display for diagnostics, temporarily disable third-party plugins, update PHP modules |
| Unable to upload files or avatars | Incorrect permissions on uploads/, tmp/ directories or open_basedir restrictions |
Set www-data as the owner and 755 permissions on the directories, check PHP settings in the control panel |
| Security scanners report a vulnerability in Subrion 4.2.1 | An outdated, unsupported release with known vulnerabilities is being used (including arbitrary file upload) | Restrict access to the admin panel, disable unsafe plugins, apply patches from the developers, or consider migrating to another up-to-date engine if updating Subrion is not possible |
Useful links
Official documentation and resources


