Someone asks me this at least once a week: "Can I run Flarum on my shared hosting plan?" The honest answer: sometimes, barely — and you'll spend more of your own time than a small server costs. Before you commit a community to a $3/month plan, here's the full map of where it bites.
In this issue:
- The seven ways shared hosting fights Flarum
- The exact checklist to send your host before signing up
- My honest take on when shared hosting is fine — and when it isn't
The seven pain points
1. The PHP wall. Flarum 2.0 wants PHP 8.3+ with a specific set of extensions — curl, dom, fileinfo, gd, mbstring, openssl, pdo_mysql, tokenizer, zip and friends. Shared hosts are notorious for lagging PHP versions, and when an extension is missing (The PHP extension 'gd' is required is a classic), a locked-down php.ini means there's nothing you can do about it. No gd, no avatars.
2. No SSH, no Composer — and Flarum is Composer-native. Installing Flarum, adding extensions, updating anything: it's all Composer. Without a command line you're into workarounds — the official archive installs, uploading composer.phar and invoking it through cPanel's terminal-of-the-day, or the Extension Manager extension. All of them work until they don't.
3. Memory limits kill updates. Composer routinely needs 512MB–1GB+ to resolve dependencies. Shared plans cap PHP at 128–256MB. The failure mode is brutal: an update dies halfway, and now your forum is stranded between versions with no CLI to roll it back. Major upgrades (1.x → 2.0 runs real database migrations) amplify this risk.
4. The Extension Manager needs what your host disabled. The GUI escape hatch for no-SSH hosting runs Composer under the hood — which needs proc_open/exec. Those are the first functions shared hosts disable for security. Check disabled_functions before you rely on it.
5. You don't control your webroot. Flarum ships with a public/ directory for a security reason: your config, vendor code and storage live outside the web-servable tree. cPanel gives you a fixed public_html. The no-public-dir archive exists for exactly this — but it trades away that isolation layer. And if mod_rewrite/.htaccess isn't enabled, pretty URLs and the API simply break.
6. No daemons — which means realtime is physically impossible. This one isn't a workaround situation. flarum/realtime (live posts, typing indicators, presence) needs a persistent websocket process supervised by systemd — a long-running daemon on an open port. Shared hosting exists specifically to prevent you from running those. No amount of configuration fixes an architectural no. (It's also exactly why I built Warble — realtime as a pasted key instead of a daemon — but more on that another issue.)
7. Everything else that quietly degrades. One-minute cron for the scheduler? Many shared hosts floor cron at 5–15 minutes. Redis for cache and queues? Not on shared — you fall back to database queues and file caches, and every page feels it. Email from a shared IP that half the internet has blacklisted? Your signup confirmations land in spam. None of these break the install; all of them make the forum feel worse than it should.
The checklist to send your host
Copy, paste, and make them answer every line:
- [ ] PHP 8.3+ with
curl,dom,fileinfo,gd,mbstring,openssl,pdo_mysql,tokenizer,zip - [ ] SSH access
- [ ]
proc_openandexecenabled - [ ] 512MB+ PHP memory limit for CLI processes
- [ ] Control over the webroot (or clean subdirectory support)
- [ ]
mod_rewrite/.htaccesshonored - [ ] Cron at one-minute granularity
More than one "no" and the plan will fight you forever.
The Numbers
The last week in data (Jun 26 – Jul 3):
The uptime fleet: 25 monitors watched · 166,455 checks performed · 746ms avg response · 71 incidents caught
The forum: 11 new members · 54 posts
Sandboxes: 35 throwaway forums spun up
My honest take
Shared hosting made sense when the alternative was expensive. It isn't anymore — a small VPS costs about the same as a decent shared plan and removes every item on that list at once. The setup is a weekend project the first time and a template forever after; the checklist above simply stops applying to you.
Want to feel Flarum 2.0 before you commit to anything? Spin up a free throwaway sandbox — a real forum with real extensions, zero setup, gone when you're done.
Running into a shared-hosting problem I didn't list? Reply below — this newsletter is a forum thread, and I read everything.
— Karl
