Ops runbook · Beginner · 10 min
How to use softaculous installer — Softaculous: Which Defaults to Change Before You Click
The install takes ten seconds; the fields you skim on the way through are the ones you will be undoing in six months.
The short answer
Softaculous does in one click what would otherwise be five manual steps — create the database and user, unpack the files, write the config, set ownership, register the install — so the only thing worth slowing down for is the form itself.
Three answers on that form have long tails. The target directory becomes a permanent part of every URL. The admin username and table prefix decide how much automated abuse finds a purchase. And the update policy decides whether the app you install today is still patched when you have forgotten it exists. Everything else you can change later.
By the HostingFast team · Reviewed 24 August 2026
Beginner
Assumed level
10 minutes
Time at the keyboard
5
Steps to done
24/7
Engineers reachable
Ten minutes, most of which is reading the form rather than waiting for the install. Softaculous carries 240+ applications on every plan here, not just WordPress.
If you would rather not use an installer at all, that is supported too: SSH with Git and Composer is on every shared tier, so a Composer project or a Git deploy is a first-class option rather than a workaround.
What the installer does in those ten seconds
It creates a MySQL database and a user with a generated password, downloads and unpacks the release, writes the configuration file with those credentials, sets sensible file ownership, and records the installation in its own list so updates and clones can find it later. Done by hand that is a database created in cPanel, an upload, a config edit and a permissions check — all of which are easy to get subtly wrong.
The registration is the part people undervalue. An install Softaculous knows about can be cloned, staged, updated and removed cleanly. A manual install in the same directory is invisible to it, which is fine until you want a staging copy in a hurry.
The four fields that actually matter
Directory: leave it empty for the domain root, and only put something there if you truly want /blog in every URL forever. Moving an application out of a subdirectory later means rewriting internal links, redirecting every old path and re-testing the lot. Admin username: not admin, not the domain name. Table prefix: change it from the default, which costs nothing and blunts a class of automated attack that assumes it.
Fourth is the pair of maintenance toggles — auto-update, and a backup taken before each update. Both are free and both matter most on the applications you install with good intentions and then never open again. Those are the ones that turn up in an incident.
Keeping the installations list truthful
The list is your inventory. It tells you what is installed, at which version, in which directory, on which domain. That inventory is what makes patching a fifteen-minute weekly job rather than an archaeology exercise, and WordPress Toolkit sits alongside it handling core and plugin updates for WordPress specifically.
Removals must go through the tool. Deleting the directory over SFTP leaves the database and its user in place, still counting against your quota — 25 databases on Sprint, 50 on Turbo, 100 on Nitro. A handful of orphaned databases is how an account ends up unable to install anything with no obvious reason why.
When to skip the installer entirely
For anything you deploy from version control, the installer is the wrong tool. Full SSH access with Git and Composer is on every shared plan, so cloning a repository into a document root and running composer install is a supported workflow, not a hack. The business tiers add native Node.js, Python and Ruby on Rails deployment and PostgreSQL alongside MySQL.
Use Softaculous for the things it is genuinely good at: standing up a known application quickly and correctly, spinning up a throwaway copy to test something, or installing one of the 240+ packages you would otherwise have to research from scratch.
The installer as it exists on our accounts
Softaculous with its full 240+ application catalogue, WordPress Toolkit, and the cPanel screens described above are on the plans we actually sell — the form you will see matches the form described here.
SSH with Git and Composer is available on every shared tier, so the installer is a convenience rather than the only route in.
- Every field on the form explained by what it costs later
- Database quotas per tier, so a failed install makes sense
- The clean uninstall route, and what the dirty one leaves behind
- Support staffed at any hour if an install misbehaves
Why HostingFast
Standard on every plan
The form, field by field
Directory, username, table prefix and update policy, each explained by the consequence rather than the label.
Quotas made visible
MySQL limits per tier, so the most common silent install failure has an obvious cause.
Clean removal explained
Why deleting the folder leaves a database and a user behind, and what that eventually blocks.
An alternative, stated
Git and Composer over SSH on every shared plan, for the projects an installer should not touch.
Inventory as maintenance
The installations list is what makes patching routine instead of a hunt for what you installed.
Round-the-clock help
An install that half-completes at midnight is a five-minute conversation with a human, not a morning's work.
Quick Start
From order to online
- 1
Confirm you have a database slot free
Sprint allows 25 MySQL databases, Turbo 50, Nitro 100. An install that fails with no useful error is very often the quota, or a target directory that is not empty. Check both before you assume the installer is broken.
- 2
Choose the directory you will still want in a year
Empty means the domain root. Anything else becomes a permanent URL prefix, and moving it later is a full path migration with redirects. Decide this once, deliberately.
- 3
Replace every default credential on the form
A real admin username, a generated password from your manager, and a table prefix that is not the framework's default. Thirty seconds here removes a whole category of automated attempt.
- 4
Switch on auto-update and the pre-update backup
Both cost nothing. They matter most for the apps you will forget about, which are statistically the ones that get exploited. Keep manual control only where an update genuinely risks a custom template.
- 5
Uninstall through the tool, never over SFTP
The tool removes files, database and user together. Deleting the directory alone leaves an orphaned database consuming your quota, and the installations list still claiming the app exists.
Built In
Loaded onto every plan
- Softaculous installs 240+ applications in one click on every plan
- WordPress Toolkit on board, with updates handled for you
- Full SSH access with Git and Composer on every shared tier
- Per-site PHP version switching from the control panel
- NVMe SSD storage behind a LiteSpeed cache on every tier
- A fresh backup daily, restorable from the panel without a ticket
- Free SSL that renews itself before it can lapse
- In-place tier upgrades with no migration when you outgrow a plan
- Money-back cover: 30 days on hosting plans, 7 on reseller
- Support answered by humans at any hour of the day
Frequently Asked
What people ask us most often
Does a Softaculous install differ from installing by hand?
No — it fetches the same official release and unpacks the same files. What differs is the setup around them: the database and user are created for you, the config file is written with correct credentials, permissions are sane, and the install is registered so it can later be cloned, staged, updated or removed cleanly. You can reproduce all of that by hand; the installer just does not make the small mistakes.
Why did my install fail without a useful error?
Two causes cover most cases. Either the account has run out of MySQL databases — 25 on Sprint, 50 on Turbo, 100 on Nitro, and orphaned databases from folder-deleted apps count — or the target directory already contains files and the installer refuses to overwrite them. Check the installations list for apps you thought you had removed, and check the directory over SSH.
Can I deploy with Git and Composer instead?
Yes, on every shared tier. SSH access with Git and Composer is included, so cloning a repository into a document root, running composer install and pointing the vhost at the public directory is a supported route. The business tiers go further with native Node.js, Python and Ruby on Rails deployment and PostgreSQL alongside MySQL.
How do I move an app out of a subdirectory later?
It is a URL migration, which is why the directory field deserves a moment's thought. You move the files, update the application's configured site address, then 301 every old path to its new one and re-submit the sitemap. Nothing about it is hard, but it is an afternoon of careful redirect work rather than a setting, so choose the root at install time unless you have a reason not to.
Keep reading
How to Use phpMyAdmin
Run queries, check indexes and export tables without leaving the browser.
How to Fix the WordPress White Screen
Read the error log instead of guessing which plugin took the site down.
Softaculous (Glossary)
What the installer is, what it registers, and why the uninstall route matters.
Mail Filtering
Spam and virus screening in front of every mailbox, before it reaches you.
Secure Hosting
Imunify protection, free SSL and hardened defaults on the account itself.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
One click for the routine, SSH for the rest.
Softaculous with 240+ applications, WordPress Toolkit, Git and Composer over SSH, NVMe behind a LiteSpeed cache, and no setup fee at any point.
View Mail Filtering plans