How to Install OJS Step by Step (OJS 3.4 / 3.5)

Before you start: what you need

Open Journal Systems (OJS) is a PHP application with a database. Before installing, make sure you have:

• A domain or subdomain for the journal, for example journal.youruniversity.edu. A dedicated subdomain keeps URLs clean and makes HTTPS simple.
• Hosting with a supported PHP version and the common extensions (mbstring, xml, intl, gd, zip, curl and the MySQL or PostgreSQL driver). Full details are in our OJS system requirements guide.
• A MySQL/MariaDB or PostgreSQL database and a database user.
• A folder outside the web root for uploaded files. On cPanel this is anywhere in your home directory except public_html.
• An SMTP mailbox (for example editor@yourjournal.org) so OJS can send notifications reliably.
• An SSL certificate. Most hosts provide a free Let's Encrypt certificate through cPanel's AutoSSL.

Which OJS version should you install?

For a new journal, install the latest stable release listed on PKP's download page. PKP also designates some releases as long-term support (LTS); if your host can only run an older PHP version, pick the newest release that supports it rather than an outdated, unsupported one.

Exact PHP and database requirements change between point releases, so always read the README and release notes inside the package you download.

Step 1: Download OJS from PKP

Download OJS only from the official PKP download page. Packages from third-party sites can contain modified code or backdoors. The release is a .tar.gz archive named like ojs-3.x.x-x.tar.gz.

Step 2: Create the database and database user

On cPanel: open MySQL® Database Wizard, then:

1. Create a database

   For example ojs. cPanel adds your account prefix, so the real name becomes something like cpuser_ojs. Note the full name.

2. Create a database user

   Use a long, random password and save it in your password manager.

3. Grant ALL PRIVILEGES

   Add the user to the database with all privileges. OJS needs to create and alter tables during installation and upgrades.

On a VPS, the equivalent SQL for MySQL/MariaDB is:

CREATE DATABASE ojs DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'ojs'@'localhost' IDENTIFIED BY 'use-a-long-random-password';
GRANT ALL PRIVILEGES ON ojs.* TO 'ojs'@'localhost';
FLUSH PRIVILEGES;

Step 3: Upload and extract OJS

1. Upload the archive

   In cPanel File Manager, open the document root of your journal domain (often public_html, or the folder you assigned to the subdomain) and upload the .tar.gz file.

2. Extract it

   Right-click and choose Extract. This creates a folder such as ojs-3.x.x-x.

3. Move the contents into place

   Move everything inside that folder up into the document root (or rename the folder if you want OJS in a subfolder). The document root should now contain index.php, config.TEMPLATE.inc.php, lib/, plugins/ and so on.

4. Prepare config.inc.php

   If the package contains only config.TEMPLATE.inc.php, copy it and name the copy config.inc.php. The installer writes your settings into this file.

Step 4: Create the files directory (outside the web root)

Create a folder that the web server can write to but browsers cannot reach, for example:

• cPanel: /home/cpuser/ojs-files (next to, not inside, public_html)
• VPS: /var/www/ojs-files when OJS lives in /var/www/ojs

Step 5: Set file and folder permissions

The web server must be able to write to these locations (and their contents):

• config.inc.php (during installation only)
• public/
• cache/, including cache/t_cache, cache/t_config, cache/t_compile and cache/_db
• your files directory, for example /home/cpuser/ojs-files

On most cPanel servers PHP runs as your own user, so the default permissions (755 for folders, 644 for files) already work. On a VPS, give ownership of only these paths to the web server user instead of making everything writable:

cd /var/www/ojs
sudo chown -R www-data:www-data cache public /var/www/ojs-files
sudo chown www-data:www-data config.inc.php

Never use chmod 777. It lets any process on the server modify your journal.

Step 6: Run the OJS web installer

Visit your journal address in a browser. OJS detects that it is not installed and shows the installation form:

1. Language settings

   Choose the primary language and any additional languages the journal will publish in. You can add more later.

2. Administrator account

   Pick a username that is not "admin", a strong password and an email address you check. This is the site administrator, above all journal managers.

3. Database settings

   Driver (MySQLi for MySQL/MariaDB, or PostgreSQL), host (usually localhost), the full database name, username and password from Step 2.

4. Files directory

   Enter the absolute path from Step 4, for example /home/cpuser/ojs-files. The installer checks that it exists and is writable.

5. Remaining options

   Set the OAI repository identifier (your domain is fine) and decide whether to join the PKP Beacon, which shares anonymous usage data with PKP. Then click Install Open Journal Systems.

If the installer cannot save config.inc.php, it displays the full configuration. Copy it into config.inc.php manually and save. A successful install ends with a confirmation page and a link to log in.

Step 7: Configure config.inc.php for production

Open config.inc.php and review these settings. Section names are shown in square brackets.

Base URL and HTTPS

[general]
installed = On
base_url = "https://journal.example.org"

[security]
force_ssl = On

Install the SSL certificate first (cPanel SSL/TLS Status → Run AutoSSL, or certbot on a VPS), then switch base_url to https://. A wrong base_url is the usual cause of missing CSS and redirect loops.

Clean URLs (remove index.php)

By default OJS URLs look like /index.php/journal/article/view/12. To remove index.php, set restful_urls = On under [general] and make sure Apache mod_rewrite is enabled with this .htaccess in the OJS root:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.*)$ index.php/$1 [QSA,L]
</IfModule>

Email (SMTP)

PHP's built-in mail function is frequently blocked or marked as spam. Send through an authenticated SMTP mailbox instead. In OJS 3.4 and later:

[email]
default = smtp
smtp_server = mail.example.org
smtp_port = 587
smtp_auth = tls
smtp_username = editor@example.org
smtp_password = "your-mailbox-password"
default_envelope_sender = editor@example.org
force_default_envelope_sender = On

In OJS 3.3 the switch is smtp = On instead of default = smtp; the other keys are the same. Also add SPF, DKIM and DMARC records for your domain so journal emails reach inboxes. If emails still fail, see fixing OJS email problems.

Scheduled tasks (cron)

OJS uses scheduled tasks for review reminders, statistics processing and DOI/indexing deposits. Enable them under [general] with scheduled_tasks = On, then add a cron job. In cPanel open Cron Jobs and add an hourly job such as:

0 * * * * /usr/local/bin/php /home/cpuser/public_html/tools/runScheduledTasks.php

The PHP binary path differs between hosts (check with your provider). Newer OJS releases changed how scheduled tasks and background jobs run, so confirm the exact command in the README or docs/ folder of the version you installed.

Turn off debugging output

Under [debug], keep show_stacktrace = Off and display_errors = Off on a live site. Error details shown to visitors reveal file paths and help attackers.

Step 8: Create your first journal

1. Log in as administrator

   Go to Administration → Hosted Journals → Create Journal.

2. Enter the basics

   Journal title, initials, a short description and the path, which becomes part of every URL (for example jmr). Keep the path short, lowercase and permanent.

3. Complete the settings

   Work through Settings → Journal (masthead, contact, sections), Website (theme, navigation, plugins), Workflow (submission checklist, review, emails) and Distribution (licence, DOIs, search indexing).

4. Create users and roles

   Add the editorial team under Users & Roles. Give journal manager rights to as few people as possible.

Next steps: choose a theme (see our comparison of free OJS themes), set up DOIs with Crossref, and publish your journal policies before inviting submissions.

Installing OJS on a VPS (command line)

On a fresh Ubuntu or Debian server with Apache and MariaDB, the core steps look like this. Replace the version number with the release you downloaded, and adjust PHP package names to your distribution.

# 1. Web server, database and PHP extensions
sudo apt update
sudo apt install apache2 mariadb-server php libapache2-mod-php \
  php-mysql php-mbstring php-xml php-intl php-gd php-zip php-curl

# 2. Download and extract OJS (use the current release from pkp.sfu.ca)
cd /var/www
sudo wget https://pkp.sfu.ca/ojs/download/ojs-3.x.x-x.tar.gz
sudo tar -xzf ojs-3.x.x-x.tar.gz
sudo mv ojs-3.x.x-x ojs
sudo cp ojs/config.TEMPLATE.inc.php ojs/config.inc.php

# 3. Files directory outside the web root + permissions
sudo mkdir /var/www/ojs-files
sudo chown -R www-data:www-data /var/www/ojs/cache /var/www/ojs/public /var/www/ojs-files
sudo chown www-data:www-data /var/www/ojs/config.inc.php

# 4. Enable URL rewriting and get a certificate
sudo a2enmod rewrite
sudo certbot --apache -d journal.example.org

Point your Apache virtual host's DocumentRoot at /var/www/ojs with AllowOverride All, then finish with the web installer (Step 6). Using Nginx? OJS relies on PATH_INFO, so your PHP location block needs fastcgi_split_path_info. See the Nginx configuration example.

Common OJS installation errors and fixes

After changing configuration or templates, clear the caches under Administration → Clear Data Caches and Clear Template Cache.

Production launch checklist

• Files directory is outside the web root and not reachable from a browser.
• HTTPS works everywhere and base_url starts with https://.
• SMTP email delivers to Gmail and Outlook inboxes (test registration and a review request).
• Scheduled tasks run (check Administration → Scheduled Tasks or the task log).
• Debug output and stack traces are switched off.
• reCAPTCHA or another protection is enabled for registration. See stopping OJS spam registrations.
• Automatic daily backups cover the database, files directory and public/ folder, and you have tested a restore.
• You are subscribed to PKP release announcements so you can apply security updates quickly.

Would you rather skip the server work? Our OJS installation service covers everything in this guide, including email, cron, SSL and hardening, and you get a tested, production-ready journal.

Frequently Asked Questions