How to Launch CakePHP on Vultr: Step by Step

To launch CakePHP on Vultr, deploy an Ubuntu 24.04 LTS Cloud Compute instance, install Nginx, PHP 8.3 FPM and MariaDB, create or clone the app with Composer, and point Nginx at the app’s webroot/ directory. CakePHP 5.4 needs PHP 8.2 or newer, so the stock Ubuntu packages work without extra repositories. The two details that trip people up in 2026 are write permissions on tmp and logs, and the new App.fullBaseUrl check that returns errors in production until you set it.

This guide assumes a single server running the web tier and database together, which suits most CakePHP apps until they have real traffic. Every command below was written for Ubuntu 24.04 with its default PHP 8.3 packages. If you have already deployed PHP on Vultr, the flow will feel familiar from our Laravel on Vultr guide; the CakePHP specifics are in the configuration and permissions sections.

Choose and deploy the Vultr instance

Vultr’s shared CPU line is called Cloud Compute, with Regular Performance, High Performance and High Frequency tiers. Dedicated CPU plans are sold separately as Optimized Cloud Compute. These are the Regular Performance sizes that matter for CakePHP, as listed on the Vultr pricing page in September 2026:

In the Vultr console, go to Products, Compute and click Deploy, then follow the Vultr provisioning steps: choose Shared CPU, a region near your users, the plan, and Ubuntu 24.04 under Configure Software. Add your SSH key, set a hostname, and consider Automatic Backups. If you enable Limited User Login, Vultr creates a sudo user called linuxuser and locks direct root login.

Secure the server

ssh root@YOUR_VULTR_IP        # or linuxuser@ with Limited User Login

sudo apt update && sudo apt upgrade -y
sudo adduser deploy
sudo usermod -aG sudo deploy
sudo rsync --archive --chown=deploy:deploy ~/.ssh /home/deploy/

sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status

Log in again as deploy before continuing. Vultr also offers Firewall Groups at the network level, which you can layer on top of UFW if you manage several instances.

Install Nginx, PHP 8.3, MariaDB and Composer

CakePHP 5 needs the intl, mbstring, SimpleXML and PDO extensions. On Ubuntu, SimpleXML ships in php8.3-xml and PDO MySQL in php8.3-mysql.

sudo apt install -y nginx mariadb-server git unzip acl \
  php8.3-fpm php8.3-cli php8.3-intl php8.3-mbstring php8.3-xml \
  php8.3-mysql php8.3-zip php8.3-curl

php -v
php -m | grep -Ei 'intl|mbstring|simplexml|pdo_mysql'

sudo mariadb-secure-installation

curl -sS https://getcomposer.org/installer -o composer-setup.php
sudo php composer-setup.php --install-dir=/usr/local/bin --filename=composer
rm composer-setup.php
composer --version

Create the database and a dedicated user. Use utf8mb4 so emoji and all other four byte characters survive.

sudo mariadb
CREATE DATABASE cakeapp CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'cakeapp'@'localhost' IDENTIFIED BY 'a_long_random_password';
GRANT ALL PRIVILEGES ON cakeapp.* TO 'cakeapp'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Create or deploy the CakePHP app

The current release is CakePHP 5.4.2, published September 6, 2026, and it requires PHP 8.2 or newer. For a fresh project, use the command from the official installation guide:

sudo mkdir -p /var/www && sudo chown deploy:www-data /var/www
cd /var/www
composer create-project --prefer-dist cakephp/app:~5.0 cakeapp
# When asked "Set Folder Permissions ? (Default to Y)", answer n

create-project also installs development packages such as DebugKit and Bake. The skeleton only loads DebugKit in debug mode and Bake on the command line, so they sit idle in production, but once the project lives in Git it is cleaner to deploy it like any other app. For an app you built locally, clone it and install production dependencies only:

git clone git@github.com:you/cakeapp.git /var/www/cakeapp
cd /var/www/cakeapp
composer install --no-dev --optimize-autoloader

The same script also copies config/app_local.example.php to config/app_local.php and writes a random security salt into it. That file is listed in the skeleton’s .gitignore, so it never reaches your repository.

Configure app_local.php for production

Open config/app_local.php and change three things. debug defaults to true. The database block needs your credentials. And App.fullBaseUrl must be set, because the current 5.x app skeleton includes a HostHeaderMiddleware that throws an error in production when it is missing and rejects requests whose Host header does not match it.

<?php
use function Cake\Core\env;

return [
    'debug' => false,
    'App' => [
        'fullBaseUrl' => 'https://example.com',
    ],
    'Security' => [
        'salt' => env('SECURITY_SALT', 'keep_the_generated_value_here'),
    ],
    'Datasources' => [
        'default' => [
            'host' => 'localhost',
            'username' => 'cakeapp',
            'password' => 'a_long_random_password',
            'database' => 'cakeapp',
        ],
    ],
];

Keep the salt the installer generated and never change it after launch, since CakePHP also uses it as the encryption key. Then make the file unreadable to other users with chmod 640 config/app_local.php.

Set permissions on tmp and logs

PHP FPM runs as www-data, while you run bin/cake as deploy. Both need to write to the same cache and log files. ACLs, which the CakePHP docs also use, solve this cleanly, and the -d flag makes new files inherit the rules.

cd /var/www/cakeapp
sudo chown -R deploy:www-data .
sudo setfacl -R -m u:www-data:rwX -m u:deploy:rwX tmp logs
sudo setfacl -R -d -m u:www-data:rwX -m u:deploy:rwX tmp logs

With permissions in place, run the migrations and warm the caches:

bin/cake migrations migrate
bin/cake cache clear_all
bin/cake schema_cache build --connection default

Nginx, the webroot and free TLS

Only webroot/ should be reachable from the internet. Pointing Nginx at the project root would expose config/ and vendor/. The first server block sends www traffic to the bare domain so the Host check never fails. Save this as /etc/nginx/sites-available/cakeapp:

server {
    listen 80;
    listen [::]:80;
    server_name www.example.com;
    return 301 $scheme://example.com$request_uri;
}

server {
    listen 80;
    listen [::]:80;
    server_name example.com;
    root /var/www/cakeapp/webroot;
    index index.php;
    client_max_body_size 20M;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
    }

    location ~ /\.(?!well-known) {
        deny all;
    }
}

The try_files line serves real files from webroot, such as CSS, JavaScript and images, directly, and hands every other URL to index.php. That is how CakePHP’s router receives clean URLs on Nginx without any rewrite rules. Enable the site and add HTTPS:

sudo ln -s /etc/nginx/sites-available/cakeapp /etc/nginx/sites-enabled/
sudo rm /etc/nginx/sites-enabled/default
sudo nginx -t && sudo systemctl reload nginx

sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/local/bin/certbot
sudo certbot --nginx -d example.com -d www.example.com
sudo certbot renew --dry-run

Point both DNS records at the instance IP before running certbot. Let’s Encrypt no longer sends expiry emails and is shortening certificate lifetimes over the next two years, so a passing dry run matters more than it used to.

Troubleshooting

• 500 error mentioning “App.fullBaseUrl is not configured”. Debug is off and the base URL is empty. Set App.fullBaseUrl in app_local.php or the APP_FULL_BASE_URL environment variable.
• 400 “Invalid Host header”. The request host differs from fullBaseUrl, usually because you opened the site by IP or through www. Browse via the canonical domain and keep the redirect block.
• 502 Bad Gateway. Nginx cannot reach PHP FPM. Run systemctl status php8.3-fpm and confirm the socket path is /run/php/php8.3-fpm.sock.
• “Permission denied” writing to tmp/cache or logs. Files were created before the ACLs existed. Rerun both setfacl commands, then bin/cake cache clear_all.
• Composer is killed on a 1 GB instance. Add swap with sudo fallocate -l 2G /swapfile, chmod 600, mkswap and swapon, or resize the plan.

Frequently asked questions

What PHP version does CakePHP 5 need?

CakePHP 5.4 requires PHP 8.2 or newer, plus the intl, mbstring, SimpleXML and PDO extensions. Ubuntu 24.04 ships PHP 8.3, which sits comfortably inside the supported range, so you can install everything from the standard Ubuntu repositories without adding a third party PPA to your Vultr server.

Which Vultr plan should I pick for CakePHP?

Start with the Regular Performance instance with 1 vCPU and 2 GB of memory, listed at $10 per month. It runs Nginx, PHP FPM and MariaDB together with headroom for Composer. The 1 GB plan works for small projects with swap, and you can resize upward later from the Vultr console.

Should I use Ubuntu 26.04 instead of 24.04?

You can, but 26.04 ships PHP 8.5. CakePHP’s test suite already runs on 8.5, yet the installation guide still names 8.4 as the supported version. Ubuntu 24.04 with PHP 8.3 is the conservative choice. If you pick 26.04, replace every php8.3 package and socket path with php8.5 and test thoroughly.

Can I use MySQL instead of MariaDB?

Yes. CakePHP’s documentation lists support for MySQL 5.7 and newer as well as MariaDB, PostgreSQL, SQL Server and SQLite. Install mysql-server instead of mariadb-server and keep the same database commands. Either way, the php8.3-mysql package provides the PDO driver CakePHP needs.

Why does my live site show detailed error pages?

Because debug is still true. The example config reads a DEBUG environment variable and falls back to true when it is missing, so a fresh app_local.php starts in debug mode. Set it to false, clear the cache with bin/cake cache clear_all, and reload PHP FPM.

The bottom line

CakePHP on Vultr is a standard LEMP build with three CakePHP specific steps: point Nginx at webroot/, give tmp and logs proper ACLs instead of world write access, and configure app_local.php for production with debug off and fullBaseUrl set.

A 2 GB Regular Performance instance is enough for most apps. Once the first deploy works, turn it into a short script and take a Vultr snapshot, and every future release becomes a routine job.

About this article: GeekBlog covers U.S. technology news, AI, phones, smartwatches and gaming. Every story is written and checked under our Editorial Policy. Spotted a mistake or have a story tip? Contact our editors.