Requirements

What the server needs before the first upload. An ordinary cPanel, Plesk or DirectAdmin hosting plan runs the site; a VPS gives YouTube more ways out (yt-dlp, a second address, a proxy of your own).

The server

• PHP 8.1 or newer (8.2 and 8.3 are fine). On an older PHP the script stops at once with This script needs PHP 8.1.0 or newer. You are running …
• MySQL or MariaDB, with one empty database and a user that has all privileges on it. The tables are made with the utf8mb4 character set and start with the prefix aiod_ unless you choose another one.
• Apache or LiteSpeed with URL rewriting (the .htaccess in the package does the rest), or Nginx with the server block from nginx.conf.example.
• No Composer, no FFmpeg and no command line are needed. Everything is done in the browser.

PHP extensions

The installer checks all of them on its first screen. A missing required extension shows a red cross and stops the installer; a missing optional one shows an orange mark. allow_url_fopen is not needed. On cPanel you switch extensions on under Select PHP Version → Extensions.

Treat zip as required in practice: without it Admin → Updates cannot install a new version or take a backup.

Folders that must be writable

storage/ (with cache/, logs/ and sessions/ inside), uploads/, modules/, plugins/ and themes/, and the folder of the site itself while the installer writes config.php. Permissions 755 for folders and 644 for files are right on almost every host, as long as the owner is the account the website runs as.

storage/ holds the cache, the logs, the sessions, yt-dlp (storage/bin), the backups and the update packages. It is closed to the web. uploads/ holds your logos, pictures and the app files.

For updates from the admin panel PHP must also be able to replace the files of the script. The Updates page says so when it cannot.

The web server

Apache and LiteSpeed

The .htaccess in the package works at the root of a domain, on a sub domain and in a sub folder without any change (no RewriteBase is needed). It also closes storage/, includes/, app/, languages/ and config.php to visitors. File managers often hide files that start with a dot: switch on Show hidden files to see that it is there.

Nginx

Use nginx.conf.example as your server block. Replace the root path and the PHP-FPM socket. Keep these lines as they are:

• client_max_body_size 64M; for uploads.
• fastcgi_read_timeout 3600; and fastcgi_buffering off; so long downloads keep flowing.
• try_files $uri /index.php$is_args$args; without $uri/: a folder must never answer 403 for /admin.

For a sub folder, change location / to location /folder/ and the fallback to /folder/index.php$is_args$args wherever it appears.

Main domain, sub domain or sub folder

All three work, and nothing has to be edited for any of them. The site works out its own address from each visit: AIOD_BASE_URL in config.php stays empty. Your licence counts the host name, so www.example.com and example.com are the same site, and a sub domain is a site of its own.

Connections out of the server

A downloader talks to other servers all day. The server must be allowed to open HTTPS connections to:

• the platforms your visitors use (YouTube, Facebook, Instagram, TikTok and the others);
• license.faruk.bd, for the licence and for updates;
• github.com, when yt-dlp or Deno is installed from the admin panel.

A plan that blocks outgoing connections cannot run a downloader. The script carries its own list of certificates (storage/cacert.pem), so an old certificate store on the server does not stop it.

Downloads pass through your server: a busy site uses as much bandwidth as its visitors download. Settings → Monetization → Bandwidth saving mode sends visitors straight to the platform instead, but some platforms (YouTube among them) refuse such direct links.

Upload limits

The .htaccess raises PHP's upload limit to 64 MB where PHP runs as an Apache module. Elsewhere set upload_max_filesize and post_max_size in the PHP settings of your hosting panel (cPanel: MultiPHP INI Editor). This matters for Install from a ZIP file on the Updates page and for plugin, theme and module uploads.

Optional

• A cron job every ten minutes. Without one the site keeps its tasks going from the pages people open. See Scheduled jobs.
• PHP that may start programs (the PHP function proc_open). yt-dlp needs it; on many shared plans only the host can switch it on. Everything else works without it; private YouTube videos do not. See YouTube and yt-dlp.
• For yt-dlp: nothing more on most Linux servers, because the stand-alone build is used first. Otherwise Python 3.10 or newer for the small Python edition. YouTube also wants a JavaScript runtime: Deno (one button on the yt-dlp page installs it) or Node 20 or newer.
• An SMTP mailbox on your own domain. E-mail from PHP's own mail() often lands in spam. Set it on Settings → E-mail.
• HTTPS. System check reminds you when the panel is not served over HTTPS. A free Let's Encrypt certificate is enough.