OpenCart

Last reviewed Aug 26, 2026 · 831 words

Before you install OpenCart, check which major version the three extensions you cannot live without support. The 4.x line rewrote the extension architecture, most of the marketplace was written for 3.x, and an extension built for one will not load on the other. That single fact shapes the whole decision: 4.x is the future and the one to start on, 3.x is where the depth is, and a shop that picks the version by feature list rather than by extension availability will find out in week two.

What the low footprint buys you

OpenCart runs on a stock PHP and MySQL stack in 256 MB of RAM, no queue worker, no Node build step, no search service. A cheap shared host runs it; a 1 GB VPS runs it with room for the database. Install is the classic upload-and-click: put the files in the web root, browse to the site, walk through the installer that writes config.php and admin/config.php, then delete the install/ directory and rename admin/ to something unguessable. Docker images exist from third parties, but the project's own path is the web installer, and for a PHP monolith that is honestly fine.

Out of the box you get products with options and attributes, categories, customer groups with different pricing, coupons and vouchers, reviews, reports, multiple currencies and languages, and multi-store from one admin, meaning several storefront domains sharing a catalogue and a login. That last one is the feature that keeps small retailers on OpenCart: a wholesale site and a retail site on one database with different prices is a five-minute setup here and a plugin purchase elsewhere.

The extension marketplace is the product, and the risk

Payment gateways beyond the bundled ones, shipping calculators, SEO packs, themes, and integrations with accounting software all come from the marketplace, much of it paid at 20 to 100 dollars per extension at last check. Quality varies more than on WooCommerce because the community is smaller, and the smaller community shows up here as extensions abandoned when their author moves on. Before buying, check the extension's last update date against the OpenCart release you run, and prefer authors with several extensions and a support history. Modifications are applied through the OCMOD system, which patches core files at load time from XML; it is clever, it works, and a conflicting pair of OCMOD extensions can take a shop down until you find which one.

Hold the core version steady during trading periods. Minor upgrades are usually safe, major ones are a migration project with a test copy first.

Hardening the parts every PHP shop gets wrong

Three items do most of the work. Rename the admin directory and set the new name in admin/config.php; automated scanners hit /admin constantly. Make config.php and admin/config.php read-only after install, and keep system/storage outside the web root, which the installer offers to do for you. Put the whole site behind TLS with a reverse proxy or the host's certificate, because the checkout page is where card details enter and no gateway will operate over plain HTTP.

Back up the database and the image/ directory, which holds product photos. A mysqldump and a tarball nightly is enough; test a restore into a staging copy before your first sale season, not after. The 12 self-hosting mistakes post covers the rest of the hygiene that applies to any public web app.

Where it sits against the neighbours

WooCommerce has a far larger ecosystem and is the default if you already run WordPress; it is also heavier and slower on the same box. PrestaShop is the closer rival: also PHP, also a monolith, more features built in, more resource-hungry and more complex to theme. OpenCart wins on install simplicity, resource use and multi-store; it loses on advanced features like proper inventory management across warehouses, B2B quoting, and a marketplace deep enough that you never have to write code. The ecommerce category lists the headless frameworks too, but those are for shops with developers, not the small retailer this tool exists for.

What I'd do

For a small retailer with a catalogue in the hundreds of products, one or two storefront domains and no developer on staff, install OpenCart 4.x on a 2 GB VPS behind Caddy, rename the admin directory on day one, and buy only extensions that were updated for your exact version in the last year. Stay on 3.x only if a specific extension you depend on has not been ported, and put a reminder in the calendar to re-check. If your catalogue is heading past 10,000 SKUs or you need warehouse logic, choose PrestaShop or a headless framework from the start; OpenCart's charm is that it is small, and it stays charming only while the shop is too.