Flarum is the forum you reach for when the honest requirements are small, modern, and still PHP. It is a Mithril single-page app on a PHP back end. It looks like 2026 on a shared host that will never run Discourse’s Docker stack. It is also not a XenForo replacement for a board that lives on Resource Manager, a credits shop, and forty add-ons, and it is not a Discourse replacement for a team that wanted official hosted and trust levels.
This article is the when. Requirements from docs.flarum.org, Composer and the extension-manager trust model, the 1.x life-support trajectory versus 2.0 in RC, unofficial importers, and a clean no. It is not the XenForo versus Discourse matrix. It is not a third column pretending to be that matrix. If you need the three-way later, that is a different piece. Here you are trying to decide whether Flarum is the right small product, not whether it wins a feature war.
Official facts below come from the Flarum docs (requirements, extensions, installer). Community facts (importers, 1.x support posture) are labelled. Where the docs are silent, this article is silent.
What Flarum actually is
A Flarum site is:
- PHP on Apache (
mod_rewrite) or Nginx. - A Mithril SPA front end. The browser is doing more work than a classic phpBB page. That is why it feels modern. It is also why “view source and scrape the HTML” is the wrong mental model.
- Composer-installed. You do not unzip a mystery archive into
public_htmland hope, except for the documented install paths that still end in Composer. - Extension-first. Tags, likes, and a lot of what you think of as “forum features” are extensions, including first-party ones. The core is deliberately thin.
- Not Docker-mandatory. Shared PHP hosting is possible if the host meets the PHP / MySQL / rewrite bar. That is the operational difference versus Discourse.
It is closer, culturally, to “a modern phpBB you might actually show a new user” than to “a XenForo you did not pay for.” The moment you need Analyze permissions, widgets, XFRM, or a 15-year style-property tree, you are in the wrong aisle.
Requirements (1.x docs)
Published requirements you should treat as the floor:
| Piece | What the docs say |
|---|---|
| Web server | Apache with mod_rewrite, or Nginx |
| PHP | 7.3+. 1.x runs up to PHP 8.5 with deprecation notices. PHP 8.3 is recommended for 1.x. |
| Database | MySQL 5.6+ / 8.0.23+, or MariaDB 10.0.5+ |
| Tooling | Composer |
| Current 1.x archive | 1.8.17 |
PHP 8.3 recommended is the line to give a host. “We are on 8.5 and the error log is noisy” is a known posture, not a mystery. Do not call 8.5 the happy path.
You also need a host that will let you run Composer (SSH or a documented workaround) and write to the right directories. A classic FTP-only shared host with PHP 7.2 and no rewrite is not a Flarum host. It might still be a phpBB host.
Compared with XenForo: XF’s public floor is PHP 7.2 (8.3 recommended) and MySQL 5.7+. The stacks overlap. That is the point. A contractor who can restore XenForo can learn Flarum without becoming a Docker person.
Compared with Discourse: official production Discourse is Docker, 1 GB RAM with swap minimum, 2 GB+ recommended, ports 80/443 owned by the installer. Flarum does not ask you for that. If the only box you can buy is PHP shared hosting, Flarum is in the running and Discourse is not (unless you pay official hosted).
1.x is on life support; 2.0 is RC
This is the planning fact people skip because the demo is pretty.
- Flarum 1.x is on life support — critical and security fixes, not a feature train.
- 2.0 is in RC. Plan the upgrade. Do not claim 2.0 is stable GA unless you are quoting a docs page that has changed since this article. At the time of writing, RC means RC.
Operational consequences:
- A new community starting in 2026 should read the 2.0 RC notes and decide whether to start on 2.0 RC (accept RC risk) or start on 1.8.17 knowing a major upgrade is the next project. There is no third option called “1.x forever, feature-complete.”
- An existing 1.x community should budget the 2.0 upgrade the way XenForo admins budget a 2.2 → 2.3 weekend: extensions first. Thin core means the extension catalogue is the risk, not the three core tables.
- Do not build a paid product or a five-year contract on 1.x assumptions. Life support is an honest phrase. Believe it.
If RC scares you and 1.x life support scares you, that is information. XenForo is a paid, stable 2.3. Discourse is a rolling open-source product with official hosted. phpBB 3.3 is still receiving 3.3.x releases (3.3.17 cited June 2026 in our notes). Flarum’s job is the modern PHP shape, not the most conservative governance.
Extension philosophy (the real product)
Most of the forum is extensions. Tags are an extension. Likes are an extension. The first-party set is how a fresh install becomes usable. Third-party extensions are how it becomes yours.
That philosophy has a trust model you must say out loud:
Extension Manager
composer require flarum/extension-manager:"*"The Extension Manager can install any Composer package. Anyone you make an admin can point it at a package. Trust all admins. This is not XenForo’s “upload a zip the ACP understands.” This is “root-equivalent for the PHP app.”
Practical rules:
- Admin accounts are few. Named humans. Not “the helpful Regular.”
- Do not give a contractor admin so they can install one extension unless you would give them SSH.
- Pin versions in Composer when you can.
*is convenient and how you get a surprise on Friday. - An extension that is abandoned on 1.x is a 2.0 blocker. Inventory before you promise a date.
The catalogue is smaller than XenForo’s. That is not a slur. It is why Flarum stays light, and why a game hub with a live server list and a shop will not find “the” add-on. The gaming fit test was written about Discourse; the extras paragraph applies here with more force. Flarum’s third-party scene is not XF’s.
What “install an extension” means operationally
You are running Composer on production or on a build you then deploy. Shared hosts vary from “SSH works” to “we put Composer in a wrapper.” If your host forbids CLI, you are fighting the product. A small VPS with PHP 8.3, MariaDB, and Nginx is a happier Flarum home than a locked cPanel, even though shared can work.
Enable / disable happens in the admin extension list. Cache and assets will need a refresh after changes — follow the current docs commands for your version rather than a 2021 gist. This article will not invent an ACP button name the 2.0 RC might have renamed.
Information architecture: tags are not a side salad
Flarum’s public IA is tags (the first-party tags extension) rather than a XenForo node tree or a Discourse category-plus-tag split. You can build primary tags that behave like rooms and secondary tags that behave like prefixes. You can also build a soup.
A workable small-site map:
| Primary tag (room) | Secondary tags | Notes |
|---|---|---|
| Announcements | — | Staff-only start. Members follow. |
| General | optional topic-type | Default “I don’t know where” |
| Support | version / product | Require a secondary tag if the UI lets you |
| Meta | — | Site talk |
| Staff (hidden) | — | Private. Groups, not wishful thinking. |
That is the same count we recommend on Discourse in the beginner guide. The difference is product grammar: Discourse has categories and tags; Flarum leans on tags for both jobs. Do not recreate 40 phpBB forums as 40 primary tags. You will get a modern-looking empty mall.
Permissions hang off groups and tags. The language is smaller than XenForo’s Never/Yes/No plus Analyze permissions. Enough for staff / members / guests / one private tag. Not enough for twelve factions without pain. If your community is an ACL, Flarum is the wrong lightweight tool.
Hosting shapes that make sense
Shared PHP that actually meets the docs. Rewrite on, PHP 8.3, MariaDB current enough, Composer possible. Cheapest path. You share noisy neighbours. Fine for a 500-member hobby.
Small PHP VPS. Same stack as a small XenForo. You control PHP-FPM and backups. This is the default professional home.
Not: a 1 GB Docker box you were saving for Discourse, unless you enjoy extra moving parts. Flarum does not need the Discourse installer. Putting it in Docker because you like Docker is a team preference, not a requirement.
Not: FTP-only PHP 7.1. Upgrade the host or pick phpBB and be honest.
Backups are the same species as any PHP app: database plus the public/assets/storage directories the docs name for your version. Test a restore. There is no official “Flarum Cloud” with the gravity of Discourse’s hosted grid. You own the box.
Unofficial importers (do not call them official)
Flarum does not ship official importers the way XenForo ships a customer-area Importers add-on (phpBB 3.2–3.3, Discourse 3.x, vBulletin, IPS, MyBB, SMF, XenForo). Community unofficial importers exist for shapes like FluxBB, MyBB, phpBB, SMF2. Quality varies. A phpBB hop is a common story: old board → phpBB (documented) → Flarum (community) — or old board → phpBB → XenForo (official) if you decide mid-project that you wanted XF after all.
Rules for a Flarum import:
- Treat every importer as community. Read the last commit date. Run it on a copy.
- Expect to reset passwords unless a specific importer’s README says otherwise. Do not invent a hash story.
- Expect attachments and avatars to need a second pass.
- If the source is XenForo, there is no official Flarum-side
xenforo.rb. You are in custom-script territory or you hop. Compare that with Discourse, which at least has a stockxenforo.rb(see the XF → Discourse runbook). - If the source is phpBB 3.2–3.3 and you might want XenForo instead, the official XF importer is the conservative path.
Greenfield Flarum is much easier than migrated Flarum. A new club, a new OSS project, a classroom: install 1.8.17 or the 2.0 RC, add the first-party extensions, invite twenty people. That is the happy path.
When Flarum is the right choice
Say yes when most of these are true:
- Small or new. Hundreds of members, not a 15-year archive you must 301 perfectly.
- PHP is the constraint. The org will not pay Discourse hosted (~$100 / ~$500 public 2026 Pro / Business — re-check live). The org will not run Docker. A PHP person exists.
- Modern UI matters and you do not want to theme XenForo into looking like 2026.
- Features are discussion plus tags plus a few extensions. Not a shop, not a media suite, not a resource directory, not a live server grid.
- You accept 1.x life support / 2.0 RC as the 2026 planning reality.
- Admins are few and trusted (Composer).
- You are willing to live with a smaller extension catalogue and to write process where XF would have sold you an add-on.
Typical good fits: a club or classroom; a small open-source project that wants something nicer than phpBB and cheaper than XF; a side community next to a main site; a prototype of a larger community you might later move.
Typical “looks like a fit, is not”: a XenForo board whose members bought extras; a game hub; a site whose homepage is a widget layout; a procurement team that needs a vendor SLA (look at Discourse hosted or XenForo Cloud instead).
When it is the wrong choice
Add-on-heavy XenForo. If XFRM, XFMG, Enhanced Search, a credits plugin, or a whitelist product are load-bearing, Flarum is a downsize dressed as a refresh. Stay, or budget a rebuild you can name.
You actually wanted Discourse. Trust levels, official hosted, review-queue automation, a serious plugin/theme-component ecosystem around Meta. Flarum will not grow those because you installed a SPA. Pay for hosted Discourse or run Docker.
You actually wanted phpBB. Zero license, huge install base, official XF import out. Flarum is more modern and more Composer-shaped. phpBB is more conservative. If the community is allergic to SPAs and CLI, phpBB 3.3.17 is the honest cheap forum.
You need official importers. XF is the adult in the room.
You need a last-post board index. Flarum’s SPA is a discussion stream. So is Discourse. XenForo and phpBB still think in rooms.
You cannot trust every admin with Composer. Fix the staff list or pick a product whose ACP cannot composer require the internet.
A week on Flarum (so the “when” is concrete)
Monday. You check that PHP-FPM did not fill the disk with logs. You glance at the extension list you have not touched since last month. There is no Docker rebuild. There is no XF “outdated templates” page. A member cannot see a hidden tag; you open the tag’s group permissions and fix one row.
Wednesday. Someone wants likes, mentions, and a markdown table. Two of those are extensions. You read the last update date. You install on staging. You do not install from a random GitHub zip on production as admin because the Extension Manager could, and that is the point of the trust model.
Friday. A 2.0 RC note drops. You read whether your three third-party extensions have branches. If they do not, you stay on 1.8.17 another quarter and you write that down so you do not pretend you are on a feature train.
None of this is XenForo’s Monday (widgets, Analyze permissions, add-on upgrades). None of it is Discourse’s Monday (review queue, TL3 demotion, ./launcher rebuild app). It is a small PHP forum’s Monday. If that paragraph feels like your staffing reality, the product fits.
Cost shape (no invented Flarum prices)
Flarum the software is free. Cost is hosting plus time plus the risk of abandoned extensions.
| Path | License | Typical home | Who it is “cheaper” for |
|---|---|---|---|
| Flarum 1.8.17 / 2.0 RC | $0 | Shared PHP or small PHP VPS | Hobby, club, prototype, PHP-only shops |
| phpBB 3.3.x | $0 | Same | People who want conservative, not SPA |
| XenForo | $195 + $60/yr ext. | Same PHP VPS, or XF Cloud $60–250/mo listed | Boards that will actually use add-ons and a stable 2.3 |
| Discourse | $0 software, or hosted Free / ~$100 / ~$500 | Docker 2 GB+ or official hosted | Teams that want TL automation or to fire the sysadmin |
VAT and price grids change. Re-check XenForo’s purchase page and discourse.org/pricing. Flarum’s price is still “the box and your Friday night.”
Three-year TCO for a 300-member club often favours Flarum or phpBB on a cheap PHP host. Three-year TCO for a 30,000-post board with a shop favours staying on XenForo even though the license is not $0. Software cost is not the line that bites. Rebuild cost is.
Migration decision, Flarum-sized
Greenfield: install, first-party extensions, four primary tags, two admins, SMTP that actually sends, backups. Invite ten humans. Do not install fifteen third-party extensions in week one. The same discipline as Discourse week one; different stack.
From phpBB: prefer a staging community importer. If the importer is stale, hop via a maintained phpBB or admit you wanted XenForo’s official path.
From XenForo: stop. Read the stay-or-migrate filters. Flarum is a downsize. The only XF → Flarum stories that end well are boards that were already using XenForo as a light forum (no extras) and wanted a modern SPA without Docker. Everyone else is shopping for Discourse or staying.
From Discourse: why? If Docker or hosted was the problem, Flarum is a coherent answer. If trust levels and the review queue were the point, you are walking backward.
Related reading
- If the alternative is Discourse: beginner week, pros and cons versus XF
- If the alternative is XenForo: matrix, stay or migrate
- If the alternative is another Node stack: when NodeBB makes sense
- If you thought Flarum would run a game hub: gaming fit test (the extras list is the same veto)
Checklist
Host
- Apache rewrite or Nginx
- PHP 8.3 preferred (7.3 min; 8.5 = deprecation notices on 1.x)
- MySQL 5.6+/8.0.23+ or MariaDB 10.0.5+
- Composer actually runs
- Backups: database + the files the current docs name
Product
- You can name Flarum as small modern PHP, not free XenForo
- 1.x life support / 2.0 RC is an accepted plan
- Admins are a trusted set (Extension Manager = any Composer package)
- Feature list is discussion + tags + a few extensions
- Importers, if any, labelled unofficial; passwords assumed reset
Explicit nos
- Not a shop / XFRM / listing / deep ACL board
- Not “we wanted Discourse hosted”
- Not a 40-tag replica of a phpBB tree
Takeaways
- Flarum is a Mithril SPA on PHP, Composer-installed, extension-first. Shared PHP hosting is possible. That is the niche: modern UI, no Docker tax.
- Docs: PHP 7.3+, 8.3 recommended for 1.x; 1.x up to 8.5 with deprecation notices; MySQL/MariaDB as above; latest 1.x archive 1.8.17.
- 1.x is life support. 2.0 is RC. Plan the upgrade. Do not call 2.0 stable GA.
- Extension Manager (
composer require flarum/extension-manager:"*") can install any package. Trust all admins. - No official importers. Community unofficial (FluxBB, MyBB, phpBB, SMF2). phpBB hops are common. XenForo still has the serious official importer catalogue.
- Not a XenForo replacement for add-on-heavy boards. Not a Discourse replacement for hosted + trust levels. A right small choice when PHP is the constraint and the community is discussion-sized.
If you can deploy Composer on PHP 8.3, you can live with RC-or-life-support, and you do not need a shop, Flarum is a coherent 2026 forum. If any of those three is a lie, pick the product that is allowed to be heavier.