Prepare the host
Use a dedicated HTTPS staging hostname, a new empty MySQL/MariaDB database and a dedicated database user. Keep a backup and preserve any existing billing system. This is a fresh-install procedure, not an in-place upgrade or automatic WHMCS migration.
Use PHP 8.4 for web and CLI. The release declares ctype, cURL, DOM, fileinfo, mbstring, OpenSSL, PDO/PDO MySQL, POSIX, sodium, tokenizer, XML/XMLWriter and ZIP. Confirm the exact release's prerequisite checks and verified outbound TLS. Restrict writable locations to the required private storage/cache/configuration; avoid world-writable permissions.
Extract the correct package
First complete installation preparation and genuine activation using the separate SDK-only kit. In your organisation's Product downloads, select that active installation and obtain the entitled product ZIP.
Use the reviewed signed-source fresh-install package with its production dependencies. GitHub's automatic source ZIP is not the signed installer. The current signed-source profile needs no ionCube Loader.
installation/
emaila-cloud-app/ private application and dependencies
public_html/ public entry point and assets
Keep these directories as siblings and point the web server only at public_html/. The private directory's retained name is required by the package's bootstrap, backup and recovery layout. Configure ORBIT_LICENSE_CONFIG for web PHP and scheduled commands to reuse the preparation directory's config.json under the same PHP Unix user. The private .env created by setup can retain that path; configure the web runtime before relying on ordinary administration and refresh its configuration cache through the matching release procedure after environment changes.
Complete setup
Open /install. Through private host file access, read emaila-cloud-app/storage/app/private/setup-key.txt. Enter that unique key, the canonical HTTPS URL and the dedicated database settings. Complete the installer with the same key and create your administrator.
Setup refuses an existing environment or nonempty database and locks after completion. Preserve the generated .env and APP_KEY. Sign in at /admin/master/login, enrol staff MFA through /admin/master/security and retain recovery codes privately. Check the already activated external licence identity; do not generate a replacement key.