Open-source shared mailbox and help desk, honestly reviewed. No marketing fluff, just what you get when you self-host it.

TL;DR

What it is: Open-source (AGPL-3.0) help desk and shared inbox built in PHP/MySQL — a self-hosted drop-in for Zendesk and Help Scout [README][website].
Who it’s for: Small teams and solo founders managing customer support via email who refuse to pay $20+/agent/month for Zendesk or Help Scout. Also anyone running on shared hosting who can’t spin up a Docker VPS [README][1].
Cost savings: Help Scout starts at ~$20/user/month; Zendesk Suite at ~$19/agent/month — both scale with headcount. FreeScout’s core is free, runs on a $3–5/mo shared hosting plan. The catch: useful features are sold as separate paid modules [website][2].
Key strength: Remarkably lightweight for a PHP app — deployable on shared cPanel hosting, no Docker required. Collision detection, push notifications, and mobile apps work out of the box [README].
Key weakness: The “free” in FreeScout is misleading at the feature level. SSO, SLA, workflows, live chat, knowledge base, and most advanced features are paid modules. One reviewer explicitly called it a “Kostenlos Fake Falle” (free fake trap) [5]. A critical unauthenticated RCE vulnerability via email (CVE-2026-28289) was disclosed in March 2026 — patched in v1.8.207, but a sharp reminder that self-hosted help desks process untrusted email input [3].

What is FreeScout

FreeScout is a shared mailbox and help desk system. The concept is simple: your support inbox, but multiple agents can see, assign, and reply to tickets without forwarding chains or CC spaghetti. The company frames it as a “free Zendesk & Help Scout” — that framing is on the GitHub README, the homepage H1, and every product description [README][website].

It’s built in PHP on the Laravel framework, uses MySQL or PostgreSQL as its database, and can run on a standard web host with PHP 7.1+. That last point is the actual differentiator in a category full of Docker-first tools: FreeScout will install on Softaculous, cPanel, Plesk, or any shared host that runs PHP. You don’t need a VPS, you don’t need root access, and you don’t need to understand containers [README].

The project launched in 2018 and the website claims “8 Years of Success.” It has 4,166 GitHub stars. There are native Android and iOS mobile apps, plus a macOS Menu Bar app maintained by a community contributor [README][website].

Where it diverges from the typical open-source model is the module architecture. The core application is AGPL-3.0 and free. Most of the features that actually make a help desk competitive — SLA enforcement, workflows, knowledge base, live chat, custom fields, SAML SSO, time tracking, white-labeling — are sold as separate modules through the official store. Some community modules exist but the substantial ones cost money [website].

Why people choose it

The reviews on GetApp and Capterra (13 verified reviews total, 4.2/5) land in a consistent place: FreeScout wins on simplicity, price floor, and deployment flexibility, and loses on total cost once modules are added and the license complexity of AGPL.

The “I can’t afford Zendesk” use case. This is the explicit target — the website says it plainly: “FreeScout is the perfect help desk solution for those who need to provide professional customer support, but who cannot afford to pay for Zendesk or Help Scout” [website]. A French product manager with 2+ years of daily use put it this way: “Freescout is an absolute gem for my use case. The minimalist and clean interface is actually what brought me to test it, I can’t stand those over-complicated products with no ergonomic or pleasant user experience” [2]. A UK web designer who had tried DeskPro, Freshdesk, OSTicket, and Fluent Support before landing on FreeScout wrote: “Not only is your offering so very affordable (even with the purchase of some extra modules), but it just works. No fuss, no hassle, just purely designed to be simple but efficient” [website].

The shared-hosting angle. Most self-hosted help desks assume a Linux VPS. FreeScout explicitly supports Softaculous (cPanel one-click install), Fantastico, and bare shared hosting. For a small business already paying for a cPanel hosting plan, this means zero additional infrastructure cost [README].

The module trap. The negative counter-signal is real and recurring. One German reviewer on Capterra gave FreeScout 1 star specifically over this: “Easy to install, except for the cronjob, but that’s it. Everything else you’d actually use has to be bought at high cost” [5]. The core handles email-based ticket management cleanly. The moment you want workflows, SLA timers, a knowledge base, or live chat — you’re buying modules individually. Whether that math beats a Zendesk subscription depends entirely on which modules you actually need.

The AGPL license question. FreeScout is AGPL-3.0, not MIT. The practical implication: if you embed FreeScout inside a commercial SaaS product you distribute to others, the AGPL requires you to open-source that product too. For a founder running FreeScout internally to handle their own support queue, AGPL is irrelevant. For anyone building a white-labeled help desk product on top of FreeScout, this is a lawyer conversation [README].

Features

Based on the README and website content:

Core (free, included):

No limits on agents, tickets, mailboxes, or storage [README]
Shared inbox with conversation assignment and notes [README]
Collision detection — a visible warning when two agents open the same ticket simultaneously [README]
Seamless email integration including modern Microsoft Exchange authentication [README]
Auto-reply, forwarding, merging, and moving conversations between mailboxes [README]
Internal notes (private, not sent to customers) [README]
Push notifications to agents [README]
Open tracking [README]
Search across all conversations [README]
Saved replies (canned responses) [website]
Satisfaction ratings [website]
Tags and spam filter [website]
Pasting screenshots from clipboard directly into the reply composer [README]
Multilingual UI: 28+ languages including Arabic, Chinese, Japanese, Russian, Ukrainian [README]
Mobile apps for Android and iOS [README]
API access [README]
Zapier and Make (Integromat) integrations [README]

Paid modules (purchased separately): The website lists dozens of paid modules. Significant ones include: LDAP integration, Kanban boards, Knowledge Base, Live chat, SMS tickets via Twilio, Time tracking, Custom fields, White-labeling, Workflows & SLA, SAML SSO, Jira integration, WooCommerce integration, CRM, Customer data enrichment, S/MIME & PGP, Real-time reports, Telegram/WhatsApp/Facebook/Slack/Rocket.Chat notifications, Meilisearch-powered faster search, and more [website].

The distinction matters: anything on that second list requires a purchase before it works. The core is genuinely functional for basic shared email support. It stops being functional the moment your team needs SLA tracking, a customer-facing portal, or live chat.

Pricing: SaaS vs self-hosted math

FreeScout:

Core software: $0 (AGPL-3.0) [README]
Paid modules: variable, one-time purchase per module. User reviews describe most as “dirt cheap” [2]. Specific pricing is not published in the materials available; you need to visit the module store directly.
Cloud hosted (FreeScout’s own managed option): pricing details available at freescout.net/cloud-hosted
VPS to self-host: $5–10/mo (or $0 on existing shared hosting)

Zendesk Suite for comparison:

Suite Team: $19/agent/month billed annually
Suite Growth: $55/agent/month
Suite Professional: $115/agent/month
For a 3-person team on the entry tier: $57/mo = $684/year

Help Scout for comparison:

Standard: ~$20/user/month billed annually
For a 3-person team: $60/mo = $720/year

The real math for FreeScout: If you need only basic shared inbox functionality — assign tickets, reply to email, add internal notes, use saved replies — FreeScout on a $5/mo VPS costs $60/year vs. $684–720 for a 3-person Zendesk/Help Scout team. That’s the legitimate savings case.

If you need SLA, workflows, live chat, and a knowledge base, the module costs accumulate. Based on user commentary describing them as “one-time payment” and “affordable,” a realistic module bundle might cost $100–200 one-time vs. ongoing monthly SaaS fees. The math still heavily favors FreeScout over 2+ years of a SaaS subscription — but “free” is the wrong mental model to start with.

Deployment reality check

FreeScout is unusual among self-hosted tools in that it does not require Docker. The install path is PHP + MySQL, which means:

Easiest path (shared hosting, no technical skill required):

One-click install via Softaculous on cPanel or Plesk
No VPS, no Docker, no CLI required
Realistic setup time: 15–30 minutes

Standard path (VPS with control panel or manual):

PHP 7.1–8.x + Nginx or Apache + MySQL/MariaDB
Web-based installer handles the rest
Docker image available for those who prefer it [README]
Realistic setup time: 30–60 minutes

What can go wrong:

The cronjob. Multiple reviewers mention the cronjob as the one setup step that trips up non-technical users [5]. FreeScout requires a cron job to fetch emails on a schedule. On shared hosting this is usually a cPanel setting; on a VPS it requires editing crontab. Not complex, but it’s where things break for beginners.
The security incident. In March 2026, OX Security disclosed CVE-2026-28289, a bypass of an earlier patch (CVE-2026-27636) that allows unauthenticated remote code execution by sending a specially crafted email with a malicious .htaccess file to any FreeScout mailbox [3]. The attack requires only that FreeScout be running on Apache with AllowOverride All — a common default configuration. The vulnerability was patched in v1.8.207. If you haven’t updated since early March 2026 and you’re running on Apache, this is urgent. Shodan showed approximately 1,100 publicly exposed FreeScout instances at disclosure time [3].
Module management. Each paid module is installed separately. If you’re buying and activating six modules, that’s six installation steps. Not a dealbreaker, but not seamless either.
AGPL propagation. If you’re a developer building anything on top of FreeScout that you’ll distribute to others, AGPL-3.0 requires you to open-source your modifications and the combined work. This rarely affects solo founders but matters for agencies and ISVs [README].

Pros and cons

Pros

Runs on shared hosting. The only serious self-hosted help desk that doesn’t require a VPS or Docker. A cPanel plan you already pay for is sufficient [README][website].
Genuinely unlimited core. No limits on agents, mailboxes, tickets, or storage in the core edition. No per-seat pricing, ever [README].
Clean, minimalist UI. Consistently praised across GetApp and Capterra reviews. One reviewer with 4,000 monthly tickets described it as “efficient, straight to the point, and let me manage incoming support requests without any burden” [2].
One-time module pricing. Paid features cost a one-time fee, not a recurring subscription. Cheaper than Zendesk add-ons over any multi-year horizon [2][website].
Mobile apps included. iOS and Android apps mirror the web functionality, including module features [README].
Active development. 8 years of continuous releases. The CVE-2026-28289 vulnerability was patched within days of disclosure [3][website].
Collision detection out of the box. The feature that prevents two agents from sending duplicate replies simultaneously is included in the free core, not a paid module [README].
28+ language support. One of the widest multilingual support sets in the category [README].

Cons

“Free” is misleading. The AGPL core handles basic shared email. Workflows, SLA, live chat, knowledge base, SSO, time tracking, custom fields, and most enterprise-adjacent features are paid modules. At least one reviewer explicitly warns of this [5].
CVE-2026-28289: zero-click RCE via email. A critical unauthenticated remote code execution vulnerability was disclosed in March 2026 that affected FreeScout instances running on Apache with default configuration. Patched in v1.8.207, but its existence signals that FreeScout’s email parsing code has had multiple file-upload security issues in succession [3].
AGPL-3.0, not MIT. More restrictive than MIT. Relevant for developers building commercial products on top of FreeScout [README].
4,166 GitHub stars is modest. For comparison, Zammad (another open-source help desk) has ~4,400 stars; osTicket has ~3,100. None of these have the star count of larger platforms. Smaller community means fewer third-party resources, tutorials, and integrations [README].
Customer support rated 3.5/5. Across GetApp/Capterra reviews, customer support scores the lowest of any category — below features, ease of use, and value [1][2]. For a tool you’re self-hosting, this matters when something breaks.
Cronjob setup trips up non-technical users. The email-fetching cron job is the most commonly cited setup pain point [5].
No built-in REST API per GetApp data. GetApp’s feature checklist marks the API as unavailable [1]. FreeScout does have an API (docs are at api-docs.freescout.net), but it’s apparently not complete enough to register on third-party software review sites’ feature checklists.

Who should use this / who shouldn’t

Use FreeScout if:

You’re on shared hosting already and don’t want to manage a VPS just for a help desk.
You have a small team (1–5 agents) managing customer email with no current system, and Zendesk’s per-seat pricing feels absurd for your volume.
You want a one-time cost model: buy the modules you need once, own them forever.
You’re running on Apache and have already patched to v1.8.207 or later.

Skip it (try Zammad instead) if:

You need an open-source help desk with a more permissive license (MIT) and a REST API that’s actually documented.
Your team is larger and you need LDAP/SSO included in the base product, not as a paid module.

Skip it (try osTicket instead) if:

You want a GPLv2-licensed help desk with more community resources, and you’re comfortable with a less polished UI in exchange for more configuration control.

Skip it (stay on Zendesk or Help Scout) if:

You have more than 10 support agents and the total module cost would approach a year of Zendesk fees anyway.
Your compliance team won’t approve self-hosted infrastructure.
You need a guaranteed SLA for the help desk software itself.

Skip it entirely right now if:

You’re running Apache with AllowOverride All and haven’t confirmed you’re on v1.8.207+. Patch first, evaluate second [3].

Alternatives worth considering

Zammad — open-source, Rails-based, richer REST API, more enterprise-ready. Requires a VPS (no shared hosting). GPL/commercial dual-license.
osTicket — GPLv2, longest track record in the open-source help desk space, runs on shared hosting similarly to FreeScout, larger community but UI feels older.
Peppermint — newer, MIT-licensed, more modern UI, lighter feature set. Worth watching if you primarily want ticket assignment and nothing else.
Zulip (for internal teams) — if your “support” is internal rather than customer-facing, a self-hosted Zulip instance handles shared-inbox patterns with more flexibility.
Help Scout — the paid SaaS FreeScout directly clones. If you have 3+ agents and module costs are adding up, Help Scout’s $20/user/month might be cleaner than piecemeal module purchases.
Zendesk Suite — the other named target. Better for larger teams needing integrations, reporting, and SLA as first-class features. Expensive at scale.
Freshdesk — free tier for up to 2 agents with solid features, worth comparing at the $0 tier before going self-hosted. Closed SaaS, but the free tier is genuinely functional.

Bottom line

FreeScout earns its place as the self-hosted help desk for teams who can’t or won’t pay Zendesk prices and need something that runs on shared hosting without Docker. The core is legitimately clean and functional for basic email-based support. The UI is consistently praised, the collision detection prevents the most common shared-inbox failure mode, and the mobile apps work.

The honest asterisks: “free” is accurate for the software license, not for a complete feature set — the module store is where FreeScout makes money, and you’ll visit it fairly quickly. The March 2026 RCE vulnerability (CVE-2026-28289) should give you pause about the security maturity of the codebase, even though it’s patched. And AGPL-3.0 matters if you’re a developer, not just an operator.

For a solo founder or a 2–3 person team drowning in support email and refusing to pay $60+/month to Zendesk, FreeScout on a shared host you already pay for is hard to argue against. For anything more complex, evaluate Zammad or osTicket alongside it before committing.

Sources

GetApp — FreeScout 2026 Pricing, Features, Reviews & Alternatives (13 reviews, 4.2/5). https://www.getapp.com/all-software/a/freescout/
Capterra New Zealand — FreeScout Pricing, Reviews & Features (13 reviews, 4.2/5). https://www.capterra.co.nz/reviews/208727/freescout
Zeljka Zorz, Help Net Security — “FreeScout vulnerability enables unauthenticated, zero-click RCE via email (CVE-2026-28289)” (March 5, 2026). https://www.helpnetsecurity.com/2026/03/05/freescout-vulnerability-cve-2026-28289/
Matías Sanchez Moises — “In love with Self-Hosted Tools” (May 22, 2025). https://matysanchez.com/in-love-with-self-hosted-tools/
Capterra Deutschland — FreeScout Erfahrungen, Vor- und Nachteile (13 reviews, 4.2/5). https://www.capterra.com.de/reviews/208727/freescout