Sales Director
As an IT decision-maker or technical business owner, you're constantly battling the same challenges: rigid, expensive communication contracts, outdated PBX hardware that lacks modern features, and a pressing need to enable a flexible, remote-capable workforce. You're tired of high monthly "per-user" fees and the lack of control over your own phone system.
This is precisely where 3CX enters the conversation.
But 3CX isn't just another VoIP provider. It's a software-based, open-platform PBX that puts the control—and the cost savings—back in your hands. It's designed for technical managers who understand networking and want a system they can customise, integrate, and scale on their own terms.
You're not looking for a sales pitch; you're looking for a technical evaluation. You have real questions about deployment, security, licensing, and TCO. This guide is built for you. We will dissect the 3CX phone system from the ground up, covering everything from initial setup and pricing to advanced security and integration.
At its core, What is 3CX? It's a software-based Private Branch Exchange (PBX) built on the open-standard SIP (Session Initiation Protocol).
In plain terms, it replaces the proprietary, on-premise "phone closet" hardware (like an old Mitel, Avaya, or Nortel box) and the expensive, rigid "per-user, per-month" hosted VoIP providers (like RingCentral or 8x8). It takes all the functions of an enterprise-grade phone system—call routing, IVRs, voicemail, queues, and conferencing—and bundles them into a software application you can run almost anywhere.
For a technical audience, the "why" of 3CX boils down to three points:
Software-Based & Hardware-Agnostic: 3CX runs on standard, off-the-shelf hardware. You can install it on a Windows or Linux (Debian) OS, run it on a small Intel NUC, or virtualise it on your existing VMware or Hyper-V cluster. This eliminates proprietary hardware and its associated costs.
Open Standards: Because it's built on SIP, 3CX gives you complete freedom. You are not locked into a specific handset vendor or carrier. You can "bring your own" SIP trunk (like Telnyx, Flowroute, or Bandwidth) and your choice of IP phones (Yealink, Fanvil, Snom, Poly), mixing and matching to get the best price and features.
Unified Communications (UC) Platform: 3CX is far more than just a phone system. It's a full UC suite. Out of the box, it includes video conferencing, a 3CX softphone for Windows/macOS, mobile apps for iOS/Android, corporate chat, and presence. It's designed to support 3CX remote working as a first-class citizen, not an afterthought.
The shift from legacy hardware to a 3CX system is a paradigm shift. Here's how they stack up.
| Feature | Traditional Hardware PBX | 3CX Software PBX |
|---|---|---|
| Deployment | A physical box in a server rack. | Software on Windows/Linux, VM, or in the cloud. |
| Hardware | Proprietary phones, cards, and chassis. High cost. | Standard servers. Open-standard SIP phones. |
| Scalability | Rigid. Requires new, expensive hardware (analogue/digital cards) to add users. | Elastic. Scale by adjusting licence (Simultaneous Calls) and VM resources. |
| Remote Work | Difficult. Often requires expensive gateways, complex VPNs, or clunky apps. | Natively supported. Web client and mobile apps designed for remote use. |
| Management | Complex, text-based interfaces. Often requires certified, expensive technicians. | Modern, web-based management console. Easily managed by any IT admin. |
| Cost Model | High CapEx (upfront hardware cost). High maintenance fees. | Low CapEx (or OpEx if cloud-hosted). Annual licence based on capacity, not users. |
| Features | Basic call features. UC/Video are often expensive, bolted-on extras. | Full UC suite (Video, Chat, Mobile) included in the core licence. |
You've likely also encountered FreePBX in your research. This is a common and important comparison: 3CX vs FreePBX.
FreePBX is the open-source "tinkerer's dream." It's built on Asterisk and is infinitely customisable. If you can code it, you can do it. The cost is your time. It requires deep Linux and Asterisk knowledge, and features like a reliable mobile app, simple provisioning, and integrated security are not its strong suit. It's a collection of modules you must assemble and maintain yourself.
3CX is the "integrator's platform." It takes the power of an open-standard system and packages it into a commercially supported, all-in-one, secure product. The setup is wizard-driven, the mobile apps just work, and security features are built-in. You get 90% of the customisation of FreePBX with 10% of the management headache.
The Verdict: If your business has dedicated Asterisk developers and unique custom-coding needs, FreePBX is an option. If your business is an SMB/Mid-Market company that needs a powerful, secure, and manageable UC system that your IT team can support without becoming full-time telecom experts, 3CX is the clear choice.
This is a primary pain point. You're tired of opaque billing. The 3CX pricing model is refreshingly different and a core reason for its popularity.
This is the single most important concept in the 3CX licensing explained guide.
3CX is not licensed per user or per extension.
You can create 10, 100, or 1,000 extensions, and the licence cost doesn't change. 3CX is licensed by Simultaneous Calls (SC)—the maximum number of internal and external calls your system can handle at any one time.
This model is incredibly cost-effective. A typical 100-employee office rarely has more than 10-15 calls happening at the exact same moment. Therefore, instead of paying for 100 user licences, you would only purchase a 16 SC licence. This directly addresses the high monthly costs of "per-seat" providers.
3CX offers different tiers, but the choice is straightforward for most businesses.
3CX FREE / StartUP: A limited, multi-tenant version hosted by 3CX. It's great for very small businesses (under 10 users) but lacks the advanced control, integration, and deployment flexibility (self-hosting) that a technical evaluator needs.
3CX Standard (Legacy): This was the entry-level paid tier. It's being phased out, but it included basic call routing, IVRs, and UC apps.
3CX PRO: This is the workhorse and the standard for 90% of businesses. It includes everything in Standard, plus the critical business features:
3CX Enterprise: This is for large-scale, high-demand call centres or corporations. It adds:
Recommendation: For any business serious about integration and call management, the PRO licence is the correct starting point.
Here is the real-world cost breakdown you've been looking for. Your 3CX TCO is the sum of these five components:
3CX Licence: The annual fee for your 3CX PRO or Enterprise licence (e.g., 16 SC, 32 SC, etc.).
Hosting:
SIP Trunks: The "pay-as-you-go" cost for your actual call minutes and phone numbers. This is paid to a separate VoIP provider (SIP Trunk provider) of your choice. Costs are typically fractions of a penny per minute.
Hardware (CapEx): A one-time cost for any physical IP phones. This is £0 if your team uses the included 3CX softphone and mobile apps.
Management (Optional): £0 if you self-manage. Alternatively, this is a monthly fee if you hire a 3CX Partner to manage, update, and support your system.
When you add these up, the TCO for a self-managed 3CX system is almost always a fraction of the cost of a "per-user" hosted solution, especially as your user count grows.
This is your first major technical decision. 3CX offers complete flexibility, allowing you to choose the model that best fits your security, control, and infrastructure preferences.
Deploying on-premise means installing 3CX on a server (physical or virtual) that lives inside your own network.
Businesses with existing VMware/Hyper-V environments, robust internal IT staff, and a desire to keep all call data and recordings within their own four walls (often for compliance like HIPAA or PCI).
Pros:
Cons: Your Responsibility: You are 100% responsible for hardware uptime, OS updates, backups, and firewall security.
Remote Provisioning: Requires more complex (but well-documented) network configuration (port-forwarding, Split-DNS, or an SBC) to support remote workers and mobile apps.
This is the most popular method for new 3CX deployments. Keyword: 3CX cloud hosting. But "cloud" has two distinct meanings with 3CX.
Option 1: 3CX Hosted / StartUP
This is the "easy button" SaaS (Software as a Service) offering from 3CX.
Pros: 3CX manages the instance, updates, and underlying security. It's the fastest way to get started.
Cons: This is a "walled garden." You have less control, are limited to specific SIP trunks, and cannot use the PRO/Enterprise features like advanced CRM integration or custom call flows. It's generally not the right fit for a technical evaluator who wants full control.
Option 2: Self-Hosted (Private Cloud)
This is the pro's choice and the most popular option for new systems. You deploy a 3CX PRO/Enterprise instance on a standard Linux VM at a cloud provider of your choice (like Vultr, DigitalOcean, AWS Lightsail, or Azure).
Pros:
Cons: You Are the Admin: You are still responsible for the cloud VM's OS (keeping Debian updated) and the cloud provider's firewall rules (e.g., AWS Security Groups).
Making the right hosting decision is critical for performance and cost. A simple Vultr or DigitalOcean instance might be perfect for 25 users, but a 500-user call centre has complex requirements for CPU, RAM, and disk I/O. The 3CX system requirements scale directly with user count and expected simultaneous calls. Furthermore, deciding between the 3CX-hosted option and a self-hosted cloud instance on AWS or Azure has major implications for cost, control, and scalability. Self-hosting gives you full control over a PRO/Enterprise instance, allowing you to choose from any SIP trunk and configure complex integrations, but you are responsible for the underlying OS and firewall. Networking is also a key consideration; a cloud-hosted PBX requires a solid understanding of remote provisioning, whether you'll use STUN for simple remote phones or deploy a Session Border Controller (SBC) for larger remote offices.
For a detailed breakdown of server specs, provider-specific setup guides, and a complete cost-benefit analysis, read our full guide: Choosing the Right Host for 3CX: AWS, Azure, DigitalOcean, or On-Premise? A Cost-Benefit Analysis
A modern 3CX phone system is a complete UC platform. The 3CX features you get, even with a Standard licence, are designed to replace multiple other subscription services.
This is the core of the UC experience. 3CX gives every user a powerful set of apps, enabling true 3CX remote working.
The 3CX Web Client: This is the central command centre for most users. It runs in a browser tab (Chrome, Edge) and provides full functionality:
A great starting point is our 3CX web client tutorial.
Mobile Apps (iOS & Android): These are arguably the best-in-class for any PBX. They are not a clunky add-on. They provide:
This is where 3CX's power becomes apparent. The 3CX call flow capabilities are robust.
Ring Groups: Ring multiple extensions at once (e.g., the "Sales Team" group).
Call Queues (PRO+): The foundation of any call centre. Calls are placed in a queue and distributed to agents based on strategies (e.g., Round Robin, Hunt by Threes, Skill-Based). Includes features like "queue position" announcements and "maximum wait time" redirects.
Digital Receptionists (IVR): The "Press 1 for Sales, Press 2 for Support" auto-attendant. 3CX allows for multi-level, complex IVRs that can route calls based on time of day, user input, or holidays.
While basic call routing is simple, building a resilient and intelligent 3CX call flow is an art. A well-designed Digital Receptionist (IVR) can transform business efficiency, guiding callers to the right department without human intervention. Understanding the critical difference between Ring Groups (for small teams) and Call Queues (for service departments) is essential for managing call loads. With 3CX, you can configure granular rules for business hours, after-hours, and specific company holidays, ensuring calls are always handled professionally. For advanced technical users, the Call Flow Designer (CFD) in the Enterprise edition unlocks the ability to build custom scripts that can query external databases, perform API lookups for caller ID, and create sophisticated, interactive voice-based applications.
To go beyond simple routing and build a truly smart system, read our advanced guide: Mastering 3CX Digital Receptionists: Advanced Call Flow Design and IVR Strategies
This is a massive, high-value feature. 3CX includes a full-fledged web conferencing platform that replaces your Zoom, Webex, or GoToMeeting subscription.
WebRTC-Based: It's 100% browser-based. Guests do not need to download or install any software; they just click a link.
Full-Featured: Includes screen sharing, remote control, PDF/whiteboard sharing, polling, and meeting recording.
Integrated: Schedule conferences from your 3CX app or M365/Google Calendar. It's all part of the same system.
Live Chat: Place a 3CX chat bubble on your company website. When a visitor starts a chat, it's routed directly to your 3CX users/queues. You can elevate a chat to a call or video meeting with one click.
Presence: See the status of your colleagues in real-time (Available, Away, On a Call, In a Meeting). This presence syncs with your M365 calendar, automatically setting you to "Do Not Disturb" when you're in a scheduled meeting.
CRM Integration: This is a core strength of the PRO licence. 3CX integration is key.
The true power of 3CX is unlocked when it stops being just a phone system and becomes part of your business data flow. Integrating 3CX with your CRM (like HubSpot, Salesforce, or Zoho) is the most critical step. This integration enables features like Click-to-Call (launching calls from your CRM), Call Journalling (auto-logging calls to a contact's record), and "screen pops" (displaying the caller's CRM record on an incoming call). Beyond CRMs, the 3CX integration with Microsoft 365 is essential for syncing user directories, profile photos, and presence (e.g., setting your 3CX status based on your M365 calendar). For advanced needs, 3CX's APIs allow for custom business application integration.
For step-by-step instructions on connecting your most critical apps, see our full tutorial: Seamless Business Integration: How to Connect 3CX with HubSpot, Salesforce, and Microsoft 365
This high-level 3CX setup guide outlines the path for a technical administrator. The process is logical and wizard-driven, but planning is essential.
Network Assessment: Your network must be ready. This means disabling any "SIP ALG" (Application Layer Gateway) functions on your firewall/router, as this feature is notorious for corrupting VoIP traffic. Plan for QoS (Quality of Service) if your network is congested.
Hosting Decision: Finalise your choice: On-premise (VM or bare metal) or Cloud (Vultr, AWS, etc.).
Licensing: Acquire your 3CX licence key.
SIP Trunks: Select and provision your SIP trunk provider. They will give you an Auth ID, password, and server hostname.
Phone List: Decide which users will get softphones and which will get physical desk phones.
Install 3CX: For cloud, use the "PBX Express" tool from your 3CX customer portal to deploy a new instance in minutes. For on-prem, download the 3CX ISO (for Debian) or the Windows installer.
Run the Setup Wizard: The installer will walk you through key settings like:
Critical Step: Run the Firewall Checker (CRITICAL): Inside the 3CX Management Console, find and run the Firewall Checker. You must get all green checkmarks. If you have red or yellow, your port forwarding is incorrect, and you will have audio problems.
Configure SIP Trunks: Go to the "SIP Trunks" section, select your provider from the template, and enter the auth credentials. You should see it register (turn green).
Set Global Office Hours: Define your company's "open" and "closed" times. This will be used to route calls.
Create Extensions: You can create extensions one-by-one, import from a CSV, or (with the PRO licence) sync them directly from Microsoft 365 or Azure AD.
Send Welcome Emails: For each user, click "Send Welcome Email." This email contains their login credentials, a link to the web client, and a QR code for provisioning their mobile app.
Provision Phones: This is a major step. For softphones, the welcome email is all they need. For desk phones, you have options.
While softphones are powerful, many business environments (like reception desks, warehouses, or executive offices) still demand the reliability and ease-of-use of a physical desk phone. 3CX supports a wide range of phones, but the best 3CX compatible phones are from vendors like Yealink, Fanvil, and Poly, which offer full "Plug and Play" (PnP) provisioning. Understanding the provisioning methods is key: PnP works for local phones on the same LAN, while remote phones in home offices must be provisioned using a Session Border Controller (SBC) for security and reliability. An SBC (which can be a small Raspberry Pi or a VM) tunnels all phone traffic back to the 3CX instance, simplifying firewall configuration and improving call quality.
To see our top-rated models and learn how to provision them securely, read our guide: The Best Desk Phones for 3CX in 2026: A Configuration Guide for Yealink, Fanvil, and Poly
Build Your Call Flow: Create a "Digital Receptionist" (IVR) for your main number to route calls (e.g., "Press 1 for Sales...").
Configure Outbound Rules: Tell 3CX how to route outbound calls (e.g., which SIP trunk to use). This is also where you configure E911 (emergency calling) services.
Test, Test, Test: Make test calls. Test every path:
A phone system is a high-value target for hackers. If compromised, they will use it to make thousands of pounds in international "toll fraud" calls in a matter of hours. 3CX security best practices are not optional.
Enable Automatic Updates: This is the #1 most important setting. Go to the "Updates" section and set 3CX to automatically install updates. This patches security vulnerabilities as they are discovered.
Enforce Strong Passwords:
Run the Firewall Checker: Yes, it's mentioned a third time. It's that important. A failing firewall test means your system is misconfigured and vulnerable.
CRITICAL: RESTRICT MANAGEMENT CONSOLE ACCESS: By default, the 3CX Management Console (Port 5001/TCP) is open to the internet. This is the #1 way systems get hacked. Go to "Security -> Admin Console Access" and create an IP whitelist. Only allow access from your office static IP and your home static IP. Block all other access.
SIP Port Security: Limit your main SIP port (5060/UDP) to only your SIP trunk providers' IP addresses.
Use an SBC for Remote Phones: Do not provision remote phones using STUN. It requires opening their SIP ports to the internet, making them vulnerable to "extension scanning" hacks. Use the 3CX SBC.
Country Code Blocking: Go to "Security -> Allowed Country Codes." Uncheck every single country you do not actively do business with. This is your best defence against toll fraud.
Extension Security: Check the "Block Extension" box for any extension not in use.
IP Blacklisting: In "Security -> Anti-Hacking," ensure the system is set to automatically block IPs after a set number of failed authentication attempts.
This overview covers the basics, but 3CX security is a deep and critical topic. A single compromised extension can lead to thousands in fraudulent call charges overnight. A comprehensive security posture involves more than just a firewall. It requires configuring the 3CX Firewall Checker correctly, using complex passwords for extensions and the admin console, and setting up mandatory country-level restrictions to prevent toll fraud. You must also implement anti-hacking measures like automatic IP blacklisting, schedule and verify security updates, and regularly monitor system logs for suspicious activity. Securing the 3CX Management Console with a strict IP whitelist is the single most important step you can take to prevent unauthorised access.
For a comprehensive checklist to lock down your instance, read our essential guide: Securing 3CX: The Essential 10-Step Guide to Preventing SIP Attacks and Toll Fraud
Even in a well-run system, issues arise. For a technical admin, 90% of all 3CX problems fall into three categories.
Symptom: You can make and receive calls, but one or both parties cannot hear anything.
The Cause: This is a firewall or NAT (Network Address Translation) problem, 100% of the time. The SIP signal (the "call setup") is getting through, but the RTP (Real-time Transport Protocol) audio streams are being blocked.
The Fix:
Symptom: A desk phone or mobile app shows "Registering..." or "Registration Failed."
The Fix:
Symptom: Your SIP Trunk shows "Red" or "Unregistered" in the 3CX dashboard.
The Fix:
While troubleshooting an existing 3CX is one challenge, the most complex project is often the initial migration from a 20-year-old legacy PBX. Planning is everything. A proper transition requires a detailed pre-migration checklist, including a full audit of your network readiness, user data, and licensing. The most critical, high-stress part of the process is porting your phone numbers (DIDs) and executing the SIP trunk cutover. This must be meticulously planned to minimise downtime. A successful migration doesn't end at the switchover; it includes a post-migration audit to test all call flows and a comprehensive user training plan to ensure adoption.
To ensure your transition is seamless, follow our comprehensive migration plan: Migrating from Legacy PBX to 3CX: A Complete Transition Planning and Execution Checklist
You've reached the end of the ultimate 3CX guide. You now have the full technical overview of 3CX's power, flexibility, and value. You understand the licensing, the deployment models, the critical security steps, and the core features that set it apart.
3CX is the platform for IT leaders who want to regain control, slash costs, and modernise their business communications.
Reading a 3,000-word guide is one thing, but designing and migrating a mission-critical communications system for your business is another. If you're ready to move from evaluation to execution, our certified 3CX experts are here to help.
We can assist with every stage of your journey:
Would you like to schedule a 15-minute technical consultation to discuss your specific 3CX migration or deployment plan?
Schedule Your Free ConsultationOur top-rated IP phone models with secure provisioning methods for both local and remote deployments.
Comprehensive security checklist covering firewall configuration, access restrictions, and fraud prevention.
Step-by-step tutorials for CRM integration, click-to-call, screen pops, and Microsoft 365 sync.
Pre-migration audits, number porting strategies, and post-migration testing procedures.
Server specifications, provider comparisons, and TCO calculations for cloud vs on-premise hosting.
Comprehensive overview of essential business phone system capabilities and how they support modern workplaces.
Understanding Direct Dial Inward numbers and how they work with 3CX extensions.
UK business guide to understanding VoIP numbers and how they integrate with 3CX.
Which deployment model is right for your business?
How to connect your phone with customer data for better results.
Auto-attendants, IVR, and intelligent routing explained.
Measuring call performance and customer satisfaction.
Protecting data and meeting regulatory requirements.
Phone system features for remote and hybrid teams.
How to calculate savings and justify your upgrade investment.
An A-to-Z guide for small business owners.
Compare the best VoIP providers for UK small businesses.
With over 25 years’ experience at T2k, Lee began his career as a telecoms engineer before progressing to Sales Director. He leverages his foundational technical knowledge to provide businesses with impartial, expert advice on modern communications, specialising in VoIP and cloud telephony. As a primary author for T2k, Lee is dedicated to demystifying complex technology for businesses of all sizes.
Your trusted technology partner.
