WordPress on an Ubuntu VPS is installed in a precise order: web server, database, files, certificate. Here is the LEMP stack (Linux, nginx, MariaDB, PHP) step by step, on a server whose system you control.
What you need
- A VPS running Ubuntu 24.04 LTS with
sudoaccess. - A domain name pointing to the server's IP address.
- Working SSH access.
If your domain is not pointed yet, settle the DNS question before requesting the HTTPS certificate.
1. Install nginx, PHP and MariaDB
apt update apt install nginx mariadb-server php-fpm php-mysql php-curl php-gd php-mbstring php-xml php-zip unzip
Then enable nginx and open the required ports in the firewall:
systemctl enable --now nginx ufw allow 22 ufw allow 'Nginx Full'
Note the installed PHP version: it is used to name the PHP-FPM service and the FastCGI socket that nginx connects to.
2. Create the database
mysql_secure_installation mysql -u root -p
In the MariaDB console:
CREATE DATABASE wordpress CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci; CREATE USER 'wpuser'@'localhost' IDENTIFIED BY 'long_password'; GRANT ALL PRIVILEGES ON wordpress.* TO 'wpuser'@'localhost'; FLUSH PRIVILEGES; EXIT;
Use a long, unique password: this database holds all the content of your site.
3. Download WordPress
cd /var/www curl -O https://wordpress.org/latest.tar.gz tar xzf latest.tar.gz chown -R www-data:www-data /var/www/wordpress
Then create wp-config.php from the sample file included in the folder, and fill in the database name, user, password and security keys.
4. Configure nginx
Create a site file in /etc/nginx/sites-available/ with a root pointing to /var/www/wordpress, then enable it with a symbolic link in sites-enabled. The PHP block must pass requests to the PHP-FPM FastCGI socket, not serve them as static files.
nginx -t systemctl reload nginx
Always validate the syntax before reloading: a single configuration error is enough to take the site down.
5. Enable HTTPS
apt install certbot python3-certbot-nginx certbot --nginx -d your-domain.com -d www.your-domain.com
Certbot installs the certificate and handles its automatic renewal. Then check that HTTP access correctly redirects to HTTPS.
6. Finish and secure
- Complete the installation in the browser: site title, administrator account, strong password.
- Enable automatic security updates for the system.
- Set up a backup of the files and the database.
- Limit login attempts on the administration page and keep the core, themes and plugins up to date.
