Install and maintain WordPress on Ubuntu

WordPress is installed below a domain-specific Apache web root with PHP 8.3, MariaDB, wp-config.php, TLS, UFW, and Fail2ban.

Before you start

• Use a clean, supported Ubuntu server with root or sudo access.
• Point app.example.com to the server before requesting a public TLS certificate.
• Replace every value written as CHANGE_ME and store the generated credentials in a password manager.
• Take a snapshot before changing an existing installation.
• Unique random database and WordPress administrator passwords.
• A plan for plugin/theme updates and off-server backups.

What the AppStore installation creates

• Apache and PHP 8.3 extensions
• MariaDB database and local database user
• WordPress files below /var/www/app.example.com/public_html
• Domain virtual host, Certbot TLS, UFW, and Fail2ban

1. Install Apache, PHP 8.3, and MariaDB

sudo apt update
sudo apt install -y apache2 mariadb-server curl tar \
  php8.3 php8.3-cli php8.3-mysql php8.3-curl php8.3-gd php8.3-intl php8.3-mbstring php8.3-xml php8.3-zip \
  libapache2-mod-php8.3 certbot python3-certbot-apache ufw fail2ban

2. Create the database

sudo mysql
CREATE DATABASE wordpress CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'wordpress'@'localhost' IDENTIFIED BY 'CHANGE_ME_DB_PASSWORD';
GRANT ALL PRIVILEGES ON wordpress.* TO 'wordpress'@'localhost';
FLUSH PRIVILEGES;
EXIT;

3. Install and configure WordPress

curl -fL https://wordpress.org/latest.tar.gz -o /tmp/wordpress.tar.gz
sudo install -d -o www-data -g www-data -m 0750 /var/www/app.example.com/public_html
sudo tar -xzf /tmp/wordpress.tar.gz --strip-components=1 -C /var/www/app.example.com/public_html
sudo cp /var/www/app.example.com/public_html/wp-config-sample.php /var/www/app.example.com/public_html/wp-config.php
sudo nano /var/www/app.example.com/public_html/wp-config.php
curl -fsSL https://api.wordpress.org/secret-key/1.1/salt/
sudo chown -R www-data:www-data /var/www/app.example.com/public_html

4. Configure Apache and TLS

Set the document root to the domain directory and allow overrides for WordPress permalinks.

sudo a2enmod rewrite ssl
sudo nano /etc/apache2/sites-available/app.example.com.conf
sudo a2ensite app.example.com.conf
sudo apache2ctl configtest
sudo systemctl reload apache2
sudo certbot --apache -d app.example.com -m admin@example.com --agree-tos --redirect

Important files and data

• WordPress root and wp-config.php: /var/www/app.example.com/public_html
• Uploads: /var/www/app.example.com/public_html/wp-content/uploads
• Themes/plugins: /var/www/app.example.com/public_html/wp-content
• Apache site configuration

Health checks and logs

Run these checks after installation and after each upgrade:

sudo apache2ctl configtest
sudo systemctl status apache2 mariadb --no-pager
curl -I https://app.example.com
sudo tail -n 100 /var/log/apache2/error.log

Routine maintenance

Review release notes and take a backup or snapshot before upgrading. Use the following playbook-aligned commands as the starting point:

cd /var/www/app.example.com/public_html
sudo -u www-data wp core update
sudo -u www-data wp plugin update --all
sudo -u www-data wp theme update --all
sudo -u www-data wp core verify-checksums

Backup scope

• MariaDB WordPress database
• wp-content and wp-config.php
• Web-server and PHP settings needed for the site

A usable backup needs both application files and application data. Test restoration on a separate server; an untested backup is not a recovery plan.

Troubleshooting

• Confirm DNS with dig +short app.example.com before retrying Certbot.
• Test the web-server configuration before reloading it: sudo nginx -t or sudo apache2ctl configtest.
• Check free space with df -h and listening ports with sudo ss -ltnup.
• If a service fails, inspect its systemd journal before changing configuration.
• A database connection error usually means wp-config.php does not match the MariaDB database/user/password/host.
• Enable WordPress debug logging temporarily, never display PHP errors containing secrets to public visitors.

Security notes

• Do not paste passwords, API keys, repository credentials, private keys, or access tokens into tickets or public logs.
• Expose only the documented public ports. Keep database and application backend ports bound to localhost or a private network.
• Keep SSH access working before enabling UFW, then allow only the ports this guide lists.
• Renewal can be tested safely with sudo certbot renew --dry-run where Certbot manages TLS.