Install WordPress on a LEMP stack

This guide installs WordPress on your VPS using a LEMP stack: Linux, Nginx (pronounced "engine-x"), MariaDB and PHP. It finishes with a free Let's Encrypt SSL certificate, so your site runs over HTTPS.

It works on every operating system we offer: Ubuntu 22.04, 24.04 and 26.04, Debian 12 and 13, AlmaLinux 8, 9 and 10, and Rocky Linux 9 and 10. Where the steps differ, the commands are split into Ubuntu/Debian and AlmaLinux/Rocky.

Before you start

• A VPS with at least 1 GB of RAM. 2 GB or more is recommended for a busy site or WooCommerce.
• A domain name with an A record pointing to your VPS IP address, for example example.co.nz and www.example.co.nz. Set this up first, because the SSL step needs it.
• SSH access as root or as a user with sudo rights. If you're logged in as root, you can leave sudo off the commands.
• A fresh server is best. If another web server such as Apache is already using ports 80 and 443, Nginx won't be able to start.

Throughout this guide, replace example.co.nz with your own domain and ChooseAStrongPassword with a strong password of your own.

Step 1: Update the server

Ubuntu/Debian

sudo apt update && sudo apt upgrade -y

AlmaLinux/Rocky

sudo dnf upgrade -y

Step 2: Install Nginx, MariaDB and PHP

Ubuntu/Debian

sudo apt install -y nginx mariadb-server php-fpm php-mysql php-curl php-gd php-intl php-mbstring php-xml php-zip php-imagick

Nginx, MariaDB and PHP-FPM start automatically after installation.

AlmaLinux 8 ships an old PHP and MariaDB by default, so switch to newer versions first:

sudo dnf module reset -y php mariadb
sudo dnf module enable -y php:8.2 mariadb:10.11

AlmaLinux 9 and Rocky Linux 9, switch to PHP 8.3 first:

sudo dnf module reset -y php
sudo dnf module enable -y php:8.3

AlmaLinux 10 and Rocky Linux 10 already include PHP 8.3, so no extra step is needed.

Then, on all AlmaLinux/Rocky versions, install the packages and start the services:

sudo dnf install -y nginx mariadb-server php-fpm php-mysqlnd php-gd php-intl php-mbstring php-xml php-opcache policycoreutils-python-utils
sudo dnf install -y php-pecl-zip
sudo systemctl enable --now nginx mariadb php-fpm

The php-pecl-zip package is optional. If dnf can't find it, skip it. WordPress will still work.

On AlmaLinux/Rocky, PHP-FPM runs as the apache user by default. Change it to nginx:

sudo sed -i 's/^user = apache/user = nginx/; s/^group = apache/group = nginx/' /etc/php-fpm.d/www.conf
sudo chgrp -R nginx /var/lib/php/session
sudo systemctl restart php-fpm

Step 3: Open the firewall

Ubuntu/Debian with UFW enabled (check with sudo ufw status):

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

AlmaLinux/Rocky with firewalld:

sudo firewall-cmd --permanent --add-service=http --add-service=https
sudo firewall-cmd --reload

Step 4: Secure MariaDB and create the database

Run the security script and answer the prompts. Set a root password if asked, and answer Y to removing anonymous users, disallowing remote root login and removing the test database.

sudo mariadb-secure-installation

Now open the MariaDB console:

sudo mariadb

Paste in the following, replacing the password with your own:

CREATE DATABASE wordpress DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'wpuser'@'localhost' IDENTIFIED BY 'ChooseAStrongPassword';
GRANT ALL PRIVILEGES ON wordpress.* TO 'wpuser'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Step 5: Download WordPress

cd /tmp
curl -LO https://wordpress.org/latest.tar.gz
tar xzf latest.tar.gz
sudo mkdir -p /var/www
sudo mv /tmp/wordpress /var/www/wordpress
cd /var/www/wordpress
sudo cp wp-config-sample.php wp-config.php

Add your database details to wp-config.php, using the password you chose in Step 4:

sudo sed -i "s/database_name_here/wordpress/; s/username_here/wpuser/; s/password_here/ChooseAStrongPassword/" wp-config.php

Next, add unique security keys. Open https://api.wordpress.org/secret-key/1.1/salt/ in your browser and copy the eight lines it shows. Then edit the file:

sudo nano wp-config.php

Find the eight lines that contain put your unique phrase here, replace them with the lines you copied, then press Ctrl+O and Enter to save and Ctrl+X to exit.

Give the web server ownership of the files:

Ubuntu/Debian

sudo chown -R www-data:www-data /var/www/wordpress

AlmaLinux/Rocky, which also need SELinux permissions so WordPress can save uploads and plugins, and reach the internet for updates:

sudo chown -R nginx:nginx /var/www/wordpress
sudo semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/wordpress/wp-content(/.*)?"
sudo restorecon -Rv /var/www/wordpress
sudo setsebool -P httpd_can_network_connect 1

Step 6: Configure Nginx

First, find your PHP-FPM socket:

• Ubuntu/Debian: run ls /run/php/. You'll normally use /run/php/php-fpm.sock. If that file isn't listed, use the versioned one shown, for example /run/php/php8.3-fpm.sock.
• AlmaLinux/Rocky: use /run/php-fpm/www.sock.

Create the site configuration file:

• Ubuntu/Debian: sudo nano /etc/nginx/sites-available/wordpress
• AlmaLinux/Rocky: sudo nano /etc/nginx/conf.d/wordpress.conf

Paste in the following, changing the domain and, if needed, the socket path on the fastcgi_pass line:

server {
    listen 80;
    listen [::]:80;
    server_name example.co.nz www.example.co.nz;

    root /var/www/wordpress;
    index index.php index.html;
    client_max_body_size 64M;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_pass unix:/run/php/php-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_index index.php;
    }

    location ~ /\.ht {
        deny all;
    }
}

Save and exit. On Ubuntu/Debian, enable the site and disable the default page:

sudo ln -s /etc/nginx/sites-available/wordpress /etc/nginx/sites-enabled/
sudo rm -f /etc/nginx/sites-enabled/default

On all systems, test the configuration and reload Nginx:

sudo nginx -t
sudo systemctl reload nginx

If nginx -t reports an error, it tells you the file and line to check.

Step 7: Add a free SSL certificate

Ubuntu/Debian

sudo apt install -y certbot python3-certbot-nginx

AlmaLinux/Rocky (Certbot comes from the EPEL repository):

sudo dnf install -y epel-release
sudo dnf install -y certbot python3-certbot-nginx

Then request the certificate on all systems:

sudo certbot --nginx -d example.co.nz -d www.example.co.nz

Enter your email address and agree to the terms. Certbot updates your Nginx configuration to use HTTPS and sets up automatic renewal. You can test renewal with sudo certbot renew --dry-run.

Step 8: Finish the WordPress setup

Open https://example.co.nz in your browser. Choose your language, then enter your site title, admin username, a strong password and your email address. Click Install WordPress, then log in at https://example.co.nz/wp-admin.

Keeping it up to date

• Update WordPress, themes and plugins from Dashboard → Updates in WordPress.
• Update the server regularly with sudo apt update && sudo apt upgrade (Ubuntu/Debian) or sudo dnf upgrade (AlmaLinux/Rocky).
• Keep your own backups of /var/www/wordpress and the database. You can export the database with sudo mariadb-dump wordpress > wordpress.sql.

Troubleshooting

• 502 Bad Gateway: Nginx can't reach PHP. Check the socket path on the fastcgi_pass line and that PHP-FPM is running (systemctl status php-fpm on AlmaLinux/Rocky, or systemctl status 'php*-fpm' on Ubuntu/Debian).
• "Error establishing a database connection": the database name, user or password in wp-config.php doesn't match what you created in Step 4.
• Uploads or plugin installs fail on AlmaLinux/Rocky: re-run the semanage and restorecon commands from Step 5.
• Certbot fails: check that your domain's A record points to this VPS and that port 80 is open. DNS changes can take a little while to take effect.

Need help?

Our Cloud VPS plans are self-managed, so you're responsible for installing, securing and maintaining the software on your server. If something on our side isn't working, such as the network, or your VPS won't boot, open a support ticket. New to your VPS? Start with our Cloud VPS Getting Started Guide. Prefer WordPress without managing a server? Our WordPress hosting plans take care of it for you.