sudo apt install -y mariadb-server\n<\/code><\/pre>\n\n\n\nThen run the security script, which removes the test database and anonymous accounts:<\/p>\n\n\n\n
sudo mariadb-secure-installation\n<\/code><\/pre>\n\n\n\nPress Enter for the current root password, answer n<\/code> to switching to unix_socket authentication and n<\/code> to changing the root password (on Ubuntu, the database root account already uses socket login, so only the system’s root user can use it), then answer Y<\/code> to the remaining four questions.<\/p>\n\n\n\nStep 5: Create the WordPress Database and User<\/h3>\n\n\n\n
WordPress should never connect as the database root user. Give it a dedicated WordPress database and a user that can touch nothing else. Open the MariaDB shell:<\/p>\n\n\n\n
sudo mariadb\n<\/code><\/pre>\n\n\n\nRun these statements, choosing your own names and a long, random password:<\/p>\n\n\n\n
CREATE DATABASE wordpress CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;\nCREATE USER 'wpuser'@'localhost' IDENTIFIED BY 'USE-A-LONG-RANDOM-PASSWORD';\nGRANT ALL PRIVILEGES ON wordpress.* TO 'wpuser'@'localhost';\nFLUSH PRIVILEGES;\nEXIT;\n<\/code><\/pre>\n\n\n\nThe utf8mb4<\/code> character set stores every character WordPress can display, including emoji and non-Latin scripts. Write the database name, user and password down somewhere safe; you need them in Step 8.<\/p>\n\n\n\nStep 6: Install PHP-FPM and the PHP Extensions WordPress Needs<\/h3>\n\n\n\n
Install PHP-FPM together with the extensions WordPress and popular plugins rely on:<\/p>\n\n\n\n
sudo apt install -y php-fpm php-mysql php-curl php-gd php-intl php-mbstring php-xml php-zip php-imagick php-bcmath\n<\/code><\/pre>\n\n\n\nphp-mysql<\/code> lets WordPress talk to the WordPress database, php-gd<\/code> and php-imagick<\/code> handle image resizing, and the rest cover international text, XML feeds, ZIP uploads and maths functions used by shop plugins. You do not need a separate OPcache package: on Ubuntu 26.04 it is built into PHP 8.5, and on 24.04 it is installed with PHP-FPM automatically.<\/p>\n\n\n\nCheck your version with php -v<\/code>. You should see PHP 8.5 on Ubuntu 26.04 or PHP 8.3 on Ubuntu 24.04.<\/p>\n\n\n\nWordPress uploads, themes and plugin installs often exceed PHP’s small default limits. Create a small settings file for PHP-FPM instead of editing the main php.ini<\/code> (replace 8.5<\/code> with 8.3<\/code> on Ubuntu 24.04):<\/p>\n\n\n\nsudo tee \/etc\/php\/8.5\/fpm\/conf.d\/99-wordpress.ini > \/dev\/null <<'EOF'\nupload_max_filesize = 64M\npost_max_size = 64M\nmemory_limit = 256M\nmax_execution_time = 120\nEOF\nsudo systemctl restart php8.5-fpm\n<\/code><\/pre>\n\n\n\nA separate file survives package upgrades and makes your changes easy to find later.<\/p>\n\n\n\n
Step 7: Download WordPress<\/h3>\n\n\n\n
Always download WordPress from the official site, never from a third-party mirror. Fetch the latest release, unpack it and move it into your web root:<\/p>\n\n\n\n
cd \/tmp\nwget https:\/\/wordpress.org\/latest.tar.gz\ntar -xzf latest.tar.gz\nsudo mkdir -p \/var\/www\/example.com\nsudo cp -a \/tmp\/wordpress\/. \/var\/www\/example.com\/\nrm -rf \/tmp\/wordpress \/tmp\/latest.tar.gz\n<\/code><\/pre>\n\n\n\nThe latest.tar.gz<\/code> link always points at the newest stable version, so you start fully patched.<\/p>\n\n\n\nWordPress reads its database details and security keys from wp-config.php<\/code>. Create it from the sample file:<\/p>\n\n\n\ncd \/var\/www\/example.com\nsudo cp wp-config-sample.php wp-config.php\nsudo nano wp-config.php\n<\/code><\/pre>\n\n\n\nFind the database section and fill in the values from Step 5:<\/p>\n\n\n\n
define( 'DB_NAME', 'wordpress' );\ndefine( 'DB_USER', 'wpuser' );\ndefine( 'DB_PASSWORD', 'USE-A-LONG-RANDOM-PASSWORD' );\ndefine( 'DB_HOST', 'localhost' );\n<\/code><\/pre>\n\n\n\nNext, replace the eight placeholder security keys. They protect login cookies, so they must be unique to your site. Generate a fresh set:<\/p>\n\n\n\n
curl -s https:\/\/api.wordpress.org\/secret-key\/1.1\/salt\/\n<\/code><\/pre>\n\n\n\nDelete the eight put your unique phrase here<\/code> lines in wp-config.php<\/code> and paste the generated block in their place. While the file is open, add this line just above the “That’s all, stop editing!” comment:<\/p>\n\n\n\ndefine( 'DISALLOW_FILE_EDIT', true );\n<\/code><\/pre>\n\n\n\nIt turns off the built-in theme and plugin code editor in the dashboard. If an attacker ever steals an admin password, that editor is the first thing they use to plant malicious code.<\/p>\n\n\n\n
Step 9: Set the Correct File Ownership and Permissions<\/h3>\n\n\n\n
PHP-FPM runs as the www-data<\/code> user on Ubuntu, so WordPress files must belong to it. That lets WordPress install plugins, themes and updates directly, without ever asking you for FTP details:<\/p>\n\n\n\nsudo chown -R www-data:www-data \/var\/www\/example.com\nsudo find \/var\/www\/example.com -type d -exec chmod 755 {} \\;\nsudo find \/var\/www\/example.com -type f -exec chmod 644 {} \\;\nsudo chmod 640 \/var\/www\/example.com\/wp-config.php\n<\/code><\/pre>\n\n\n\nFolders get 755<\/code>, files get 644<\/code>, and wp-config.php<\/code> gets 640<\/code> so other users on the server cannot read your database password. Never use 777<\/code>, whatever an old forum post tells you.<\/p>\n\n\n\nStep 10: Create the Nginx Server Block for WordPress<\/h3>\n\n\n\n
Now connect Nginx to WordPress. Create a new Nginx server block for your domain:<\/p>\n\n\n\n
sudo nano \/etc\/nginx\/sites-available\/example.com\n<\/code><\/pre>\n\n\n\nPaste in this configuration:<\/p>\n\n\n\n
server {\n listen 80;\n listen [::]:80;\n server_name example.com www.example.com;\n\n root \/var\/www\/example.com;\n index index.php index.html;\n\n client_max_body_size 64M;\n\n # Block PHP inside uploads and hidden files (must come before the PHP block)\n location ~* \/wp-content\/uploads\/.*\\.php$ { deny all; }\n location ~ \/\\.(?!well-known) { deny all; }\n location = \/xmlrpc.php { deny all; }\n\n location \/ {\n try_files $uri $uri\/ \/index.php?$args;\n }\n\n location ~ \\.php$ {\n include snippets\/fastcgi-php.conf;\n fastcgi_pass unix:\/run\/php\/php-fpm.sock;\n }\n\n location ~* \\.(css|js|gif|ico|jpe?g|png|svg|webp|avif|woff2?)$ {\n expires 30d;\n access_log off;\n log_not_found off;\n }\n}\n<\/code><\/pre>\n\n\n\nCheck the PHP-FPM socket name with ls \/run\/php\/<\/code>. If there is no php-fpm.sock<\/code> shortcut, use the versioned name instead, for example unix:\/run\/php\/php8.5-fpm.sock<\/code> (or php8.3-fpm.sock<\/code> on Ubuntu 24.04).<\/p>\n\n\n\nEnable the site, remove the default welcome page, then test and reload:<\/p>\n\n\n\n
sudo ln -s \/etc\/nginx\/sites-available\/example.com \/etc\/nginx\/sites-enabled\/\nsudo rm -f \/etc\/nginx\/sites-enabled\/default\nsudo nginx -t\nsudo systemctl reload nginx\n<\/code><\/pre>\n\n\n\nNever skip nginx -t<\/code>. It catches typos before they can take your site offline.<\/p>\n\n\n\nStep 11: Enable Free HTTPS with Let’s Encrypt<\/h3>\n\n\n\n
Install Certbot and its Nginx plugin, then request a certificate for both versions of your domain:<\/p>\n\n\n\n
sudo apt install -y certbot python3-certbot-nginx\nsudo certbot --nginx -d example.com -d www.example.com\n<\/code><\/pre>\n\n\n\nCertbot verifies your domain, installs the certificate, adds the listen 443 ssl<\/code> lines to your Nginx server block and sets up an automatic redirect from HTTP to HTTPS. Renewal runs on its own through a systemd timer; confirm it works with sudo certbot renew --dry-run<\/code>.<\/p>\n\n\n\nDo this before you run the installer. WordPress stores your site address in the database, and starting on HTTPS saves you from mixed-content warnings later.<\/p>\n\n\n\n
Step 12: Run the WordPress Web Installer<\/h3>\n\n\n\n
Open https:\/\/example.com<\/code> in your browser. WordPress asks you to choose a language, then shows its famous five-minute install screen. Fill in:<\/p>\n\n\n\n\n- Site title:<\/strong> you can change it later.<\/li>\n\n\n\n
- Username:<\/strong> anything except
admin<\/code>, which is the first name bots try.<\/li>\n\n\n\n- Password:<\/strong> keep the strong one WordPress suggests and store it in a password manager.<\/li>\n\n\n\n
- Email:<\/strong> an address you check, because password resets go there.<\/li>\n<\/ul>\n\n\n\n
Click Install WordPress<\/strong>, log in at https:\/\/example.com\/wp-admin<\/code>, and you are done. You now know how to install WordPress on an Ubuntu VPS with Nginx, from the first update to the first login.<\/p>\n\n\n\nUnderstanding Your Nginx Server Block Line by Line<\/h2>\n\n\n\n
Copying a configuration is easy; knowing what it does is what lets you fix it at 2 a.m. Here is what each part of the Nginx server block does:<\/p>\n\n\n\n
\nroot<\/code> and index<\/code><\/strong> tell Nginx where WordPress lives and to look for index.php<\/code> first.<\/li>\n\n\n\nclient_max_body_size 64M<\/code><\/strong> matches the PHP limit from Step 6. Without it, Nginx rejects large uploads with a “413 Request Entity Too Large” error before PHP ever sees them.<\/li>\n\n\n\ntry_files $uri $uri\/ \/index.php?$args<\/code><\/strong> is the heart of WordPress on Nginx. It serves a real file if one exists, then a real folder, and otherwise passes the request to WordPress with its query string. This single line replaces the rewrite rules WordPress writes to .htaccess<\/code> on Apache, and it is what makes pretty permalinks work.<\/li>\n\n\n\n- The uploads rule<\/strong> blocks PHP execution inside
\/wp-content\/uploads\/<\/code>. Uploads should only ever contain media, so a PHP file there is almost always malware. Nginx checks regular-expression locations in order, which is why these deny rules sit above the PHP block.<\/li>\n\n\n\n- The hidden-files rule<\/strong> blocks
.git<\/code>, .env<\/code> and similar files while still allowing \/.well-known\/<\/code>, which Let’s Encrypt needs.<\/li>\n\n\n\n- Blocking
xmlrpc.php<\/code><\/strong> shuts a door that bots use for brute-force login attempts. Remove that line only if you use the Jetpack plugin or a mobile app that depends on XML-RPC.<\/li>\n\n\n\n- The static-files block<\/strong> tells browsers to cache images, fonts, CSS and JavaScript for 30 days and keeps those requests out of your logs.<\/li>\n<\/ul>\n\n\n\n
When you host a second site on the same Ubuntu VPS, copy this Nginx server block, change server_name<\/code> and root<\/code>, and give it its own WordPress database and user.<\/p>\n\n\n\nPretty Permalinks with Your Nginx Server Block (Including Subfolder Installs)<\/h3>\n\n\n\n
Pretty permalinks turn addresses like example.com\/?p=123<\/code> into clean, readable URLs such as example.com\/my-first-post\/<\/code>. They are better for visitors and for search engines, because the address itself describes the page.<\/p>\n\n\n\nOn Nginx, there is nothing to install and no .htaccess<\/code> to edit. WordPress only needs every unknown address passed to index.php<\/code>, and the try_files<\/code> line in your Nginx server block already does that. Choose Post name<\/strong> under Settings \u2192 Permalinks<\/strong>, click Save Changes<\/strong>, and your URLs are clean straight away.<\/p>\n\n\n\nIf WordPress lives in a subfolder, such as example.com\/blog<\/code>, the root rule is not enough. Keep root \/var\/www\/example.com;<\/code>, place WordPress in \/var\/www\/example.com\/blog<\/code>, and add a block that sends unknown addresses to the subfolder’s own index.php<\/code>:<\/p>\n\n\n\nlocation \/blog\/ {\n try_files $uri $uri\/ \/blog\/index.php?$args;\n}\n<\/code><\/pre>\n\n\n\nWithout it, the blog’s home page loads but every post returns a 404. Test the result by opening a post, or run curl -I https:\/\/example.com\/blog\/my-first-post\/<\/code> and look for 200 OK<\/code>.<\/p>\n\n\n\nBacking Up and Protecting Your WordPress Database<\/h2>\n\n\n\n
Your posts, pages, users and settings all live in the WordPress database, so it deserves the most protection.<\/p>\n\n\n\n
Keep MariaDB private.<\/strong> By default, MariaDB on Ubuntu listens only on 127.0.0.1<\/code>. Check with sudo ss -tlnp | grep 3306<\/code> and never open port 3306 in your firewall when WordPress and MariaDB run on the same server.<\/p>\n\n\n\nBack it up every day.<\/strong> A simple, reliable export looks like this:<\/p>\n\n\n\nsudo mariadb-dump --single-transaction wordpress | gzip > ~\/wordpress-$(date +%F).sql.gz\n<\/code><\/pre>\n\n\n\nSchedule it with cron, keep at least a week of copies, and store some of them off the server, because a backup on the same disk does not survive a disk failure. Back up \/var\/www\/example.com\/wp-content<\/code> too, since your themes, plugins and uploads live there.<\/p>\n\n\n\nChange the table prefix on new sites.<\/strong> If you have not run the installer yet, changing $table_prefix<\/code> in wp-config.php<\/code> from wp_<\/code> to something like ng7x_<\/code> makes automated SQL injection attacks a little less likely to hit the right tables.<\/p>\n\n\n\nEssential Settings After You Install WordPress<\/h2>\n\n\n\n
A fresh install works, but a few minutes of setup makes it faster, safer and friendlier to search engines:<\/p>\n\n\n\n
\n- Set permalinks.<\/strong> Go to Settings \u2192 Permalinks<\/strong> and choose Post name<\/strong>. Thanks to the
try_files<\/code> line, this works immediately on Nginx with no extra rules.<\/li>\n\n\n\n- Check the site address.<\/strong> Under Settings \u2192 General<\/strong>, both addresses should start with
https:\/\/<\/code>.<\/li>\n\n\n\n- Delete what you do not use.<\/strong> Remove the sample post, the sample page, the “Hello Dolly” plugin and every inactive theme except one default theme as a fallback.<\/li>\n\n\n\n
- Turn on automatic updates.<\/strong> Minor WordPress releases update themselves by default. Enable auto-updates for trusted plugins on the Plugins<\/strong> screen as well, because outdated plugins are the most common way WordPress sites get hacked.<\/li>\n\n\n\n
- Add login protection.<\/strong> Enable two-factor authentication with a reputable plugin, and consider Fail2Ban on the server to block repeated failed logins.<\/li>\n<\/ol>\n\n\n\n
Speed Up WordPress on Your Ubuntu VPS<\/h2>\n\n\n\n
Nginx and PHP-FPM are already fast, but caching makes the biggest difference.<\/p>\n\n\n\n
Use a page cache.<\/strong> A caching plugin stores finished pages so PHP and the WordPress database are skipped for repeat visitors. For maximum speed, Nginx’s own FastCGI cache can serve cached pages without touching PHP at all.<\/p>\n\n\n\nAdd an object cache.<\/strong> Install Redis with sudo apt install -y redis-server php-redis<\/code>, restart PHP-FPM, and enable it with a Redis object cache plugin. Busy pages then hit the WordPress database far less often.<\/p>\n\n\n\nTune PHP-FPM for your RAM.<\/strong> The default pool settings in \/etc\/php\/8.5\/fpm\/pool.d\/www.conf<\/code> are conservative. On a 2 GB Ubuntu VPS, pm.max_children = 10<\/code> is a sensible starting point for most WordPress sites; raise it gradually while watching memory with free -h<\/code>.<\/p>\n\n\n\nServe modern images.<\/strong> Current WordPress versions accept WebP and AVIF uploads, which are often much smaller than JPEG at the same quality. Converting large photos before you upload them cuts page weight more than almost any plugin.<\/p>\n\n\n\nOptional: Install WordPress Faster with WP-CLI<\/h2>\n\n\n\n
Once you have done this by hand, you may want to install WordPress faster next time. WP-CLI is the official command-line tool for WordPress, and it can download, configure and install a site in seconds. Install it once:<\/p>\n\n\n\n
curl -O https:\/\/raw.githubusercontent.com\/wp-cli\/builds\/gh-pages\/phar\/wp-cli.phar\nchmod +x wp-cli.phar\nsudo mv wp-cli.phar \/usr\/local\/bin\/wp\n<\/code><\/pre>\n\n\n\nAfter you finish Steps 1 to 6 and Step 10, you can replace Steps 7, 8 and 12 with three commands, run as www-data<\/code>:<\/p>\n\n\n\ncd \/var\/www\/example.com\nsudo -u www-data wp core download\nsudo -u www-data wp config create --dbname=wordpress --dbuser=wpuser --prompt=dbpass\nsudo -u www-data wp core install --url=https:\/\/example.com --title=\"My Site\" --admin_user=yourname --admin_email=you@example.com --prompt=admin_password\n<\/code><\/pre>\n\n\n\nThe --prompt<\/code> options ask for the passwords interactively, so they never end up in your shell history. WP-CLI also makes daily tasks easy: wp plugin update --all<\/code>, wp core update<\/code> and wp db export<\/code> all work the same way.<\/p>\n\n\n\nTroubleshooting Common WordPress and Nginx Errors<\/h2>\n\n\n\n
Most problems after you install WordPress come from a handful of causes:<\/p>\n\n\n\n
\n- 502 Bad Gateway:<\/strong> Nginx cannot reach PHP-FPM. Check that the service runs with
systemctl status php8.5-fpm<\/code> and that the socket path in your Nginx server block matches what ls \/run\/php\/<\/code> shows.<\/li>\n\n\n\n- Error establishing a database connection:<\/strong> the details in
wp-config.php<\/code> do not match Step 5. Test them with mariadb -u wpuser -p wordpress<\/code>. If that login fails, WordPress will fail too.<\/li>\n\n\n\n- Pages other than the home page return 404:<\/strong> the
![\"How](\"https:\/\/nodeguard.io\/blog\/wp-content\/uploads\/2026\/10\/wordpress-ubuntu-nginx-how-it-works-1024x576.webp\")
<\/figure>\n\n\n\n![\"Install](\"https:\/\/nodeguard.io\/blog\/wp-content\/uploads\/2026\/10\/wordpress-ubuntu-nginx-12-steps-1024x576.webp\")