How to set up a server for WordPress

What you are building

A production WordPress server usually includes:

• A web server (Nginx or Apache)
• PHP-FPM with a supported PHP version
• MariaDB or MySQL
• TLS certificates with auto-renewal
• Firewall and failed-login protections
• Automated off-server backups
• Basic monitoring and disk alerts

Step 1: Choose the base and access model

1. Create the VPS in a region close to your visitors.
2. Prefer Ubuntu LTS or another long-support distro your team already knows.
3. Disable password root login. Use SSH keys only.
4. Create a sudo user for day-to-day work.
5. Record the provider’s recovery or console access path before you tighten the firewall.

Step 2: Update and harden the OS

• Apply system updates immediately, then reboot if the kernel changed.
• Enable automatic security updates or a scheduled patch window you actually run.
• Configure a firewall: allow SSH, HTTP, and HTTPS only unless you need more ports.
• Install fail2ban or equivalent and protect SSH.
• Set the timezone and NTP so logs and cron match reality.

Step 3: Install the WordPress stack

You can use a control panel or a lean CLI stack. Either way, verify the following:

• Web server serving a temporary hostname or IP test page
• PHP-FPM connected to the web server with phpinfo() then removed
• Database server listening on localhost only
• A dedicated database and user for WordPress with least privilege

Recommended PHP extensions for most modern WordPress sites include mysqli, curl, xml, mbstring, zip, gd or imagick, and intl.

Step 4: Create the site files and permissions

1. Create a web root such as /var/www/example.com/public.
2. Download WordPress core into that directory or deploy from your own repo.
3. Set ownership to the PHP/web user your stack expects.
4. Use directory permissions around 755 and file permissions around 644.
5. Keep wp-config.php restrictive and never world-writable.

For permission repairs later, see how to fix WordPress file permissions.

Step 5: Configure HTTPS before launch

• Point a staging hostname or wait for DNS if you are launching a brand-new domain.
• Issue certificates with Let’s Encrypt or your provider’s ACME tool.
• Force HTTPS redirects only after the certificate is valid.
• Test renewal with a dry run so certificate expiry does not become an outage.

If padlock warnings appear after go-live, use our SSL error how-to and mixed content guide.

Step 6: Hardening WordPress itself

• Set unique table prefix and strong salts in wp-config.php.
• Disallow file editing in admin with DISALLOW_FILE_EDIT.
• Limit XML-RPC if you do not need it.
• Create an admin user that is not named admin.
• Put SMTP credentials in a proper mail plugin or transactional provider. Do not rely on bare mail().

Step 7: Backups, cron, and monitoring

Step 8: Migrate or launch content

1. Copy files and import the database if migrating.
2. Search-replace URLs carefully for serialized data.
3. Update DNS with a lowered TTL planned days ahead.
4. Flush caches and confirm forms, login, checkout, and webhooks.
5. Leave the old host online briefly as a rollback path.

Full migration walkthrough: migrate WordPress to a new host. Prefer a developer-owned cutover? Request a BugShield migration.

Common setup mistakes

• Opening MySQL to the public internet
• Leaving WP_DEBUG_DISPLAY on for visitors
• No swap or no disk alerts on small VPS plans
• Only provider snapshots, never tested application restores
• Pointing production DNS before HTTPS and mail are ready

Related reading

• Best shared hosting for WordPress
• Best VPS for WordPress
• How to secure wp-config.php