The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →You can run a secure WordPress site on a fresh Ubuntu 24.04 server with Nginx, PHP-FPM, MariaDB, and HTTPS in one VM. This guide takes you from DNS and package updates through the WordPress browser wizard, then verifies PHP, database access, permalinks, uploads, TLS redirects, and the firewall.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What you will build
A LEMP stack uses Linux, Nginx (the “E”), MariaDB or MySQL, and PHP. The finished installation has Nginx serving your domain, PHP-FPM processing .php requests, MariaDB storing WordPress data, and Certbot obtaining and renewing a certificate. WordPress.org recommends PHP 8.3 or newer, MariaDB 10.11 or newer (or MySQL 8.0 or newer), HTTPS, and Nginx or Apache as a robust web server. Ubuntu 24.04 supplies PHP 8.3, which is a compatible baseline. For a new production deployment, use a newer supported PHP branch such as PHP 8.4 when your repository and plugins support it; the Hosting Handbook records PHP 8.3 as security-only after 31 December 2025 and recommends PHP 8.4 or later for production.
As an Amazon Associate I earn from qualifying purchases.
This procedure assumes a single virtual machine with at least 2 GB of RAM, an SSH-capable non-root sudo account, control of the domain’s DNS, and a public IPv4 address. Nginx, PHP-FPM, MariaDB, WordPress, TLS, and backups all share that VM. A split database or application design can scale further, but it adds networking, credentials, monitoring, and backup work.
Decide the deployment details first
| Decision | Choice in this guide | When another choice makes sense |
|---|---|---|
| Server layout | One VM running every component | Split services when you need independent scaling, managed databases, or separate failure domains |
| Database | MariaDB 10.11 or newer | MySQL 8.0 or newer is also supported; use one database engine, not both |
| PHP | Ubuntu 24.04 PHP 8.3 packages | PHP 8.4 or another currently supported branch for new production sites, after checking plugin and theme compatibility |
| Hosting model | Self-managed VPS with SSH, sudo, DNS, and firewall control | Managed WordPress hosting removes operating-system maintenance but does not follow this LEMP procedure |
Prerequisites and naming conventions
- Use a fully qualified hostname such as
example.com. Replace it and every other placeholder below with your own values. - Create an A record for the domain pointing to the VM’s public IPv4 address. Publish an AAAA record only when IPv6 is configured, routable, and allowed through the firewall.
- Have a non-root account that can run
sudo. Keep a second SSH session open while changing firewall rules. - Prepare a unique, randomly generated database password and a separate WordPress administrator password. Do not paste either into screenshots, tickets, or shell history.
- Ensure the VM has at least 2 GB RAM for a small site. PHP memory of 128 MB is enough for a vanilla install; 256 MB is a sensible default for a typical production site with several plugins and a modern theme.
1. Point DNS at the server and update Ubuntu
DNS must resolve before certificate issuance. In your DNS provider, set the domain’s A record to the VM address. Add www only if you will request a certificate for it; that name must resolve to the same server.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Connect over SSH and update the operating system:
ssh your-user@example-server
sudo apt update
sudo apt upgrade -y
If the upgrade installs a new kernel or reports that a reboot is required, restart during a maintenance window:
sudo rebootAfter reconnecting, check both DNS records from a machine with dig:
dig +short A example.com
dig +short AAAA example.comThe A result must be your VM’s IPv4 address. If you do not have working IPv6, an empty AAAA result is preferable to an unreachable address.
2. Install Nginx, MariaDB, PHP-FPM, and WordPress extensions
Install the web server, database, PHP-FPM, required extensions, and archive utilities:
sudo apt install -y nginx mariadb-server php-fpm php-mysql php-curl php-gd php-intl php-mbstring php-soap php-xml php-zip php-imagick curl tar openssl unzipUbuntu 24.04 normally installs PHP 8.3. Enable the services and start them now:
sudo systemctl enable --now nginx
sudo systemctl enable --now mariadb
sudo systemctl enable --now php8.3-fpmConfirm the versions and service state:
nginx -v
php -v
mariadb --version
systemctl --no-pager --full status nginx mariadb php8.3-fpmIf your enabled PHP branch is not 8.3, use its matching FPM service name and socket in the Nginx configuration later. Do not point Nginx at a socket that does not exist.
3. Harden MariaDB and create a least-privilege WordPress database
Run the hardening routine supplied by your MariaDB release:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
sudo mariadb-secure-installationFollow the prompts to remove anonymous users, disallow remote root access, remove the test database, and reload privilege tables. Exact prompts vary by MariaDB release; retain local administrative access through sudo mariadb.
Create a database and a local account used only by WordPress. The account is restricted to connections from the same VM and receives privileges only on the WordPress database:
sudo mariadbCREATE DATABASE wordpress CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'wpuser'@'localhost' IDENTIFIED BY 'replace-with-a-long-unique-password';
GRANT ALL PRIVILEGES ON wordpress.* TO 'wpuser'@'localhost';
FLUSH PRIVILEGES;
EXIT;Use a strong password that is not reused anywhere else. If you accidentally expose it in a command or terminal recording, rotate it immediately:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutesudo mariadb
ALTER USER 'wpuser'@'localhost' IDENTIFIED BY 'new-long-unique-password';
FLUSH PRIVILEGES;
EXIT;Do not grant the WordPress user global privileges or allow it to connect remotely unless your architecture specifically requires that.
4. Download WordPress into a domain-specific document root
Download the current WordPress archive from the official source, extract it under Nginx’s web directory, and rename the directory to your domain:
cd /tmp
wget https://wordpress.org/latest.zip
sudo unzip latest.zip -d /usr/share/nginx/
sudo mv /usr/share/nginx/wordpress /usr/share/nginx/example.com
sudo rm latest.zipThe resulting document root is /usr/share/nginx/example.com. Keeping each site in its own directory makes later migrations and server-block changes less error-prone.
5. Create wp-config.php, salts, and safe permissions
Copy the sample configuration and edit it:
cd /usr/share/nginx/example.com
sudo cp wp-config-sample.php wp-config.php
sudo nano wp-config.phpSet these values to match the database you created:
Recommended Free Tools
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
define( 'DB_NAME', 'wordpress' );
define( 'DB_USER', 'wpuser' );
define( 'DB_PASSWORD', 'replace-with-a-long-unique-password' );
define( 'DB_HOST', 'localhost' );
define( 'DB_CHARSET', 'utf8mb4' );
define( 'DB_COLLATE', '' );Replace every placeholder authentication key and salt in the file with fresh random values from the official WordPress salt endpoint or installer. Never reuse salts between sites. After changing salts on an existing site, all logged-in sessions are invalidated.
Use ownership that lets PHP-FPM write where WordPress needs to write without making the entire tree world-writable:
sudo chown -R root:www-data /usr/share/nginx/example.com
sudo find /usr/share/nginx/example.com -type d -exec chmod 755 {} ;
sudo find /usr/share/nginx/example.com -type f -exec chmod 644 {} ;
sudo chown root:www-data /usr/share/nginx/example.com/wp-config.php
sudo chmod 640 /usr/share/nginx/example.com/wp-config.php
sudo chown -R www-data:www-data /usr/share/nginx/example.com/wp-content
Giving www-data ownership of wp-content permits media uploads and, when enabled, plugin and theme updates. If your update policy uses deployment tooling instead, keep code owned by your administrator and grant write access only to wp-content/uploads. Never use chmod -R 777.
6. Configure the Nginx server block
Create a site configuration:
sudo nano /etc/nginx/sites-available/example.comUse this server block, replacing the domain names and PHP socket if your PHP version differs:
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
root /usr/share/nginx/example.com;
index index.php index.html;
location / {
try_files $uri $uri/ /index.php?$args;
}
location ~ .php$ {
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/run/php/php8.3-fpm.sock;
}
location ~* /(?:.git|.env|wp-config.php|wp-admin/install.php) {
deny all;
}
location ~* ^/wp-content/uploads/.*.php$ {
deny all;
}
location ~ /.ht {
deny all;
}
}
The try_files rule is WordPress’s front-controller fallback: real files and directories are served directly, while other URLs are passed to index.php so pretty permalinks work. The sensitive-file rule blocks common configuration and repository files. The uploads rule prevents an uploaded PHP file from being executed.
Enable the site and remove the default conflicting configuration:
sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/example.com
sudo rm -f /etc/nginx/sites-enabled/default
sudo nginx -t
sudo systemctl reload nginxnginx -t must report a successful syntax check. If it names an unknown socket, list installed sockets with ls /run/php/ and change fastcgi_pass to the matching FPM socket.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
7. Open only the required firewall ports
Allow SSH before enabling UFW, otherwise a mistake can lock you out:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorssudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verboseConfirm that the SSH rule appears before closing your existing session. If your SSH daemon uses a nonstandard port, allow that specific port instead of the OpenSSH profile.
8. Enable HTTPS with Certbot before entering credentials
Install Certbot’s Nginx integration:
sudo apt install -y certbot python3-certbot-nginxRequest a certificate only for hostnames whose DNS records already resolve to this VM. The following command also configures HTTP-to-HTTPS redirection, HSTS, and OCSP stapling:
sudo certbot --nginx --agree-tos --redirect --hsts --staple-ocsp --email [email protected] -d example.com -d www.example.comUse a real monitored mailbox. Omit www.example.com if you did not create and verify that DNS record. Certbot edits the Nginx configuration and schedules renewal through the installed timer. Check renewal readiness without issuing a real certificate:
sudo certbot renew --dry-runVisit https://example.com. An HTTP request to http://example.com should redirect to HTTPS. Do not submit database or administrator credentials until the secure URL loads.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →9. Complete the WordPress browser wizard
- Open the HTTPS hostname in a browser. If WordPress displays a language selector, choose the site language.
- Enter database name
wordpress, usernamewpuser, the password you created, database hostlocalhost, and the default table prefix unless you have a documented reason to change it. - Submit the form. WordPress writes its tables through the local MariaDB account.
- Enter a site title, a unique administrator username that is not “admin,” a strong administrator password, and a monitored email address.
- Complete installation, sign in at
/wp-admin/, and immediately apply available core, theme, and plugin updates.
If the browser reports “Error establishing a database connection,” verify the database name, user, password, and host in wp-config.php, then test the account interactively:
mariadb -u wpuser -p -h localhost wordpressFor a 502 or “File not found” response, check systemctl status php8.3-fpm, the socket path, and Nginx’s error log with sudo tail -f /var/log/nginx/error.log.
Verification checklist after installation
Run these checks before declaring the site ready:
- Services:
systemctl is-active nginx mariadb php8.3-fpmreturnsactivefor each service. - DNS:
dig +short A example.commatches the VM. Check AAAA only when IPv6 is intentionally configured. - TLS:
curl -I http://example.comshows a redirect to HTTPS, andcurl -I https://example.comreturns a successful response. - Login: Sign in at
https://example.com/wp-admin/and confirm the dashboard loads without mixed-content warnings. - Permalinks: In WordPress, open Settings, Permalinks, select a preferred structure, and save. Open a post in a private browser window to confirm it does not return 404.
- Media: Upload a JPEG or PNG in Media, insert it into a draft, and confirm the generated URL uses HTTPS.
- Uploads execution block: Create a temporary file named
test.phpin/usr/share/nginx/example.com/wp-content/uploads/containing<?php echo 'test';, request its HTTPS URL, and confirm it is denied or downloaded rather than executed. Remove it immediately afterward. - Firewall:
sudo ufw statuslists SSH, 80/tcp, and 443/tcp only (plus any explicitly required administration port). - Backups: Confirm that both the MariaDB database and the WordPress files are included in your backup job and that a restoration test has a scheduled date.
Common failures and precise fixes
Certificate issuance fails
Check that every requested hostname resolves to this VM, port 80 is reachable, and Nginx answers the hostname in its server_name. Remove names without DNS records and run Certbot again. A stale AAAA record pointing elsewhere can make validation fail even when the A record is correct.
Nginx returns 403 or serves the wrong page
Run sudo nginx -T and look for another enabled server block with the same hostname. Confirm the document root exactly matches /usr/share/nginx/example.com, then run sudo nginx -t && sudo systemctl reload nginx. Check that directories are searchable (755) and that Nginx can read files through the root:www-data ownership scheme.
Permalinks return 404 after the homepage works
Ensure the location block contains try_files $uri $uri/ /index.php?$args; and that PHP requests pass to the active FPM socket. Save the permalink settings once in the dashboard to flush WordPress’s rewrite rules.
Uploads fail or exceed limits
Check free disk space with df -h and ownership of wp-content. For larger files, inspect the active PHP-FPM configuration with php --ini and raise upload_max_filesize and post_max_size deliberately, keeping post_max_size at least as large as the upload limit. Restart the matching FPM service after edits.
The site becomes slow or PHP workers are killed
Inspect memory and process errors with free -h and sudo journalctl -u php8.3-fpm. A vanilla site can run with 128 MB PHP memory, while a plugin-heavy production site commonly needs a 256 MB default. Increase limits only after identifying the workload, and add RAM or tune FPM workers when the VM is consistently swapping.
Maintenance, updates, and backups
Apply security updates regularly:
sudo apt update
sudo apt upgrade -yKeep Nginx, PHP-FPM, MariaDB, WordPress core, themes, and plugins current. Before a major PHP or WordPress upgrade, verify that your plugins and theme support the target PHP branch. The Hosting Handbook lists WordPress 7.1 as fully compatible with PHP 8.2, 8.3, 8.4, and 8.5, but individual extensions can still impose their own constraints.
Free tools Windows power users keep installed
One-click scans. No signup required.
Back up two separate assets: the MariaDB database and the complete WordPress directory, including wp-content and wp-config.php. Store copies away from the VM, encrypt them, restrict access, and periodically restore both into a test environment. A backup that has never been restored is only an assumption.
Monitor disk usage, certificate renewal, Nginx and PHP-FPM logs, MariaDB health, and failed SSH attempts. Remove unused plugins and themes, use separate administrator accounts instead of sharing credentials, and rotate database or administrator passwords after suspected exposure.
When to move beyond a single VM
The single-server LEMP design is straightforward and economical for one small or medium site, but every component shares the VM’s CPU, memory, disk, and outage domain. Consider a split design when database load, media processing, or traffic requires independent scaling, or when you need a managed database with automated replication. That change requires private networking, encrypted database connections, new firewall rules, coordinated backups, and a revised failure-recovery plan. If you do not want to maintain those layers, managed WordPress hosting may be a better operational fit, although it will not provide the same system-level control as this Ubuntu 24.04 installation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
