Run WordPress on a self-managed VPS with four pieces: a supported PHP-FPM runtime, MySQL or MariaDB, Caddy as the web server, and a DNS name that reaches the server. Caddy serves the WordPress files, forwards PHP requests to PHP-FPM, and obtains and renews HTTPS certificates through ACME. This guide shows a production-minded setup, including database privileges, file permissions, Caddy routing, verification, backups, and recovery from common failures.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What the finished stack looks like
A browser requests https://example.com. DNS sends the request to your VPS, and Caddy accepts TCP traffic on ports 80 and 443. Caddy serves images, CSS, JavaScript, and other static files directly from the WordPress document root. Requests for PHP scripts go through the PHP-FPM Unix socket. WordPress uses MariaDB or MySQL on the same server, normally bound to localhost rather than exposed to the internet.
As an Amazon Associate I earn from qualifying purchases.
- Caddy: public web server, HTTP-to-HTTPS handling, certificate issuance and renewal, compression, and static-file delivery.
- PHP-FPM: executes WordPress PHP code behind Caddy.
- MariaDB or MySQL: stores posts, users, settings, and plugin data.
- WordPress: the application files and
wp-contentmedia directory. - systemd: keeps the Caddy service running and provides service logs and reload controls.
The arrangement gives you complete server control, but you remain responsible for operating-system patches, database security, backups, firewall rules, monitoring, and incident response.
Requirements before you start
Server and network prerequisites
- A current Linux VPS distribution with root or sudo access.
- A public IPv4 address, IPv6 address, or both, depending on your DNS design.
- A registered domain or subdomain. Create an A record for IPv4 and an AAAA record only when IPv6 is correctly configured on the VPS.
- Inbound TCP ports 80 and 443 allowed by both the VPS provider’s network firewall and the operating-system firewall. Port 80 is needed for normal HTTP redirects and ACME HTTP challenges; port 443 carries HTTPS and TLS challenges.
- Enough storage for the operating system, database, WordPress core, themes, plugins, media, logs, and backups. There is no authoritative one-size-fits-all VPS size: expected traffic, media volume, and plugin workload determine the requirement.
Supported software versions
WordPress’s published baseline is PHP 7.4 or newer, MySQL 5.7 or newer or MariaDB 10.3 or newer, and HTTPS support. Its current requirements page recommends MariaDB 10.11 or newer or MySQL 8.0 or newer for the smoothest experience. That page was first published March 28, 2023 and last updated December 17, 2025, so check it again when choosing packages for a new server.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Use the PHP-FPM package supplied by your distribution and install the extensions required by the WordPress release, theme, and plugins you will run. Typical distributions package extensions for database access, cURL, image processing, multibyte strings, XML, and ZIP separately from the FPM service. Do not assume that a minimal PHP installation includes them.
1. Update the VPS and install PHP-FPM and the database
Log in over SSH with an administrative account, update package metadata and installed packages, then install PHP-FPM, the PHP extensions required by your chosen WordPress version, and MariaDB or MySQL using your distribution’s package manager. On a Debian- or Ubuntu-family system, the package names commonly include php-fpm, a database connector such as php-mysql, and the database server package; exact names vary by release.
Recommended Free Tools
sudo apt update
sudo apt upgrade
sudo apt install php-fpm php-mysql mariadb-serverThe command is an example for an apt-based distribution, not a universal command. Use the equivalent packages for your Linux release. Record the PHP-FPM service name and socket path; distributions often include the PHP version in both, for example a service such as php8.3-fpm and a socket such as /run/php/php8.3-fpm.sock.
Keep the database listening on localhost unless your architecture specifically requires remote connections. A database reachable from the public internet expands the attack surface and is unnecessary when WordPress, PHP-FPM, and the database run on one VPS.
Enable and start PHP-FPM and the database service using their distribution-specific systemd names. Verify that each reports an active state before moving on. If PHP-FPM fails to start, inspect its journal immediately; a configuration error is easier to fix before Caddy begins forwarding requests.
2. Install Caddy as a production system service
Install Caddy from the official package for your Linux distribution rather than copying a random binary or running it inside an interactive shell. The official packages integrate Caddy with systemd. In a production installation the service is named caddy.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →sudo systemctl enable --now caddy
sudo systemctl status caddyThe status command should show an active service. Caddy may start with a default configuration; you will replace or edit it after creating the WordPress document root and confirming the PHP-FPM socket. Running Caddy as a service means it can restart after a reboot and its logs are available through systemd.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
3. Create a least-privilege WordPress database
Open the MariaDB or MySQL client as an administrator and create a database with UTF-8 support and a separate login used only by WordPress. Do not use the database administrator account in the WordPress installer.
sudo mariadbCREATE DATABASE wordpress CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'wp_user'@'localhost' IDENTIFIED BY 'use-a-long-unique-password';
GRANT ALL PRIVILEGES ON wordpress.* TO 'wp_user'@'localhost';
FLUSH PRIVILEGES;
EXIT;Choose a database name, username, and password that are not reused elsewhere. The password is entered into the browser installer, so store it in a password manager. The host value is localhost when the database is local. If you later move the database to another server, create a narrowly scoped account and explicitly restrict its source addresses instead of opening the database to every IP.
4. Download WordPress into a dedicated document root
Create a directory such as /var/www/wordpress and place a current WordPress release there. Obtain the archive from the official WordPress distribution channel, verify that the download completed, extract it, and copy the contents (including hidden files such as .htaccess if present in a package) into the document root. Remove any temporary archive from a web-accessible directory.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorssudo mkdir -p /var/www/wordpress
sudo rsync -a wordpress/ /var/www/wordpress/The rsync line assumes you have already extracted a directory named wordpress in your current working directory. Substitute the extraction method supplied by your distribution or the official release archive; the important result is that index.php, wp-admin, wp-includes, and wp-content are directly under /var/www/wordpress, not one level deeper.
Set ownership and permissions deliberately
Find which account runs PHP-FPM and which account Caddy uses on your distribution. Debian-family PHP-FPM pools commonly use www-data, while the Caddy package commonly uses a caddy account. The web server must be able to traverse the parent directories and read WordPress files; PHP-FPM needs write access only to paths where WordPress must create files, normally parts of wp-content.
sudo chown -R root:www-data /var/www/wordpress
sudo find /var/www/wordpress -type d -exec chmod 755 {} ;
sudo find /var/www/wordpress -type f -exec chmod 644 {} ;
These are conservative example permissions. Adjust the group to the actual PHP-FPM account and grant group write access only to the operational directories you have chosen, rather than making the entire tree world-writable. If WordPress must upload media or install updates without SSH, permit the PHP-FPM user to write to the relevant wp-content paths and keep core PHP files protected from routine web-process writes. Recheck directory traversal permissions on /var, /var/www, and the document root when diagnosing access errors.
5. Point DNS at the VPS
Create DNS records for the exact hostname you will use in the Caddyfile. Wait until public DNS resolvers return the VPS address before requesting a certificate. If an old server, forwarding service, or proxy still answers for the name, Caddy’s ACME validation can fail even though the VPS itself is configured correctly.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Test from the VPS and from an external network. Confirm that an A record reaches the intended IPv4 address and that any AAAA record reaches a working IPv6 listener. A stale AAAA record can send some visitors to a different machine while IPv4 users appear to work.
6. Configure Caddy for WordPress and PHP-FPM
Edit the Caddyfile used by the package, commonly /etc/caddy/Caddyfile. Replace example.com with your real hostname and replace the socket with the path reported by your PHP-FPM package.
example.com {
root * /var/www/wordpress
encode gzip
php_fastcgi unix//run/php/php8.3-fpm.sock
file_server
}The root directive sets the document root. encode gzip compresses responses that benefit from compression. php_fastcgi is Caddy’s shortcut for routing PHP requests to FastCGI and applying the fallback behavior WordPress needs. file_server serves static assets and should be paired with php_fastcgi in this pattern. If your distribution uses a generic socket such as /run/php/php-fpm.sock, use that exact path instead.
Do not guess the socket name. List the PHP runtime directory or inspect the active FPM pool configuration, then confirm that the socket exists and is readable by the Caddy service account. A version upgrade can change a versioned socket path and cause a 502 until the Caddyfile is updated.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Add targeted WordPress protections when they fit your site
Caddy’s WordPress pattern documentation includes rules that block files which should never be downloaded or executed. Apply them after considering the plugins you actually use. In particular, prevent PHP execution under the uploads directory, deny direct access to SQL dumps, and restrict xmlrpc.php when your site does not require it.
example.com {
root * /var/www/wordpress
encode gzip
@xmlrpc path /xmlrpc.php
respond @xmlrpc 403
@uploadsPhp path_regexp uploadsPhp ^/wp-content/uploads/.*.php$
respond @uploadsPhp 404
@sqlFiles path_regexp sqlFiles (?i).*.sql$
respond @sqlFiles 404
php_fastcgi unix//run/php/php8.3-fpm.sock
file_server
}The upload rule is a defense-in-depth measure: an uploaded PHP file should not become executable code. The SQL rule helps keep accidentally stored database dumps private. XML-RPC is used by some legitimate integrations, so a blanket block can break a service that depends on it; leave that rule out or narrow it when required. Review every deny rule after installing plugins, and test both the front end and administrative functions.
7. Validate, reload, and watch the logs
Never reload an unvalidated configuration. Validate the file, reload the service, and follow both Caddy and PHP-FPM logs while making the first request.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
sudo caddy validate --config /etc/caddy/Caddyfile
sudo systemctl reload caddy
sudo systemctl is-active caddy
sudo journalctl -u caddy -fUse the corresponding PHP-FPM service name to inspect its journal as well. A successful validation checks Caddyfile syntax, but it does not prove that the socket exists, DNS is correct, or the PHP process can read every file. Those require an actual request.
8. Let Caddy obtain HTTPS certificates
With DNS pointing to the VPS and ports 80 and 443 reachable, browse to the configured hostname. Caddy automatically requests and renews a public certificate through ACME. Its documented default TLS settings use TLS 1.2 as the minimum and TLS 1.3 as the maximum; Caddy describes those defaults as secure. You normally do not need to write custom cipher or protocol settings.
Certificate issuance depends on public reachability. A provider firewall, local firewall, incorrect DNS record, or an intervening proxy/CDN that intercepts ACME challenges can prevent issuance. Caddy’s logs identify the challenge that failed; correct the network or DNS condition and retry rather than repeatedly changing TLS settings.
Once the certificate is active, requests to the HTTP endpoint should redirect to HTTPS. Check that the browser shows the expected hostname and that no mixed-content warnings appear after WordPress is configured with an HTTPS site URL.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 119. Complete the WordPress browser installer
- Open
https://example.comafter Caddy has obtained the certificate. - Choose the installation language and enter the database name, database username, database password, and host created earlier. Use
localhostfor a local database. - Set a unique administrator username, a long password, an administrator email address, and a site title. Avoid using “admin” as the administrator username.
- Confirm that the site URL uses
https://, finish the installation, and sign in to/wp-admin/. - Update WordPress core, themes, and plugins before publishing content. Remove any temporary archives or extracted copies that are not part of the live installation.
After logging in, open the Site Health screen. It should recognize HTTPS and show no database connection errors. Configure permalinks to the structure you want, then test a post URL while logged out; this is the quickest confirmation that Caddy’s PHP fallback and the WordPress root are aligned.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Verification checklist
systemctl is-active caddyreportsactive, and the PHP-FPM service reportsactive.caddy validate --config /etc/caddy/Caddyfilesucceeds before every reload.- The front page loads over HTTPS, and an HTTP request redirects to the HTTPS URL.
- A pretty permalink resolves to the requested post or page instead of a Caddy 404.
- The WordPress Site Health screen reports HTTPS and no database connection errors.
- Caddy logs show certificate issuance or renewal without repeated upstream socket failures.
- A backup restore has been tested in a separate location, not merely recorded as a successful backup job.
- Database dumps and the
wp-contentmedia directory are included in the backup set.
Troubleshoot the first request
502 Bad Gateway
A 502 normally means Caddy cannot connect to PHP-FPM. Confirm the FPM service is running, verify the socket path in the Caddyfile character for character, and check that the Caddy service account can access the socket and traverse its parent directories. A PHP-FPM restart after a package upgrade can also create a new versioned socket while the old path remains in Caddy’s configuration.
The browser downloads a PHP file or displays PHP source
The request is not reaching php_fastcgi. Check that the Caddyfile site block matches the hostname, that the document root contains index.php, and that php_fastcgi appears before the final file_server directive in the intended site block. Validate and reload after correcting the configuration. Do not leave a site online if it is exposing PHP source.
Only pretty permalinks return 404
The document root may point one directory too high or too low, or the request may not be using WordPress’s fallback behavior. Confirm that /var/www/wordpress/index.php exists, that the hostname reaches the correct site block, and that a direct request to the front page works. The php_fastcgi WordPress pattern should route missing paths to WordPress; a static-only configuration will not.
ACME certificate issuance fails
Check that public DNS resolves to this VPS, that ports 80 and 443 are permitted at every firewall layer, and that no proxy or CDN is intercepting the challenge. Inspect the Caddy journal for the exact challenge error. Fix the underlying DNS or reachability problem before trying again.
Permission denied while uploading or updating
Identify the account used by the PHP-FPM pool, then check ownership, mode bits, and directory traversal on every parent directory. Give write access only to the WordPress paths that need it, usually selected wp-content directories. Avoid solving an upload error by changing the entire document root to mode 777; that lets any local process or compromised service alter executable PHP files.
Database connection errors
Recheck the database name, username, password, and host entered during installation. Test the credentials locally with the database client, confirm the database service is active, and inspect its logs. If the database is bound to localhost, do not enter a public IP as the host.
Operate the VPS after launch
Updates
Apply operating-system, PHP, database, Caddy, WordPress, theme, and plugin updates on a schedule. Read release notes for PHP and plugin compatibility before updating a busy site. After updates, check the front page, an authenticated administrative page, a form or checkout workflow if applicable, and a representative media URL.
Free tools Windows power users keep installed
One-click scans. No signup required.
Backups and recovery
A usable WordPress backup contains at least a database dump and wp-content, especially uploads. Keep copies off the VPS so a disk failure, account compromise, or accidental deletion does not destroy both the live site and its backups. Periodically restore to a separate test location and verify that the restored database, media, HTTPS configuration, and login all work. A backup that has never been restored is an assumption, not a recovery plan.
Firewall and monitoring
Expose only the services you need. Public web traffic requires TCP 80 and 443; SSH should be restricted according to your administration policy. Monitor disk space, certificate events, Caddy errors, PHP-FPM failures, database health, and failed logins. Repeated upstream socket failures often indicate a stopped FPM service, exhausted workers, or a path changed by a package update.
Self-managed VPS or managed WordPress service?
A general VPS is appropriate when you need control over Caddy’s configuration, PHP-FPM, firewall, and operating system. It also means you own patching, backups, monitoring, and incident response. Managed WordPress services reduce routine administration but may not expose Caddy configuration or the underlying system.
| Decision factor | Self-managed VPS | Managed WordPress service |
|---|---|---|
| Web-server control | Full control of Caddyfile, routing, headers, and PHP-FPM integration. | Often limited to the provider’s supported settings; Caddy may not be available. |
| Software versions | You select supported PHP-FPM and MariaDB/MySQL versions and schedule upgrades. | The provider selects or exposes only approved versions. |
| HTTPS | Caddy can issue and renew ACME certificates when DNS and ports are reachable. | Usually handled by the provider, subject to its domain and proxy design. |
| Backups and restore | You must configure, store, and test database and media backups. | Backup tooling may be included, but confirm retention, export access, and restore testing. |
| Monitoring and firewall | You choose logs, alerts, firewall rules, and response procedures. | Some monitoring and firewall controls are supplied; scope varies. |
| IPv6 and storage | You control address records, routing, disk choice, and performance characteristics. | Availability and storage behavior depend on the provider. |
| Expected traffic | You size and tune the VPS for your actual workload; no universal capacity number applies. | The service’s plan limits and scaling model determine the ceiling. |
Choose the VPS route when configuration control and hands-on operations matter more than minimizing administration. Choose managed hosting when a provider’s supported stack, backup process, and response coverage meet your requirements and you do not need to edit the Caddy or operating-system layer.
Quick Recap
Maintenance checklist
- Keep DNS records, Caddy, PHP-FPM, the database, WordPress, themes, and plugins current.
- Review
systemctl statusand service logs after reboots and package upgrades. - Run Caddy validation before each reload.
- Confirm HTTPS renewal and HTTP-to-HTTPS redirection periodically.
- Test a pretty permalink and a media upload after significant configuration changes.
- Retain database dumps and
wp-contentbackups off-server, with documented restoration steps. - Revisit permissions whenever a plugin requests filesystem write access; keep executable core files protected.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
