Halloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsWindows FixRecommendedWindows errors stealing your time? Find the fix fastScan stability, cleanup and performance issues.Fix NowHalloween DealsAmazon USOctober picks are moving - compare before checkoutAmazon US: current deals, useful picks and tech finds.See Picks×
FREEDOM251

Freedom251 › Blog › Apache

Ubuntu WordPress Setup with Apache and Cloudflare: A Complete Guide

By Freedom251 Team · · 14 min read

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.

To install WordPress on Ubuntu with Apache and Cloudflare, build the origin in five layers: a supported Ubuntu system, Apache, PHP, MariaDB or MySQL, and the WordPress files. Then publish the site through Cloudflare DNS, install an origin certificate on Apache, and set Cloudflare to Full (strict). The most common failures are an outdated PHP/database package, incorrect Apache permissions, and an HTTP/HTTPS or host-header mismatch behind the proxy. This guide gives a repeatable single-site setup, explains the choices that matter on multi-site servers, and shows how to recover from redirect loops, database errors, and certificate warnings.

What do you need before installing WordPress?

Use a supported Ubuntu release with security updates, a user that can run sudo, a domain name, and an IPv4 or IPv6 address that points to the server. Keep SSH access independent from the web traffic you will later proxy through Cloudflare. You should also have a plan for database backups, file backups, and restoring a known-good version before changing PHP, Apache, or TLS settings.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

WordPress.org’s current requirements page, accessed in 2026, recommends PHP 8.3 or greater, MariaDB 10.11 or greater or MySQL 8.0 or greater, and HTTPS. Apache is a recommended web server. Ubuntu repositories vary by release, so verify the installed versions instead of assuming that an apt package meets those requirements.

  • A DNS name such as example.com and, if used, www.example.com.
  • At least one non-root administrative account with sudo.
  • TCP port 80 available for initial HTTP validation and port 443 available for HTTPS.
  • A strong, unique database password and a separate WordPress administrator password.
  • A maintenance window if the server already hosts other sites.

Which installation choices matter?

The simplest reliable design is one Ubuntu server running Apache, PHP, and MariaDB, with Cloudflare proxying the public web records. The comparison below highlights decisions that affect maintenance rather than merely changing commands.

#1 Best Overall
Elebase USB to USB C Adapter for iPhone 18 Pro Max,USBC Car Charger Adapter | 4Pack Type C Female to A Male Cable Converter for Apple Duo 17 16 15 14 Plus,iWatch Watch 12 11 10,iPad 9 8 Air,Airpods 5 4
  • Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
  • Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
  • Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
  • Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
  • 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Decision Option used here Alternative and trade-off
WordPress distribution Current archive from WordPress.org, unpacked under /srv/www/wordpress. The Ubuntu Archive package is easier to install but may trail upstream. The Ubuntu tutorial explicitly uses the WordPress.org release because it is the upstream-preferred method.
PHP execution Apache with the Ubuntu PHP module for a straightforward single site. PHP-FPM gives process-pool isolation and more tuning control, which is preferable when several sites or different PHP limits share the host.
Database MariaDB or MySQL managed locally with a dedicated WordPress account. A managed database reduces patching work but adds network, access-control, and backup dependencies.
Origin certificate Cloudflare Origin CA, trusted by Cloudflare for proxied traffic. A publicly trusted certificate also works for direct browser access and for periods when a DNS record is not proxied.
Cloudflare mode Proxy only the web records, with Full (strict) after Apache has a valid origin certificate. DNS-only records expose the origin directly and require a browser-trusted certificate on the server.
Server scope One virtual host and one WordPress installation. Multiple sites require separate virtual hosts, ownership boundaries, logs, backups, and usually PHP-FPM pools.

How do you install Apache, PHP, and the required extensions?

Update the operating system first, then install Apache, the database server, PHP, and the extensions used by WordPress and common plugins. The package names below are the usual Ubuntu names; if your release selects an older PHP stream, stop and move to a supported Ubuntu release or an approved, maintained PHP source rather than running WordPress below its recommended version.

  1. Refresh package metadata and apply available security updates:

    Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
    sudo apt update
    sudo apt full-upgrade -y
  2. Install the web and database stack:

    sudo apt install -y apache2 mariadb-server php libapache2-mod-php php-mysql php-curl php-gd php-mbstring php-xml php-xmlrpc php-soap php-intl php-zip unzip curl
  3. Check the versions and services:

    php -v
    apache2 -v
    mariadb --version
    sudo systemctl is-active apache2
    sudo systemctl is-active mariadb
  4. Enable services at boot:

    sudo systemctl enable --now apache2 mariadb

WordPress can use either MySQL or MariaDB, but the database server and PHP connector must agree. The php-mysql package supplies the connector used by both. Keep the command output with your deployment notes; it makes later troubleshooting and rollback far easier.

How do you create a least-privilege WordPress database?

WordPress needs a database and a database user that can operate on that database. Do not reuse the database server’s administrative account in wp-config.php. Create a database with utf8mb4, grant privileges only on that database, and use a long random password.

  1. Open the local MariaDB or MySQL shell:

    sudo mariadb
  2. Run SQL with your own database name, username, and generated password:

    CREATE DATABASE wordpress CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
    CREATE USER 'wpuser'@'localhost' IDENTIFIED BY 'replace-with-a-long-random-password';
    GRANT ALL PRIVILEGES ON wordpress.* TO 'wpuser'@'localhost';
    FLUSH PRIVILEGES;
    EXIT;
  3. Record the four values WordPress will need: database name, database user, password, and host. For a local database, the host is normally localhost.

    Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The grant is intentionally scoped to wordpress.*. If several sites share the server, give each site a different database and database account. Avoid granting global privileges, and do not expose the database port to the public Internet unless a specific remote architecture requires it and firewall rules restrict the source addresses.

How do you download and place the WordPress files?

Use the current upstream archive rather than an old distribution package. The following example keeps web content under /srv/www, a location that makes ownership and virtual-host boundaries clear.

Rank #2
Sale
Anker USB-C Hub, 5-in-1 USB Hub for Laptops, 4K HDMI Multiport Adapter | USB C Dongle with 90W Max Power Delivery, 3×5Gbps USB A Data Ports, for MacBook, Dell, and More (Charger Not Included)
  • 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
  • 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
  • Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
  • 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
  • What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
  1. Download and unpack the archive:

    cd /tmp
    curl -LO https://wordpress.org/latest.tar.gz
    sudo mkdir -p /srv/www
    sudo tar -xzf latest.tar.gz -C /srv/www
  2. Confirm the expected directory exists:

    ls -la /srv/www/wordpress
  3. Set ownership and conservative permissions for a single-site server:

    sudo chown -R www-data:www-data /srv/www/wordpress
    sudo find /srv/www/wordpress -type d -exec chmod 755 {} ;
    sudo find /srv/www/wordpress -type f -exec chmod 644 {} ;

Those permissions let Apache read the site and write where WordPress needs to write, but they are not a substitute for a deployment policy. On a multi-site host, consider a per-site Unix account, a controlled release directory, and only narrowly writable upload or cache directories. Never make the entire web root world-writable to “fix” an update error.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

How do you configure an Apache virtual host?

The virtual host maps your domain to the WordPress document root and allows WordPress’s .htaccess rewrite rules. Replace the example names before saving the file.

  1. Create a site definition:

    sudo nano /etc/apache2/sites-available/wordpress.conf
  2. Use this HTTP virtual host:

    <VirtualHost *:80>
        ServerName example.com
        ServerAlias www.example.com
        DocumentRoot /srv/www/wordpress
    
        DirectoryIndex index.php
    
        <Directory /srv/www/wordpress>
            Options FollowSymLinks
            AllowOverride All
            Require all granted
        </Directory>
    
        ErrorLog ${APACHE_LOG_DIR}/wordpress_error.log
        CustomLog ${APACHE_LOG_DIR}/wordpress_access.log combined
    </VirtualHost>
  3. Enable the site and the rewrite module. Disable the default site if this server is dedicated to WordPress:

    sudo a2ensite wordpress.conf
    sudo a2dissite 000-default.conf
    sudo a2enmod rewrite
    sudo apache2ctl configtest
    sudo systemctl reload apache2

apache2ctl configtest must report Syntax OK before you reload. AllowOverride All is required here because WordPress normally writes rewrite rules to .htaccess. If you manage rewrites centrally in Apache instead, you can tighten that setting, but you must then provide equivalent rules yourself.

How do you complete the WordPress web installer?

With DNS temporarily pointing to the server or with a local hosts-file test, open the domain in a browser. WordPress displays its setup screen when Apache can read the files and PHP can connect to the database.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  1. Choose the installation language.
  2. Enter the database name, database username, database password, and localhost as the database host.
  3. Keep the table prefix unique if several installations could ever share a database; using a distinct database per site is safer.
  4. Create a separate WordPress administrator account. Do not use the database username as the administrator name, and do not use a predictable login.
  5. Set the site title, administrator email, and a strong password. Save the generated credentials in a password manager.

If WordPress cannot create wp-config.php, copy the displayed configuration text into /srv/www/wordpress/wp-config.php, then set ownership and permissions deliberately. A configuration file containing database credentials should not be readable by unrelated Unix users.

How do you add the domain to Cloudflare and choose DNS records?

Add the domain to Cloudflare, then create records for the names that should reach WordPress. An apex record normally points to the origin address; a www record can point to the same address or be a CNAME to the apex, depending on your naming policy.

Rank #3
Sale
Anker USB C Hub, 7in1 Multi-Port USB Adapter, 4K@60Hz USBC to HDMI Splitter | 85W Max PD, 2 USB 3.0 & 1 USBC Data Ports, SD/TF Card Reader, for Laptops/Mac and Other Type C Devices (Charger Not Included)
  • Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
  • Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
  • Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
  • Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
  • What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
  • Proxy only web records that should pass through Cloudflare. The orange-cloud proxy is appropriate for HTTP and HTTPS traffic.
  • Keep SSH, database, monitoring, and other administrative records DNS-only or off the public DNS entirely. Never assume Cloudflare’s web proxy protects an SSH service.
  • Allow Cloudflare’s published edge address ranges to reach ports 80 and 443 at the origin, while restricting other inbound traffic with the Ubuntu firewall or your provider’s firewall.
  • Keep a direct emergency path for administration, such as a provider console or a restricted management address.

DNS changes can take time to appear at different resolvers. Before diagnosing WordPress, confirm that the hostname resolves to Cloudflare when proxied and that the origin itself answers on the expected ports.

How do you install HTTPS between Cloudflare and Apache?

Cloudflare Origin CA encrypts the Cloudflare-to-origin connection. Cloudflare’s documentation, updated August 14, 2026, describes Origin CA certificates for origins that receive traffic only from proxied records. An Origin CA certificate is not trusted by ordinary browsers, so direct visits that bypass Cloudflare can show a certificate warning.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  1. In the Cloudflare dashboard, open the domain’s SSL/TLS area, choose the origin-server certificate function, and create a certificate covering every hostname you will proxy, such as example.com and *.example.com where appropriate.

  2. Save the certificate and private key on the server with root ownership. For example:

    sudo install -d -m 700 /etc/apache2/ssl
    sudo nano /etc/apache2/ssl/example.com.pem
    sudo nano /etc/apache2/ssl/example.com.key
    sudo chown root:root /etc/apache2/ssl/example.com.*
    sudo chmod 600 /etc/apache2/ssl/example.com.key
    sudo chmod 644 /etc/apache2/ssl/example.com.pem
  3. Enable SSL and headers support:

    sudo a2enmod ssl headers
    sudo systemctl restart apache2
  4. Add a port-443 virtual host, using the same document root and directory policy:

    <VirtualHost *:443>
        ServerName example.com
        ServerAlias www.example.com
        DocumentRoot /srv/www/wordpress
    
        SSLEngine on
        SSLCertificateFile /etc/apache2/ssl/example.com.pem
        SSLCertificateKeyFile /etc/apache2/ssl/example.com.key
        DirectoryIndex index.php
    
        <Directory /srv/www/wordpress>
            Options FollowSymLinks
            AllowOverride All
            Require all granted
        </Directory>
    
        ErrorLog ${APACHE_LOG_DIR}/wordpress_ssl_error.log
        CustomLog ${APACHE_LOG_DIR}/wordpress_ssl_access.log combined
    </VirtualHost>
  5. Validate and reload:

    sudo apache2ctl configtest
    sudo systemctl reload apache2
  6. In Cloudflare, select Full (strict). Use this mode only after the origin certificate covers the requested hostname and Apache serves it on port 443.

    Free tools Windows power users keep installed

    One-click scans. No signup required.

    Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Do not choose Flexible mode as a shortcut. It leaves the Cloudflare-to-origin leg on HTTP and commonly creates a loop when WordPress believes the public URL is HTTPS. Full (strict) verifies that Cloudflare is speaking TLS to the intended, properly certified origin.

Why does WordPress redirect in a loop behind Cloudflare?

A loop usually means Cloudflare receives HTTPS from the visitor but Apache or WordPress evaluates the request as HTTP. A second cause is a host mismatch: the proxy forwards one hostname while WordPress generates links for another. Fix the protocol and host interpretation before changing random redirect rules.

Rank #4
Sale
UGREEN USB to USB C Adapter Combo 4-Pack, 10Gbps USB C Converter Space Gray | Data transfer & Fast charging for MacBook, iPhone 17/16/15, iPad, Samsung Galaxy, Apple Watch
  • Dual Converters, Infinite Potential:Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
  • Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
  • Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
  • Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
  • Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft

Check the Cloudflare mode and origin listener

  • Confirm the DNS record is proxied only when the origin serves the matching hostname.
  • Confirm Apache listens on 443 and presents the certificate for that hostname.
  • Set Cloudflare to Full (strict), not Flexible.

Set stable WordPress URLs

For a single canonical hostname, define the public URLs in wp-config.php before WordPress loads:

define('WP_HOME', 'https://example.com');
define('WP_SITEURL', 'https://example.com');

Use the exact hostname you want visitors and search engines to use. If you serve both apex and www, redirect one at Apache or Cloudflare and keep these two values on the chosen canonical name.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Pass the forwarded protocol safely

Cloudflare and other reverse proxies commonly send X-Forwarded-Proto. Add this to wp-config.php before the line that says WordPress should stop editing the file:

if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && strpos($_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') !== false) {
    $_SERVER['HTTPS'] = 'on';
}

Do not blindly copy an arbitrary forwarded host into HTTP_HOST. If you must support multiple hostnames, allow-list them at the proxy and Apache level. Otherwise keep WP_HOME and WP_SITEURL fixed, which prevents generated links from being controlled by an untrusted header.

What should you harden after the first successful login?

Make the installation operational before adding plugins. HTTPS, patching, backups, and restricted administration matter more than cosmetic tuning.

  • Install WordPress core, themes, and plugins only from sources you trust, and remove inactive software rather than leaving it exposed.
  • Schedule unattended Ubuntu security updates or a documented patch window. Test PHP and major plugin changes on a staging copy first.
  • Back up both the database and /srv/www/wordpress/wp-content. A database dump alone cannot restore uploaded media; a file copy alone cannot restore posts, settings, and users.
  • Store backups off the server, retain multiple generations, and perform a restore test. A backup that has never been restored is only an assumption.
  • Restrict SSH with keys, disable password login where your access policy permits, and use a firewall that exposes only required services.
  • Review Apache access and error logs after enabling a plugin or changing rewrite rules. Keep logs outside the web root.
  • Add an HSTS header only after HTTPS works consistently for every required hostname and you understand the consequences of forcing future HTTPS connections.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

What are the common installation failures and fixes?

“Your PHP version is too old”

Run php -v and compare it with WordPress.org’s current recommendation of PHP 8.3 or greater. The command-line version and Apache’s loaded PHP version can differ; create a temporary, protected diagnostic page or inspect Apache’s module configuration, then remove any diagnostic file immediately. Upgrade the Ubuntu release or PHP source under a maintenance plan rather than suppressing the requirement.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

“Error establishing a database connection”

Check that MariaDB is active, the database name and username match the SQL you created, and the password contains no accidental shell or configuration-file substitutions. Test locally with the same account, verify that the account is defined for localhost, and inspect the MariaDB service log. Do not solve this by granting the account global privileges.

Apache returns 403 Forbidden

Check the DocumentRoot, the <Directory> path, Require all granted, and every parent directory’s execute permission. Confirm that Apache can read the files and that an overly restrictive ownership change did not remove access. The Apache error log usually identifies the exact path that was denied.

Best Value
Sale
Anker USB C Hub, 5-in-1 USBC to HDMI Splitter with 4K Display | 85W Max PD, 1 Powered USB-C 5Gbps & 2 Powered USB-A 3.0 5Gbps Data Ports, for MacBook Pro, MacBook Air, Dell and More (Black)
  • 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
  • Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
  • Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
  • HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
  • What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.

Permalinks return 404 after the home page works

Enable mod_rewrite, confirm AllowOverride All, and reload Apache after running apache2ctl configtest. In the WordPress dashboard, visit Settings > Permalinks and save the existing structure once to regenerate rewrite rules.

Cloudflare reports a 525 or 526 error

A 525 means the TLS handshake to the origin failed; a 526 means the certificate could not be validated in strict mode. Check that port 443 is open, Apache is serving the certificate file you installed, the private key matches it, and the certificate includes the requested hostname. Make sure the DNS record is reaching the intended server, not an old address.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Images or styles load over HTTP

Mixed content normally means the site or a plugin stored absolute HTTP URLs before HTTPS was enabled. Keep the canonical WordPress URLs on HTTPS, clear plugin and page caches, and update stored URLs with a tool that understands serialized WordPress data. Do not perform an unqualified text replacement on the database.

How does this setup scale to multiple sites?

A single site can share Apache’s PHP module without much complexity. Multiple sites increase the impact of one vulnerable plugin, a writable directory, or a runaway PHP process, so isolate them deliberately.

Area Single site Multiple sites
Apache One virtual host and one log pair are usually sufficient. Give every hostname its own virtual host, document root, access log, and error log.
PHP Shared limits are often acceptable after measuring usage. PHP-FPM pools provide per-site users, limits, and process isolation.
Database One database and one dedicated account. Separate databases and accounts simplify export, restore, and incident response.
Permissions www-data ownership is straightforward. Per-site Unix ownership prevents one site’s files from being modified by another site’s process.
Backups Restore the site’s database and wp-content. Test per-site restores and document which DNS, certificates, and PHP settings belong to each site.

Cloudflare can proxy all of the web hostnames, but each origin certificate must cover the names actually used. Keep the certificate inventory and renewal or replacement procedure with the server documentation.

How do you verify the finished deployment?

Run a short acceptance checklist from outside the server’s network:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • The apex and chosen alternate hostname resolve to the intended Cloudflare records.
  • HTTP reaches the intended HTTPS canonical URL without repeated redirects.
  • HTTPS shows the expected WordPress site and no certificate error through Cloudflare.
  • Logging in, uploading an image, creating a page, and saving permalinks all work.
  • The database service survives a restart and the site returns after Apache restarts.
  • A test backup exists, is stored off-host, and has been inspected or restored in a safe location.
  • Direct origin access is restricted according to your firewall policy, while SSH remains available through the separate administrative path.

This arrangement follows the three trust boundaries that matter: WordPress authenticates to a least-privilege database account, Apache serves only the configured document root, and Cloudflare encrypts and proxies the public web connection to a certificate-validated origin.

Frequently Asked Questions

Can I install WordPress on Ubuntu without Cloudflare?

Yes. Cloudflare is optional; Apache can serve the site directly if the server has a publicly trusted certificate and appropriate firewall rules. If you later enable proxying, recheck the forwarded protocol, canonical hostname, and TLS mode rather than assuming the existing redirects will remain correct.

Is MariaDB better than MySQL for WordPress on Ubuntu?

Both are supported when they meet WordPress.org’s current minimum versions. The practical choice is usually the version supplied and maintained by your Ubuntu release, plus the backup, monitoring, and upgrade process you can operate consistently.

Why does an Origin CA certificate show as untrusted in my browser?

Origin CA certificates are intended for Cloudflare-to-origin encryption and are trusted by Cloudflare, not by normal browsers. A direct visit that bypasses the proxy can therefore warn even though proxied visitors receive a valid Cloudflare certificate.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Should WordPress files be owned by www-data?

That is a workable simple-server arrangement, but it gives the web process broad write access. On a host with several sites or a controlled deployment pipeline, per-site Unix users, limited writable directories, and PHP-FPM pools provide stronger isolation.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

ApacheCloudflareHTTPSLinux administrationMariaDBUbuntuWordPress

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Recommended PC Tool
Recommended PC Tool
Crashes, No Sound, or Screen Glitches?Free driver scan
Windows Errors? Fix Them Before They SpreadFree repair scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.