Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

To host WordPress on a VPS, rent an Ubuntu LTS server, connect over SSH, install Nginx, MariaDB or MySQL, and PHP-FPM, then create a database, copy WordPress into the web root, configure wp-config.php, add an Nginx server block, and enable HTTPS. You are responsible for updates, backups, firewall rules and recovery, but you gain control over the software versions and server configuration.

This guide uses a practical 2026 setup that works across current Ubuntu LTS releases. Package names and PHP-FPM socket versions differ between releases, so the commands show where to verify those details rather than assuming one Ubuntu version.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What hosting WordPress on a VPS involves

A virtual private server is a rented virtual machine with its own operating system, CPU allocation, memory, storage and public IP address. Unlike shared hosting, you administer the operating system and the web stack. Unlike a managed WordPress service, you also decide how Nginx, PHP, the database, firewall and backups are configured.

A typical installation has four layers:

  • Ubuntu LTS: the operating system you patch and secure.
  • Nginx: the web server that accepts HTTP and HTTPS requests, serves static files and forwards PHP requests.
  • PHP-FPM: the process manager that executes WordPress PHP code.
  • MariaDB or MySQL: the database that stores posts, users, settings and plugin data.

WordPress files live under a directory such as /var/www/example.com. DNS points your domain’s A record to the VPS address, Nginx maps that domain to the directory, and a browser-based wizard finishes the WordPress configuration.

Requirements and version choices

Before creating the server, check the current WordPress requirements page. The published baseline is PHP 8.3 or newer, MariaDB 10.11 or newer, or MySQL 8.0 or newer, plus Nginx or Apache and HTTPS. The WordPress Hosting Team’s guidance for the WordPress 7.0/7.1 cycle favors PHP 8.4 or 8.5, MySQL 8.4, and MariaDB 10.11, 11.4 or 11.8 when those versions are supported by your Ubuntu release. Treat these as targets, not a reason to force an unsupported package.

Older minimums such as PHP 7.4 and MySQL or MariaDB 5.5.5 are compatibility floors for old WordPress releases. They are end-of-life choices and should not be used for a new server. Keep WordPress, PHP and the database within their supported windows and plan upgrades before any component reaches end of life.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Decision Recommended approach Why it matters
Operating system Current Ubuntu LTS supplied by your VPS host Security updates and predictable packages last longer than a non-LTS release.
Web server Nginx with PHP-FPM Efficient static-file delivery and a common WordPress configuration.
Database MariaDB 10.11+ or MySQL 8.0+ Meets current WordPress requirements when supported by the chosen Ubuntu release.
PHP PHP 8.4 or 8.5 when the release repository supports it Matches current Hosting Team guidance for new installs; verify plugin compatibility.
Memory Choose a plan with enough RAM for WordPress, the database and traffic peaks There is no single WordPress VPS size that fits every plugin set or visitor load.

Prepare the VPS and domain

Create a non-root administrator

Use the provider’s console to obtain the initial IP address and root credentials, then connect from your computer:

ssh root@SERVER_IP

Create a named administrator and grant sudo access. Replace the account name with your own; do not continue operating WordPress as root.

adduser siteadmin
usermod -aG sudo siteadmin

Install your SSH public key for that account before disabling password login. From your local computer, the usual command is:

ssh-copy-id siteadmin@SERVER_IP

After opening a second terminal and confirming key login works, edit /etc/ssh/sshd_config to set PasswordAuthentication no. Keep the existing session open while testing a new one, then reload SSH:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
sudo systemctl reload ssh

Point DNS to the server

At your domain registrar, create an A record for the root domain (for example, example.com) pointing to the VPS IPv4 address. Add a www record if you intend to serve www.example.com. DNS propagation can take time, so verify resolution with:

dig +short example.com
dig +short www.example.com

Do not request a TLS certificate until both names resolve to this server.

Patch Ubuntu and configure the firewall

sudo apt update
sudo apt full-upgrade -y
sudo apt install ufw -y
sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'
sudo ufw enable
sudo ufw status verbose

Allow SSH before enabling UFW or you can lock yourself out. The Nginx Full profile permits ports 80 and 443; remove any rule you do not need.

Install Nginx, MariaDB and PHP-FPM

Install the packages

Ubuntu’s package names vary slightly by release, especially for PHP. Install the generic metapackage names first:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
sudo apt install nginx mariadb-server php-fpm php-mysql php-curl php-gd php-mbstring php-xml php-zip php-intl -y

Check which PHP version and FPM socket were installed instead of copying a version from a different tutorial:

php -v
apt-cache policy php-fpm
ls -l /run/php/

On Ubuntu 22.04, guides commonly use php8.1-fpm. Ubuntu 24.04 guides may refer to PHP 8.3 or 8.4, and an Ubuntu 26.04 setup may provide PHP 8.5 with MariaDB. The repository enabled on your server is authoritative. The Nginx configuration later must use the socket shown by ls -l /run/php/.

Enable and test services

sudo systemctl enable --now nginx mariadb
sudo systemctl status nginx mariadb
systemctl list-units 'php*-fpm.service'

If a service is failed, inspect its journal before proceeding:

sudo journalctl -u nginx -n 50 --no-pager
sudo journalctl -u mariadb -n 50 --no-pager

Secure MariaDB and create the WordPress database

Run the interactive hardening script:

sudo mariadb-secure-installation

Use it to remove anonymous accounts, disallow remote root login, remove the test database and reload privilege tables. The exact prompts differ between MariaDB releases; read each prompt rather than blindly accepting a tutorial written for an older version.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Log in locally and create a database and a dedicated user. Use a long, unique password and store it in a password manager:

sudo mariadb
CREATE DATABASE wordpress CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'wpuser'@'localhost' IDENTIFIED BY 'USE-A-LONG-RANDOM-PASSWORD';
GRANT ALL PRIVILEGES ON wordpress.* TO 'wpuser'@'localhost';
FLUSH PRIVILEGES;
EXIT;

utf8mb4 supports emoji and a broad range of multilingual characters. Do not grant the WordPress user global privileges or use the database root account in wp-config.php.

Download WordPress and set file ownership

Download the current WordPress release from WordPress.org, unpack it outside the web root, and move it into a directory named for your domain:

cd /tmp
curl -O https://wordpress.org/latest.tar.gz
tar -xzf latest.tar.gz
sudo mkdir -p /var/www/example.com
sudo cp -a wordpress/. /var/www/example.com/
sudo chown -R www-data:www-data /var/www/example.com
sudo find /var/www/example.com -type d -exec chmod 755 {} ;
sudo find /var/www/example.com -type f -exec chmod 644 {} ;

Replace example.com with your real domain. The web server needs to read the files and write to wp-content for updates and uploads. Giving every file mode 777 is unsafe and unnecessary.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Configure wp-config.php and authentication salts

Copy the sample configuration and edit it:

cd /var/www/example.com
sudo cp wp-config-sample.php wp-config.php
sudo nano wp-config.php

Set these values to the database and user you created:

define( 'DB_NAME', 'wordpress' );
define( 'DB_USER', 'wpuser' );
define( 'DB_PASSWORD', 'USE-A-LONG-RANDOM-PASSWORD' );
define( 'DB_HOST', 'localhost' );

Replace the sample authentication keys and salts with fresh values from the official WordPress secret-key service. One convenient method is:

curl -s https://api.wordpress.org/secret-key/1.1/salt/

Copy the returned eight define lines into wp-config.php, replacing the corresponding sample lines. Salts invalidate existing login cookies when changed, which is useful after a suspected credential theft.

Restrict the configuration file after editing:

sudo chown www-data:www-data /var/www/example.com/wp-config.php
sudo chmod 640 /var/www/example.com/wp-config.php

If you plan to manage files through SSH rather than the WordPress dashboard, keep ownership and write permissions deliberately limited and test plugin updates before changing them.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Create the Nginx server block

Write the virtual-host configuration

Create a file for the domain:

sudo nano /etc/nginx/sites-available/example.com

Use this configuration, replacing the domain names and the PHP-FPM socket with the exact socket listed under /run/php/:

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    root /var/www/example.com;
    index index.php index.html;

    client_max_body_size 64M;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ .php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
    }

    location ~* /.ht {
        deny all;
    }
}

The socket in the example is illustrative. If your server shows php8.4-fpm.sock, use that exact filename; if it shows php8.5-fpm.sock, use that instead. A wrong socket produces a 502 Bad Gateway response.

Enable and validate the site

sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/example.com
sudo rm -f /etc/nginx/sites-enabled/default
sudo nginx -t
sudo systemctl reload nginx

Never reload after editing a server block without running nginx -t. A successful test reports that the syntax is okay and the test is successful. Visit the domain over HTTP; you should see the WordPress setup page or a temporary Nginx response rather than a connection error.

Enable HTTPS with Let’s Encrypt

Install Certbot and its Nginx integration:

sudo apt install certbot python3-certbot-nginx -y

Request certificates for every hostname you configured:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
sudo certbot --nginx -d example.com -d www.example.com

Choose the option that redirects HTTP to HTTPS unless you have a specific reason to serve both schemes. Certbot normally installs renewal configuration. Verify that renewal works without waiting for the certificate to expire:

sudo certbot renew --dry-run

After HTTPS is active, WordPress’s site URL should use https://. If the browser reports mixed content, update hard-coded HTTP image or script URLs and clear any caching plugin after confirming the certificate works.

Complete the WordPress browser setup

  1. Open https://example.com and select the language.
  2. Enter a site title, an administrator username that is not simply “admin,” a unique administrator password and an email address you monitor.
  3. Keep search-engine visibility enabled for a public site. Disable it only while building a private staging site, and remember to re-enable it before launch.
  4. Sign in at https://example.com/wp-admin/.
  5. Open Settings > Permalinks, select the URL format you want, and save once. This writes the rewrite rules WordPress needs.
  6. Open Settings > General and confirm both WordPress Address and Site Address use the final HTTPS domain.
  7. Upload a test image, publish a draft, log out and back in, and check the site from a separate device or private browser window.

Install only plugins and themes that are maintained for your PHP and WordPress versions. Delete inactive extensions you do not need; leaving abandoned code on a public server increases your attack surface.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Production security and maintenance

Use key-based administration

Keep SSH restricted to key authentication, use a non-root sudo account, and review /var/log/auth.log for unexpected login attempts. If your VPS provider offers a network firewall, use it alongside UFW to restrict management ports to your own addresses where practical.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Apply updates in a controlled order

Schedule regular checks for Ubuntu security updates, PHP, MariaDB or MySQL, Nginx, WordPress core, themes and plugins. Take a backup before major upgrades. Keep PHP and the database compatible with the WordPress release; upgrading one layer while leaving another far behind creates avoidable failures.

Back up both database and files

A complete WordPress backup includes the database, uploads, themes, plugins and configuration. A simple local backup pattern is:

sudo mkdir -p /var/backups/wordpress
sudo mysqldump --single-transaction wordpress | gzip | sudo tee /var/backups/wordpress/wordpress.sql.gz > /dev/null
sudo tar -czf /var/backups/wordpress/files-$(date +%F).tar.gz /var/www/example.com

Copy backups off the VPS to separate storage and retain multiple dated copies. Test a restore on a staging server; a backup that has never been restored is only an assumption.

Monitor capacity and logs

Watch disk usage with df -h, memory with free -h, and service logs with journalctl. WordPress media, database growth, PHP workers and log files can consume a small VPS quickly. Set alerts before the disk reaches 100 percent, because a full filesystem can prevent MariaDB and Nginx from writing essential files.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Common failures and precise fixes

Symptom Likely cause Checks and remedy
502 Bad Gateway Nginx points to a nonexistent or stopped PHP-FPM socket. Run ls /run/php/, update fastcgi_pass, then run sudo systemctl restart php8.x-fpm using the installed service name and reload Nginx.
“Error establishing a database connection” Wrong database name, user, password, host or stopped database service. Run sudo systemctl status mariadb and test credentials with mariadb -u wpuser -p wordpress.
403 Forbidden Incorrect ownership, permissions, document root or a denied location rule. Confirm the server block root, check namei -l /var/www/example.com, and inspect /var/log/nginx/error.log.
Permalinks return 404 Missing try_files rule or permalinks were not saved. Confirm try_files $uri $uri/ /index.php?$args;, run nginx -t, reload Nginx and save permalinks again.
Uploads fail or exceed the limit PHP or Nginx request-size and execution limits are too low. Raise Nginx client_max_body_size and matching PHP settings such as upload_max_filesize and post_max_size, then restart PHP-FPM.
Certificate issuance fails DNS does not resolve to the VPS, port 80 is blocked, or the requested hostname is absent from Nginx. Check both dig results, UFW rules, the server block’s server_name, and retry after DNS updates propagate.
White screen or fatal PHP error Plugin/theme incompatibility, exhausted PHP memory or an incomplete update. Inspect PHP and Nginx logs, disable the last extension by renaming its directory under wp-content/plugins, and restore a known-good backup if necessary.

VPS versus managed WordPress hosting

A VPS is appropriate when you need control over PHP or database versions, custom Nginx rules, background workers, private networking or predictable server-level access. The trade-off is operational work: you patch the operating system, harden SSH, configure HTTPS, monitor capacity, maintain backups and diagnose outages.

Managed WordPress hosting shifts much of that administration to the host and usually offers a dashboard and support process, but it may restrict server-level configuration, extensions or version timing. Compare the total cost of administration and downtime risk, not only the advertised monthly server price. A VPS is not automatically cheaper once your time, backup storage and recovery work are included.

Launch checklist

  • Ubuntu LTS is patched and a non-root sudo account works.
  • SSH key login succeeds and password login is disabled after testing.
  • DNS A records resolve to the VPS address.
  • UFW allows SSH and Nginx, with no unnecessary ports open.
  • Nginx, MariaDB and PHP-FPM are enabled and running.
  • MariaDB has a dedicated utf8mb4 database and least-privilege WordPress user.
  • wp-config.php contains correct credentials and fresh salts.
  • Nginx passes PHP to the socket installed on this Ubuntu release.
  • nginx -t succeeds before every reload.
  • HTTPS redirects correctly and certbot renew --dry-run succeeds.
  • Permalinks, login, uploads and publishing have been tested.
  • Off-server backups exist and a restore procedure has been tested.
  • WordPress, plugins, themes, PHP and the database have an update schedule.

Bottom line

Hosting WordPress on a VPS is a repeatable LEMP deployment, not a one-click installation. Start with a supported Ubuntu LTS release, choose PHP and database versions that match current WordPress requirements, create a least-privilege database account, verify the PHP-FPM socket rather than guessing it, and put HTTPS, backups and patching in place before inviting visitors. That workflow gives you the control of a VPS without relying on obsolete tutorials or insecure default settings.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.