iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To run Joomla on Ubuntu behind Nginx and Cloudflare, install Nginx, PHP-FPM and a supported database, create a dedicated database user, place Joomla in a protected document root, configure Nginx to send PHP requests to PHP-FPM, and complete Joomla’s browser installer. Then install a hostname-matching certificate on the origin and select Cloudflare Full (strict). Finish by testing direct HTTPS, redirects, administrator access and uploads before enabling HSTS.
This guide follows Joomla 6’s current requirements and Cloudflare’s production recommendations. It also explains the settings that commonly cause blank pages, redirect loops, mixed content or unsafe database permissions.
What does Joomla need on an Ubuntu Nginx server?
Joomla is a PHP application, so the server needs four functional layers: a web server, PHP with PHP-FPM, a supported SQL database, and the Joomla files. Nginx serves images, CSS, JavaScript and other static files; requests for PHP scripts are forwarded to PHP-FPM through FastCGI. The browser installer then connects Joomla to the database using credentials you create in advance.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Joomla 6 technical baseline
| Component | Supported baseline | Recommended version |
|---|---|---|
| PHP | 8.3.0 | 8.4 |
| Nginx | 1.26 | 1.29 |
| MariaDB | 10.6 | 12.0 |
| MySQL | 8.0.13 minimum | Use a currently maintained release |
Joomla requires the PHP extensions json, simplexml, dom, zlib, gd and either mysqlnd, pdo_mysql or pdo_pgsql. The mbstring extension is recommended. Joomla recommends at least 256 MB of PHP memory.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
PHP limits required by the installer
memory_limit = 256Mupload_max_filesize = 64Mpost_max_size = 64Mmax_execution_time = 30
Use a maintained Ubuntu release, a DNS name that you control, SSH access with sudo privileges, and enough disk space for Joomla, extensions, logs and backups. Decide whether you will manage updates, backups and monitoring yourself; a managed Joomla service removes much of that operational work but gives you less server-level control.
Should you self-manage Ubuntu or use managed Joomla hosting?
Self-managed Ubuntu is best when you need root-level Nginx, PHP or database control and can maintain the system. Managed hosting is usually easier for a small team that values support and automated operations over low-level customization.
| Area | Self-managed Ubuntu | Managed Joomla hosting |
|---|---|---|
| Access and control | Full SSH, Nginx, PHP-FPM and database configuration. | Control is limited to the host’s panel and allowed settings. |
| Patching | You schedule Ubuntu, PHP, Nginx, database and Joomla updates. | The provider may handle platform patches; Joomla and extensions still need checking unless explicitly included. |
| Backups and restore | You must back up both the document root and database and test restores. | Backups may be automated, but retention, off-site copies and restore access vary. |
| Monitoring | You configure uptime, disk, memory, PHP-FPM and database alerts. | Basic monitoring and support are commonly included, with less visibility into the host. |
| Support | You diagnose Nginx, PHP, SQL and Cloudflare failures. | The provider can handle infrastructure incidents, subject to its support scope. |
| Total cost | Lower software cost but recurring administration time and backup or monitoring costs. | Higher recurring fee in exchange for operational convenience. |
How do I prepare Ubuntu and install the software stack?
Log in over SSH, update the package index, and install Nginx, PHP-FPM, the Joomla PHP modules and MariaDB. Package names differ slightly between Ubuntu releases, so confirm the installed PHP major version before writing the Nginx socket path.
Recommended Free Tools
- Update the host.
sudo apt update sudo apt full-upgrade -y - Install Nginx, MariaDB and PHP.
sudo apt install -y nginx mariadb-server php-fpm php-cli php-mysql php-xml php-gd php-mbstring php-curl php-zip php-intl unzip curlThe
php-xmlpackage supplies the XML-related modules Joomla uses, whilephp-mysqlprovides the normal MySQL/MariaDB connector. Verify that your release supplies all required modules before proceeding. - Enable and start services.
sudo systemctl enable --now nginx sudo systemctl enable --now mariadb sudo systemctl enable --now php8.3-fpmReplace
php8.3-fpmwith the PHP-FPM service installed on your host, such asphp8.4-fpm. - Check versions and modules.
php -v php -m nginx -v sudo systemctl status php8.3-fpm --no-pagerLook for the required modules and a running FPM service. If a module is missing, install the matching package for the same PHP major and minor version, then restart PHP-FPM.
Set Joomla’s PHP limits
Find the active FPM configuration with php --ini and the FPM pool’s PHP version. Edit the FPM php.ini (often under /etc/php/<version>/fpm/php.ini) and set the four Joomla limits:
Free tools Windows power users keep installed
One-click scans. No signup required.
memory_limit = 256M
upload_max_filesize = 64M
post_max_size = 64M
max_execution_time = 30Restart the matching service and verify the values from the FPM context, not only the command-line PHP context:
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
sudo systemctl restart php8.3-fpmIf uploads fail later while command-line values look correct, inspect the FPM configuration and Nginx’s client_max_body_size; both layers must permit the intended upload size.
How do I create a least-privilege Joomla database?
Create a separate database and user rather than using the database administrator account. Record the database host, name, username and password because Joomla’s installer asks for them.
- Harden the initial MariaDB installation.
sudo mariadb-secure-installationFollow the prompts to remove anonymous users, disallow remote administrative login and remove the test database where appropriate.
Recommended: Update Every Outdated Driver on Your PC in One Scan - Free →Recommended: PC Feels Slow? A Free Scan Shows What's Dragging Windows Down →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. - Open the database shell.
sudo mariadb - Create the database and account.
CREATE DATABASE joomla CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci; CREATE USER 'joomla_user'@'localhost' IDENTIFIED BY 'use-a-long-unique-password'; GRANT ALL PRIVILEGES ON joomla.* TO 'joomla_user'@'localhost'; FLUSH PRIVILEGES; EXIT;
For a local database, use localhost as the database host in the installer. Do not expose MariaDB to the internet merely to make Joomla work; keep the database on the private host unless your architecture specifically requires a separate database server and firewall rules.
How do I download and place Joomla in the Nginx document root?
Use Joomla’s official current package, extract it into a directory dedicated to the domain, and keep the archive outside the web root. The exact download URL and release filename change, so obtain the current package from Joomla’s official download page rather than hard-coding an old version.
- Create the site directory.
sudo mkdir -p /var/www/example.com cd /tmp - Download and extract the Joomla archive.
curl -fL -o joomla.zip 'OFFICIAL-JOOMLA-DOWNLOAD-URL' sudo unzip joomla.zip -d /var/www/example.comThe command above shows the operation; replace the quoted value with the current official package URL. If the archive contains a top-level directory, move its contents into
/var/www/example.comsoindex.phpis directly in the document root. - Set ownership and restrictive defaults.
sudo chown -R www-data:www-data /var/www/example.com sudo find /var/www/example.com -type d -exec chmod 755 {} ; sudo find /var/www/example.com -type f -exec chmod 644 {} ;Nginx must read the files and Joomla must write only the directories that its documentation identifies as writable. Avoid making the entire tree world-writable. After installation, review writable directories and remove any temporary archive from the document root.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
How do I configure Nginx and PHP-FPM for Joomla?
Create a server block that points to the Joomla root, serves static files directly, and forwards PHP scripts to the active PHP-FPM Unix socket. The socket filename must match the PHP-FPM version installed on your Ubuntu host.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
- Create the configuration file.
sudo nano /etc/nginx/sites-available/example.com - Add an HTTP server block for initial validation.
server { listen 80; listen [::]:80; server_name example.com www.example.com; root /var/www/example.com; index index.php index.html; client_max_body_size 64M; location / { try_files $uri $uri/ /index.php?$args; } location ~ .php$ { include snippets/fastcgi-php.conf; fastcgi_pass unix:/run/php/php8.3-fpm.sock; } location ~ /.ht { deny all; } }Replace the domain names, document root and socket path. The
try_filesfallback lets Joomla route friendly URLs throughindex.php. The hidden-file rule prevents accidental exposure of files such as.htaccess. - Enable and test the site.
sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/example.com sudo nginx -t sudo systemctl reload nginxDo not reload a configuration that fails
nginx -t. Typical errors are a wrong PHP socket, a duplicateserver_name, a missing semicolon or a document-root typo.
Keep the eventual HTTPS server block’s root, index, rewrite and PHP-FPM settings consistent with the HTTP block. When you later add certificates, redirect HTTP deliberately and avoid creating two competing redirect rules.
How do I run the Joomla browser installer?
Point DNS at the Ubuntu server, visit the domain, and complete the installer in a browser. The installer asks for the site name, a super-user account and database connection details.
- Create an A or AAAA record for the domain pointing to the server’s address. Allow DNS time to propagate.
- Open
http://example.comand select the installation language when prompted. - Enter the site name, administrator name, username, a unique password and an email address. Use an administrator username that is not obvious.
- Enter database type, host, database name, username, password and table-prefix values. For the local MariaDB account above, the host is
localhost, the database isjoomla, and the user isjoomla_user. - Review the pre-installation checks. Correct any missing PHP module or limit before continuing.
- Finish installation and sign in through Joomla’s administrator URL.
On a production installation Joomla removes the installation folder after successful completion. If the installer reports that it cannot remove it, remove it only after confirming the installation completed and that you are deleting the correct directory. Never leave an accessible installer directory on a live site.
Which Cloudflare SSL mode should I use with Nginx?
Use Full (strict) for production when the origin serves a valid, unexpired certificate whose hostname matches the domain. It encrypts both the visitor-to-Cloudflare and Cloudflare-to-origin connections and validates the origin certificate.
| Cloudflare mode | Visitor to Cloudflare | Cloudflare to origin | Certificate validation | Main risk |
|---|---|---|---|---|
| Flexible | HTTPS | HTTP | No origin HTTPS validation | An origin HTTPS redirect creates a redirect loop; traffic on the origin leg is unencrypted. |
| Full | HTTPS | HTTPS | Encryption is used, but the origin certificate is not strictly validated. | It can conceal an expired, mismatched or otherwise invalid origin certificate. |
| Full (strict) | HTTPS | HTTPS | Requires a valid, unexpired, hostname-matching certificate issued by a publicly trusted CA or Cloudflare Origin CA. | Requests fail until the origin certificate and Nginx configuration are correct. |
Cloudflare’s guidance is: “For the best security, choose Full (strict) mode whenever possible (unless you are an Enterprise customer).” Flexible is not a shortcut for a correctly configured origin; Cloudflare specifically warns, “If your origin forces HTTPS by automatically redirecting HTTP requests to HTTPS, do not use Flexible mode.”
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteHow do I install an origin certificate and enable Cloudflare HTTPS safely?
First make Nginx serve HTTPS directly. Only then change Cloudflare settings and add browser-facing redirects.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
- Issue an origin certificate. Use a publicly trusted certificate or a Cloudflare Origin CA certificate covering every hostname you will publish, such as the apex domain and
wwwif both are used. Keep the private key readable only by the required system components. - Configure an HTTPS server block. Add
listen 443 ssl;, the matchingserver_name, the certificate and key paths, the same Joomla root and the same PHP-FPM location used by HTTP. Test withsudo nginx -tand reload Nginx. - Test the origin directly. Before changing Cloudflare, verify the certificate, hostname, Joomla home page, administrator URL, CSS, JavaScript and a media upload. Correct certificate-chain, permission and PHP errors first.
- Select Full (strict). In the Cloudflare dashboard, open the zone’s SSL/TLS settings and choose Full (strict).
- Enable Always Use HTTPS. Turn it on only after direct origin HTTPS works. This redirects HTTP requests at Cloudflare to HTTPS.
- Enable Automatic HTTPS Rewrites. This helps rewrite eligible HTTP asset references, but it cannot repair every hard-coded URL or insecure third-party resource. Fix Joomla configuration and extension URLs as well.
- Stage HSTS last. Enable HSTS only after every page, administrator path, API endpoint, media URL and included subdomain works over HTTPS. Include subdomains only when every included subdomain supports HTTPS. Treat preload as an irreversible operational commitment for the preload period.
What should I test before declaring the Joomla site finished?
Test from an ordinary browser and from a command line so that redirects, certificate errors and PHP failures are visible.
- HTTP requests redirect once to the canonical HTTPS hostname, without a loop.
- The home page, Joomla administrator URL, login, logout and password-reset flow work.
- CSS, JavaScript, images and downloadable media load without mixed-content warnings.
- A normal media upload succeeds and respects the intended 64 MB PHP and Nginx limits.
- Joomla can connect to MariaDB, create content and save configuration changes.
- Nginx access and error logs show no repeated 404, 403, 502 or permission errors.
- PHP-FPM remains healthy under normal requests; a 502 usually means a stopped service or wrong socket path.
- Cloudflare cache behavior matches your policy. Do not cache administrator or personalized responses as public content.
- Backups include both the database and the complete Joomla files, and a restore procedure has been tested.
How do I fix the most common installation failures?
Cloudflare shows a redirect loop
Check the Cloudflare mode first. Flexible mode combined with an origin that redirects HTTP to HTTPS loops because Cloudflare connects to the origin over HTTP. Install and verify origin HTTPS, then use Full or preferably Full (strict).
Nginx returns 502 Bad Gateway
Confirm the FPM service is running and that fastcgi_pass points to the socket that actually exists under /run/php. Check the Nginx error log and restart the matching FPM service after configuration changes.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Joomla reports missing extensions
Install the missing extension package for the active PHP version, restart PHP-FPM and reload the installer page. Checking php -m alone can be misleading if the command-line PHP version differs from FPM.
Uploads fail even though Joomla shows 64 MB
Confirm upload_max_filesize and post_max_size in FPM, then check Nginx’s client_max_body_size. Restart FPM and reload Nginx after editing each layer.
Pages work at the home page but friendly URLs return 404
Verify that the Joomla server block contains try_files $uri $uri/ /index.php?$args; and that the active block is the one enabled in sites-enabled. Test the configuration and reload Nginx.
Cloudflare reports an origin certificate error
Ensure the certificate is unexpired, includes the requested hostname and is installed with its private key and required chain. Full (strict) intentionally refuses an invalid or mismatched certificate; replacing it is safer than downgrading to Flexible.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsHow should I maintain Joomla, Nginx and Cloudflare after setup?
Schedule updates rather than applying them blindly on a live site. Keep Ubuntu, Nginx, PHP, MariaDB, Joomla core, templates and extensions within their supported versions. Take a database and file backup before major upgrades, verify that the backup can be restored, and review PHP-FPM and Nginx logs after each change.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Keep Cloudflare DNS records accurate, remove unused hostnames, renew the origin certificate before expiry, and review firewall and administrator access. Re-test HTTPS, uploads, redirects and the administrator interface after certificate renewal or PHP upgrades. Do not enable HSTS for a hostname until you are confident that every required subdomain and service will remain HTTPS-capable.
What is the safest production architecture?
A practical production arrangement is Joomla on a patched Ubuntu host, Nginx serving the site, PHP-FPM isolated behind its Unix socket, MariaDB bound locally or to a private network, and Cloudflare proxying the public hostname. Use Full (strict), keep the database account dedicated to Joomla, limit writable directories, back up files and SQL separately, and monitor the origin as well as the public URL.
This design preserves end-to-end encryption, avoids Flexible-mode redirect loops and gives you a clear troubleshooting path: browser and Cloudflare first, then Nginx, PHP-FPM and finally the database.
Frequently Asked Questions
Can I use MySQL instead of MariaDB for Joomla on Ubuntu?
Yes. Joomla 6 lists MySQL 8.0.13 as the minimum supported MySQL version. Use the matching PHP MySQL driver, create a dedicated database account, and verify that your chosen MySQL release remains maintained by its vendor.
Do I need Cloudflare proxying during the Joomla installation?
No. You can temporarily set the DNS record to DNS-only while validating the origin and running the installer. Proxy it after direct HTTPS works, then select Full (strict) and test the proxied hostname.
Where is the Joomla administrator login after installation?
The administrator interface is normally reached by appending /administrator to the canonical site URL. Protect that path with strong credentials and additional access controls appropriate for your team; do not publish or share the administrator password.
Should I enable HSTS preload immediately after turning on HTTPS?
No. HSTS can make browsers refuse HTTP for the policy period, and preload extends that behavior beyond your own response headers. First verify every required hostname, redirect, asset, upload and administrator function over HTTPS, then stage HSTS conservatively.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
