How to Install WordPress With a LEMP Stack on Ubuntu 24.04

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.

You can install WordPress on Ubuntu 24.04 with a LEMP stack by combining Nginx, PHP-FPM, MariaDB, HTTPS, and a domain that resolves to your server. This procedure produces a single-VM site with a completed WordPress browser installer, secure file permissions, PHP upload handling, and checks for every service in the request path.

Ubuntu 24.04 provides PHP 8.3, which is a workable compatibility baseline. For a new production deployment, use a newer supported PHP branch when your repository and WordPress extensions support it; the WordPress Hosting Handbook recommends PHP 8.4 or later for production and records PHP 8.3 as security-only after 31 December 2025. The commands below show PHP 8.3 paths and explain where to substitute another installed version.

#	Preview	Product	Price
1		Compressed Air Duster,130000RPM Super Power Cordless Air Duster,Rechargeable Brushless Blower,3 Gear...	$21.59	Buy on Amazon
2		EVEO® Screen Cleaner Spray Kit (Streak-Free) TV Screen Cleaner for Smart TV, Lcd, LEd, Oled |...	$15.97	Buy on Amazon
3		BladeHawks RGB Gaming Mouse Pad Extra Large Extended 31.5x12 Inch-Black | LED mouse pad with 14...	$13.99	Buy on Amazon
4		Vaydeer Wrist Rest for Keyboard and Mouse, Computer Ergonomic Wrist Support Pad, Soft Memory Foam...	$15.99	Buy on Amazon
5		Under Desk Cable Management Tray No Drill, Metal Mesh Cable Management Under Desk with Clamp Mount,...	$13.89	Buy on Amazon

What this Ubuntu 24.04 WordPress LEMP installation includes

The design uses one virtual machine. Nginx accepts web traffic, PHP-FPM runs WordPress code, MariaDB stores content, Certbot obtains TLS certificates, and the WordPress files live under Nginx’s document root.

WordPress.org states that “To run WordPress, it’s recommended your host supports: PHP version 8.3 or greater,” “MariaDB version 10.11 or greater OR MySQL version 8.0 or greater,” and that “Apache or Nginx is recommended as the most robust and featureful server for running WordPress.”

#1 Best Overall

Sale

Compressed Air Duster,130000RPM Super Power Cordless Air Duster,Rechargeable Brushless Blower,3 Gear Adjustable Blower with LED Light,Dust Remover for Computer/House/Outdoor/Car

• Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
• With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
• Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
• Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
• Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.

$21.59

Buy on Amazon

Prerequisites and decisions before connecting

Server, account, and network requirements

• A fresh Ubuntu 24.04 VM with at least 2 GB of RAM for a small site. A busy site, visual builder, large media library, or many plugins needs more memory.
• An SSH-capable, non-root administrator account with sudo access. Do not perform the whole installation as root.
• A public IPv4 address. Create an A record such as example.com pointing to it.
• Only publish an AAAA record when IPv6 is configured, routed, and reachable through the VM firewall. An unreachable AAAA record can make some visitors fail before IPv4 is tried.
• Control of DNS and a mailbox for certificate-renewal notices.
• Ports 22, 80, and 443 available at both the cloud firewall and the VM firewall.

Choose the deployment shape

1. Point DNS at the VM and update Ubuntu

Wait until DNS points to the VM before requesting a certificate. Replace example.com with your real hostname and run these commands from your workstation or the server:

dig +short A example.com
dig +short AAAA example.com

The A query should return the VM’s public IPv4 address. Run the AAAA query only when you intentionally configured IPv6; an empty result is normal when you do not use IPv6.

Connect with your sudo user, update packages, and reboot if the upgrade installs a new kernel or explicitly requests a reboot:

ssh admin@example.com
sudo apt update
sudo apt upgrade -y
sudo reboot

Reconnect after the reboot. Keeping the base system current before installing the application avoids troubleshooting an old library or service during the rest of the setup.

2. Install Nginx, MariaDB, PHP-FPM, and WordPress extensions

Install the web server, database server, PHP runtime, common WordPress extensions, and archive utilities:

sudo apt install -y nginx mariadb-server php-fpm php-mysql php-curl php-gd php-intl php-mbstring php-soap php-xml php-zip php-imagick curl tar openssl unzip

Enable the services so they start after a reboot. Ubuntu 24.04 normally names the PHP service php8.3-fpm; discover the installed name if you selected another PHP branch:

systemctl list-unit-files 'php*-fpm.service'
sudo systemctl enable --now nginx mariadb php8.3-fpm
sudo systemctl status nginx mariadb php8.3-fpm --no-pager

Confirm the versions and record the PHP-FPM socket name for the Nginx configuration:

nginx -v
php -v
mariadb --version
ls -l /run/php/

If the socket is not /run/php/php8.3-fpm.sock, use the actual socket shown by ls in the server block later.

Rank #2

EVEO® Screen Cleaner Spray Kit (Streak-Free) TV Screen Cleaner for Smart TV, Lcd, LEd, Oled | Computer Screen Cleaner Spray and Wipe Microfiber Cloth - TV, Monitor, Laptop, iPad, Car - 6.7oz 1 Pack

• Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
• Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
• Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
• Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
• Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth

$15.97

Buy on Amazon

3. Harden MariaDB and create a least-privilege WordPress database

Run the hardening routine supplied by the installed MariaDB release. It removes anonymous accounts, prevents unsuitable remote administrative access, and lets you review the test database:

sudo mariadb-secure-installation

Answer the prompts according to your security policy. Then open the local administrative client:

sudo mariadb

Create a database and a dedicated local account. Use a long, unique password; the example is deliberately a placeholder. Do not paste a real password into screenshots, tickets, or a shell command that will remain in history.

CREATE DATABASE wordpress CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'wpuser'@'localhost' IDENTIFIED BY 'replace-with-a-long-unique-password';
GRANT ALL PRIVILEGES ON wordpress.* TO 'wpuser'@'localhost';
FLUSH PRIVILEGES;
EXIT;

The account receives privileges only on wordpress.*, not on every database. If you use a different database name or username, keep those values consistent in wp-config.php and the browser installer.

4. Download WordPress into a domain-specific document root

Download the official current archive, extract it below Nginx’s web directory, and rename the extracted directory to your site hostname:

cd /tmp
wget https://wordpress.org/latest.zip
unzip latest.zip
sudo mv wordpress /usr/share/nginx/example.com
sudo rm -f latest.zip

Use a directory name without a trailing slash in the Nginx root directive. If you host more than one site, give each site its own directory rather than placing several installations in one tree.

5. Create wp-config.php, salts, and safe permissions

Copy and edit the configuration

Copy the sample configuration and edit it as the administrator:

cd /usr/share/nginx/example.com
sudo cp wp-config-sample.php wp-config.php
sudo nano wp-config.php

Set these four values to the database created above:

Rank #3

Sale

BladeHawks RGB Gaming Mouse Pad Extra Large Extended 31.5x12 Inch-Black | LED mouse pad with 14 lighting modes, covers keyboard & mouse, anti-slip rubber base, waterproof surface, USB powered

• 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
• 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
• 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
• 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
• 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.

$13.99

Buy on Amazon

define( 'DB_NAME', 'wordpress' );
define( 'DB_USER', 'wpuser' );
define( 'DB_PASSWORD', 'replace-with-a-long-unique-password' );
define( 'DB_HOST', 'localhost' );

Replace every sample authentication, nonce, and logged-in key and salt with fresh values generated by the official WordPress salt endpoint or by the installer. Never reuse salts from another site. Keep wp-config.php outside public downloads through Nginx rules and filesystem permissions.

Use ownership that limits write access

PHP-FPM needs to write uploads and, depending on your update method, selected WordPress directories. It does not need the entire installation to be world-writable. The following pattern makes your deployment account the owner, gives PHP-FPM the group, and grants write ownership to wp-content only. Replace admin with your actual login and adjust the path if your site differs:

sudo chown -R admin:www-data /usr/share/nginx/example.com
sudo find /usr/share/nginx/example.com -type d -exec chmod 755 {} ;
sudo find /usr/share/nginx/example.com -type f -exec chmod 644 {} ;
sudo chown -R www-data:www-data /usr/share/nginx/example.com/wp-content
sudo chmod 640 /usr/share/nginx/example.com/wp-config.php

If you want administrator-controlled updates instead, keep the deployment owner on core files and grant PHP-FPM write access only during a planned update. Whichever model you choose, never use chmod -R 777.

6. Create and test the Nginx server block

Write the site configuration

Create a dedicated configuration file:

sudo nano /etc/nginx/sites-available/example.com

Use this HTTP configuration. It includes WordPress’s front-controller fallback, blocks sensitive files, and prevents PHP execution in uploads. Change the hostname, document root, and PHP-FPM socket to match your server.

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;

    root /usr/share/nginx/example.com;
    index index.php index.html;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ .php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
    }

    location ~* ^/wp-content/uploads/.*.php$ {
        deny all;
    }

    location ~* /(wp-config.php|.htaccess|.git|composer.(json|lock)) {
        deny all;
    }

    location = /xmlrpc.php {
        # Add a deliberate policy here if your integrations require XML-RPC.
    }
}

The uploads rule is deliberately more specific than the general PHP rule, so a file accidentally copied into wp-content/uploads cannot execute as PHP. The sensitive-file rule also prevents direct requests for configuration and repository metadata.

Enable the site and remove the conflicting default

sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/example.com
sudo rm -f /etc/nginx/sites-enabled/default
sudo nginx -t
sudo systemctl reload nginx

nginx -t must report a successful syntax test before you reload. If it reports a duplicate server name, inspect the enabled files and remove an old configuration for the same hostname.

7. Allow required traffic without locking yourself out

Install UFW if it is not present. Add SSH before enabling the firewall; otherwise you can cut off your only administrative path:

sudo apt install -y ufw
sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'
sudo ufw status numbered
sudo ufw enable
sudo ufw status verbose

Confirm that the SSH rule appears before closing your current session. If your provider uses a nonstandard SSH port, allow that port explicitly instead of relying on the OpenSSH profile.

Rank #4

Sale

Vaydeer Wrist Rest for Keyboard and Mouse, Computer Ergonomic Wrist Support Pad, Soft Memory Foam Arm Cushion for Desk, Palm Hand Office Laptop Typing

• 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
• 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
• 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
• 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
• 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.

$15.99

Buy on Amazon

8. Enable HTTPS with Certbot before entering credentials

Install Certbot’s Nginx integration:

sudo apt install -y certbot python3-certbot-nginx

Request a certificate only after every listed hostname resolves to this VM and ports 80 and 443 are reachable. Use a real mailbox and replace the example names. Omit www if you did not create a DNS record for it:

sudo certbot --nginx --agree-tos --redirect --hsts --staple-ocsp --email you@example.com -d example.com -d www.example.com

Certbot edits the Nginx configuration to serve TLS and redirect HTTP to HTTPS. Check the resulting configuration and renewal timer:

sudo nginx -t
sudo systemctl reload nginx
sudo systemctl status certbot.timer --no-pager
sudo certbot renew --dry-run

A failed dry run usually indicates DNS, firewall, rate-limit, or certificate-name problems. Fix those before the certificate expires; do not disable certificate verification as a workaround.

9. Complete the WordPress browser wizard

1. Open https://example.com in a browser. If you used both names, test the canonical name selected by your redirect.
2. Choose the site language.
3. Enter database name wordpress, username wpuser, the unique password, and host localhost. Keep the table prefix unique if you run multiple installations in one database, although separate databases are simpler.
4. Provide a site title and a unique administrator username. Do not use a predictable administrator name.
5. Use a unique administrator password and a monitored email address. Keep the “discourage search engines” choice appropriate to whether the site is still private.
6. Submit the installer and sign in over HTTPS.

If the wizard cannot write configuration, confirm that the database values are correct and that wp-config.php exists with readable permissions. If it reports a database connection error, test the same local account with MariaDB before changing Nginx.

10. Verify every layer of the finished site

Service and version checks

sudo systemctl is-active nginx
sudo systemctl is-active mariadb
sudo systemctl is-active php8.3-fpm
nginx -v
php -v
mariadb --version

Each is-active command should print active. Substitute the installed PHP-FPM service name when you are using a newer branch.

DNS, redirect, and TLS checks

dig +short A example.com
curl -I http://example.com
curl -I https://example.com

The HTTP response should redirect to HTTPS, and the HTTPS response should be served by your site rather than the default Nginx page. Visit the site in a browser and inspect the certificate hostname and expiry date.

Permalinks and login

In the WordPress dashboard, open Settings → Permalinks, choose the desired structure, and save once. Open a post and a page in a private browser window, then sign out and sign back in. A 404 on a post URL usually means the try_files fallback is missing or the Nginx configuration was not reloaded.

Media upload and PHP execution blocking

Upload a small image through Media → Add New. Confirm that it appears in the media library and that the file is created below wp-content/uploads. Then test the upload protection from the server:

Best Value

Sale

Under Desk Cable Management Tray No Drill, Metal Mesh Cable Management Under Desk with Clamp Mount, 2 Hole Cable Tray with Wire Management and Cord Organizer for Home Office Standing Desk

• 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
• 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
• 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
• 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
• 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.

$13.89

Buy on Amazon

echo '<?php echo "unexpected"; ?>' | sudo tee /usr/share/nginx/example.com/wp-content/uploads/security-test.php
curl -i https://example.com/wp-content/uploads/security-test.php
sudo rm -f /usr/share/nginx/example.com/wp-content/uploads/security-test.php

The request must not return the text unexpected. A 403 or another non-executing response confirms that PHP is blocked in uploads. Remove the test file even when the result is correct.

PHP memory, updates, and backups

Set a realistic memory target

The Hosting Handbook lists 128 MB as sufficient for a vanilla installation and 256 MB as a recommended default for a typical production site with several plugins and a modern theme. This is a PHP memory setting, not a substitute for adequate VM RAM. If plugins hit the limit, raise the PHP-FPM pool or PHP memory setting deliberately, restart PHP-FPM, and monitor total system memory.

Patch the complete stack

• Apply Ubuntu security updates and reboot when required.
• Update Nginx, PHP-FPM, MariaDB, WordPress core, themes, and plugins.
• Recheck PHP support before a major upgrade. PHP 8.3 is recorded as security-only after 31 December 2025; PHP 8.4 or later is the production recommendation when compatible with your code.
• Test updates on a staging copy when the site is business-critical.

Back up data and prove that restoration works

A usable backup contains both the MariaDB database and the WordPress files, including wp-content/uploads and your final wp-config.php (stored securely). Schedule database dumps and file backups, retain more than one recovery point, and periodically restore them to an isolated VM. A backup that has never been restored is an assumption, not a recovery plan.

Troubleshooting common installation failures

“502 Bad Gateway” from Nginx

Check that PHP-FPM is running and that the socket in fastcgi_pass exists:

sudo systemctl status php8.3-fpm --no-pager
ls -l /run/php/
sudo tail -n 50 /var/log/nginx/error.log

Correct the socket path, test Nginx, and reload it. A socket for PHP 8.4, for example, will not be found when the configuration still points to PHP 8.3.

Database connection errors

Confirm the database and account locally:

mariadb -u wpuser -p -h localhost wordpress

If authentication fails, reset the password in MariaDB and update wp-config.php. Verify that the username is exactly wpuser@localhost; a user created for a different host is a different MariaDB account.

Certificate issuance fails

Re-run the A and AAAA queries, remove stale records, verify that the cloud firewall and UFW allow ports 80 and 443, and request only names that resolve to this VM. An AAAA record pointing elsewhere can cause validation to reach the wrong machine.

Uploads fail or permissions are denied

Inspect ownership and free disk space:

df -h
namei -l /usr/share/nginx/example.com/wp-content/uploads
sudo journalctl -u php8.3-fpm -n 50 --no-pager

Ensure PHP-FPM can write the uploads directory without making the whole site writable. Correct the directory owner or group, then retry a small image upload.

WordPress shows the default Nginx page

Check that the hostname is present in server_name, the symlink exists in /etc/nginx/sites-enabled, the default site is disabled, and DNS points to this VM. Run sudo nginx -T to see the active configuration and reload after corrections.

Quick Recap

SaleBestseller No. 1

Compressed Air Duster,130000RPM Super Power Cordless Air Duster,Rechargeable Brushless Blower,3 Gear Adjustable Blower with LED Light,Dust Remover for Computer/House/Outdoor/Car

$21.59

Bestseller No. 2

EVEO® Screen Cleaner Spray Kit (Streak-Free) TV Screen Cleaner for Smart TV, Lcd, LEd, Oled | Computer Screen Cleaner Spray and Wipe Microfiber Cloth - TV, Monitor, Laptop, iPad, Car - 6.7oz 1 Pack

$15.97

SaleBestseller No. 3

BladeHawks RGB Gaming Mouse Pad Extra Large Extended 31.5x12 Inch-Black | LED mouse pad with 14 lighting modes, covers keyboard & mouse, anti-slip rubber base, waterproof surface, USB powered

$13.99

SaleBestseller No. 4

Vaydeer Wrist Rest for Keyboard and Mouse, Computer Ergonomic Wrist Support Pad, Soft Memory Foam Arm Cushion for Desk, Palm Hand Office Laptop Typing

$15.99

SaleBestseller No. 5

Under Desk Cable Management Tray No Drill, Metal Mesh Cable Management Under Desk with Clamp Mount, 2 Hole Cable Tray with Wire Management and Cord Organizer for Home Office Standing Desk

$13.89

Final security checklist

• HTTPS works and HTTP redirects to it.
• SSH is allowed before UFW is enabled, and root password login is disabled according to your access policy.
• The WordPress database has its own strong local account.
• wp-config.php is not world-readable and is denied by Nginx.
• PHP files in wp-content/uploads do not execute.
• WordPress, plugins, themes, PHP, MariaDB, Nginx, and Ubuntu have an update and rollback plan.
• Database and file backups run automatically and have been restored successfully in a test environment.
• Disk space, PHP-FPM memory, certificate renewal, and service health are monitored.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.