Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
The reliable pattern is to run Traefik as the only internet-facing container, keep WordPress on a shared internal Docker network, and let Traefik obtain and renew a Let’s Encrypt certificate. Point your WordPress hostname at the Docker host, publish the port required by your ACME challenge, enable the Docker provider with automatic exposure disabled, and add an HTTPS router label to WordPress. Persist acme.json so certificates survive container recreation.
How the deployment works
A browser connects to https://example.com and reaches Traefik on port 443. Traefik matches the request against the WordPress router’s Host() rule, terminates TLS, and forwards plain HTTP over a private Docker network to the WordPress container. WordPress does not need to publish port 80 to the internet.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →
Traefik’s Docker provider watches container labels and creates routers and services from them. Setting providers.docker.exposedbydefault=false is important: containers are not published accidentally; only a service with traefik.enable=true is eligible for routing.
Prerequisites: DNS, ports and software
- A publicly reachable Linux host (or equivalent Docker server) with Docker Engine and Docker Compose installed.
- A DNS
AorAAAArecord for the WordPress hostname, such asexample.com, pointing to that host’s public address. Include any required wildcard or separate subdomain records. - Firewall, cloud security-group and upstream-router rules allowing the ACME port and normal HTTPS traffic. TLS-ALPN-01 requires inbound TCP 443. HTTP-01 requires inbound TCP 80; publish 443 as well for ordinary HTTPS.
- A directory for persistent certificate state, for example
./letsencrypt, beside your Compose file.
Verify DNS from a network outside your server before requesting a certificate. A record that resolves only inside your home or corporate network cannot satisfy Let’s Encrypt’s public validation. If you publish both A and AAAA records, make sure IPv6 actually routes to the same Traefik host; an incorrect AAAA record can make validation fail even when IPv4 works.
#1 Best Overall
Port forwarding must continue all the way from the public address to the host running Traefik. Opening a port in the operating-system firewall does not help if a cloud security group, home router, carrier-grade NAT, or upstream load balancer blocks it first. Any existing process bound to 80 or 443 must be moved, stopped, or deliberately integrated with Traefik.
Choose the Let’s Encrypt challenge
| Challenge | Public port required | Use it when | Important constraint |
|---|---|---|---|
| TLS-ALPN-01 | 443 | Traefik can receive HTTPS directly and no upstream service must terminate TLS first. | Port 443 must reach Traefik without a proxy or load balancer preventing the ACME TLS-ALPN exchange. |
| HTTP-01 | 80 (and 443 for the site) | Port 80 is available and your network or load balancer handles HTTP reliably. | The HTTP challenge entrypoint must be reachable; redirects must not break /.well-known/acme-challenge/. |
TLS-ALPN-01 is the simplest configuration when 443 can be forwarded directly. Choose HTTP-01 when port 80 is the port your infrastructure can expose consistently, or when an existing design already routes HTTP to Traefik. Do not enable both merely as a workaround; first make one challenge path reachable and test it.
With TLS-ALPN-01, another reverse proxy cannot terminate TLS and then forward ordinary HTTPS to Traefik unless it passes the ACME ALPN handshake correctly. With HTTP-01, Traefik must own the public web entrypoint and answer the challenge URL. A shared load balancer can work only if it forwards the challenge request to this Traefik instance rather than to a different web server.
Prepare the project and certificate storage
Create a working directory and a certificate directory:
mkdir -p ~/wordpress-traefik/letsencrypt
cd ~/wordpress-traefik
touch letsencrypt/acme.json
chmod 600 letsencrypt/acme.jsonTraefik writes account and certificate data to this file. Back it up securely, never commit it to a repository, and do not expose it through a web server. If you restore the file on another host, preserve its restrictive permissions. A missing, read-only, or incorrectly mounted file can make Traefik request certificates again after every recreation.
Compose configuration using TLS-ALPN-01
The following Compose file uses Traefik 3.7, a WordPress Apache container, and MariaDB. Replace the example hostname, email address and passwords before starting it. Pin image tags that you have tested rather than relying on an unchanging latest tag in a production deployment.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
services:
traefik:
image: traefik:v3.7
command:
- --providers.docker=true
- --providers.docker.exposedbydefault=false
- --entrypoints.websecure.address=:443
- --certificatesresolvers.myresolver.acme.email=admin@example.com
- --certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json
- --certificatesresolvers.myresolver.acme.tlschallenge=true
ports:
- '443:443'
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- ./letsencrypt:/letsencrypt
networks:
- proxy
db:
image: mariadb:11
environment:
MARIADB_DATABASE: wordpress
MARIADB_USER: wordpress
MARIADB_PASSWORD: change-this-db-password
MARIADB_ROOT_PASSWORD: change-this-root-password
volumes:
- db_data:/var/lib/mysql
networks:
- internal
wordpress:
image: wordpress:latest
depends_on:
- db
environment:
WORDPRESS_DB_HOST: db:3306
WORDPRESS_DB_NAME: wordpress
WORDPRESS_DB_USER: wordpress
WORDPRESS_DB_PASSWORD: change-this-db-password
labels:
- traefik.enable=true
- traefik.http.routers.wordpress.rule=Host(`example.com`)
- traefik.http.routers.wordpress.entrypoints=websecure
- traefik.http.routers.wordpress.tls=true
- traefik.http.routers.wordpress.tls.certresolver=myresolver
- traefik.http.services.wordpress.loadbalancer.server.port=80
networks:
- proxy
- internal
volumes:
db_data:
networks:
proxy:
internal:The Docker socket is mounted read-only. Traefik needs to inspect container metadata, while WordPress and the database share only the networks they require. The database is not attached to the public proxy network. The Compose project creates a network name based on the directory; use that generated name when inspecting it later.
Traefik 3.x examples are not interchangeable with every older v2 example. Confirm the image tag and option names against the release you installed before copying a configuration. A valid-looking flag from another major version can leave the provider or ACME resolver disabled without producing the router you expect.
What each WordPress label does
traefik.enable=trueopts this container into routing after automatic exposure has been disabled.rule=Host(`example.com`)limits the router to the requested hostname. Use the exact DNS name users will enter.entrypoints=websecurebinds the router to the HTTPS entrypoint on port 443.tls=truetells Traefik that this router handles HTTPS traffic.tls.certresolver=myresolverselects the ACME resolver that obtains the certificate.loadbalancer.server.port=80tells Traefik which port the WordPress container listens on inside Docker. It is not a host-published port.
Traefik and WordPress must share the proxy network. If a container is attached to several networks, you can also set traefik.docker.network=proxy to remove ambiguity about which network Traefik should use. Without that hint, Traefik may select a different attached network and fail to connect even though the router appears in its configuration.
Start the stack and complete WordPress installation
- Save the file as
compose.yml, replace every example value, and confirm that the hostname in theHost()label exactly matches DNS. - Validate the Compose model before creating containers:
docker compose config - Start the services in the background:
docker compose up -d - Watch Traefik while the first certificate is requested:
docker compose logs -f traefik - Open
https://example.com. The first request may take a short time while the ACME order completes. Continue through the normal WordPress installer and set the site URL to the HTTPS address. - Confirm renewal state is still present after a restart:
docker compose restart traefik ls -l letsencrypt/acme.json
Do not repeatedly restart or recreate the stack while troubleshooting a failed production request. Let’s Encrypt applies rate limits. Use the staging procedure below until routing and reachability are proven. Check the logs for the ACME authorization result rather than judging success only by whether the container is running.
Using HTTP-01 instead
Change the Traefik command section and ports as follows:
command:
- --providers.docker=true
- --providers.docker.exposedbydefault=false
- --entrypoints.web.address=:80
- --entrypoints.websecure.address=:443
- --certificatesresolvers.myresolver.acme.email=admin@example.com
- --certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json
- --certificatesresolvers.myresolver.acme.httpchallenge=true
- --certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web
ports:
- '80:80'
- '443:443'Keep the WordPress HTTPS labels unchanged. The ACME client uses the web entrypoint to answer the challenge, while normal site traffic uses websecure. Port 80 must be forwarded to this Traefik instance from the public internet; opening it only on the host firewall is not enough if a router or load balancer sits upstream.
Rank #3
HTTP-01 is useful when an infrastructure team already permits port 80, but it introduces an additional public entrypoint to monitor. If another service owns port 80, either move that service behind Traefik or choose TLS-ALPN-01 when direct 443 access is possible. Do not point the DNS name at one machine while forwarding the challenge port to another.
Redirect HTTP to HTTPS safely
After certificate issuance works, add a redirect router for the same hostname. These labels create a middleware and an HTTP router that sends visitors to HTTPS:
- traefik.http.middlewares.wordpress-https.redirectscheme.scheme=https
- traefik.http.routers.wordpress-http.rule=Host(`example.com`)
- traefik.http.routers.wordpress-http.entrypoints=web
- traefik.http.routers.wordpress-http.middlewares=wordpress-https
- traefik.http.routers.wordpress-http.service=wordpressWhen using HTTP-01, verify that the redirect does not prevent Traefik from serving /.well-known/acme-challenge/. Test issuance first, then enable and test the redirect from an external network. A redirect is not a substitute for publishing the challenge entrypoint. If a redirect is installed before the challenge path is reachable, the browser may appear to work while ACME validation still fails.
Test with Let’s Encrypt staging first
For safe tests, temporarily add this command flag:
- --certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directoryA successful staging certificate is intentionally untrusted and is commonly identified as Fake LE Intermediate X1
. That result proves DNS, ports, the challenge and router wiring without consuming production issuance attempts.
- Start or restart Traefik with the staging CA and inspect its logs for a completed order.
- Confirm the router serves the expected hostname and that the certificate is a staging certificate.
- Stop Traefik, remove the staging
acme.json, remove the staging flag, recreate an empty file with mode 600, and start again to request the trusted production certificate.
Do not leave the staging server configured permanently: browsers will warn about the certificate, and visitors will not receive a trusted production chain. Keep separate staging and production certificate files so a test account or certificate is not accidentally reused.
Troubleshooting 404 responses and default certificates
| Symptom | Likely cause | Checks and correction |
|---|---|---|
| Traefik returns 404 | The request does not match a router, or Traefik cannot reach the selected service. | Check the exact Host() value, confirm the request uses the published entrypoint, verify the WordPress container is on proxy, and confirm the service port is 80. |
| Traefik presents its default certificate | No matching TLS router or no usable certificate for the hostname. | Verify tls=true, the websecure entrypoint, the resolver label, DNS, and ACME logs. Ensure the hostname in the browser is covered by the router. |
| ACME HTTP-01 fails | Port 80 is blocked, mapped elsewhere, or the web entrypoint is missing. | Test TCP 80 externally, inspect firewall and load-balancer forwarding, and confirm acme.httpchallenge.entrypoint=web. |
| ACME TLS-ALPN-01 fails | Port 443 does not reach Traefik directly or another TLS terminator answers first. | Forward 443 to this host, remove conflicting listeners, and confirm the TLS challenge flag and websecure binding. |
| Certificate disappears after recreation | acme.json was not persisted or was mounted at the wrong path. |
Check that ./letsencrypt is mounted to /letsencrypt and the storage flag points to /letsencrypt/acme.json. |
| Router exists but requests time out | Network selection or host firewall prevents Traefik from reaching WordPress. | Inspect generated configuration and container networks; keep the Docker socket read-only and make sure both services share the proxy network. |
Start diagnosis with logs and externally observed connectivity rather than changing several labels at once:
docker compose ps
docker compose logs --tail=200 traefik
docker network inspect wordpress-traefik_proxy
docker compose configUse the actual Compose-generated network name if your project directory differs. The key evidence is whether DNS reaches this host, whether the required port reaches Traefik, and whether Traefik generated the router from the labels. A 404 is usually a routing mismatch, while a default certificate usually indicates that TLS negotiation occurred without a matching certificate router; treat those as separate clues.
When you do not have a public Docker host
ACME validation cannot reach a laptop or private server hidden behind an inaccessible address. Use a public VPS, a managed Docker host, or another server where you control DNS, firewall rules, Docker and Compose. Point the WordPress hostname at that host and ensure the selected challenge port is forwarded to Traefik. Hosting prices and included network features vary by provider, so confirm that the service supplies a public IPv4 or IPv6 address and permits inbound 80 or 443 before migrating the stack.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Operational and security practices
- Keep only Traefik’s 80/443 ports public. Do not publish MariaDB or WordPress directly unless you have a specific administrative reason.
- Use strong, unique database credentials and store secrets outside a committed Compose file when your deployment platform supports Docker secrets or an environment-file mechanism.
- Back up both the database volume and
letsencrypt/acme.json. A database backup without certificate state means a replacement host must perform a new ACME order. - Monitor Traefik logs and test renewal before certificate expiry. Renewal is automatic only while Traefik can still reach the ACME endpoint and write its storage file.
- Review image updates deliberately. Traefik option names and examples differ between major releases, so check the documentation for the version you actually run before copying a v2 configuration into a v3 deployment.
- Keep the Docker socket read-only and restrict access to the host; possession of Docker-socket access is effectively administrative control over the machine.
- Document which DNS records, port forwards, resolver name and certificate file belong to each environment. This prevents a staging stack from competing with production for the same hostname.
Final verification checklist
- The WordPress hostname resolves publicly to the Docker host.
- The selected ACME port (443 for TLS-ALPN-01 or 80 for HTTP-01) reaches Traefik directly.
- Traefik publishes
websecureon 443 and, for HTTP-01 or redirects,webon 80. providers.docker.exposedbydefault=falseis enabled.- WordPress has the Host rule, secure entrypoint,
tls=true, resolver and internal service-port labels. - Traefik and WordPress share a Docker network, while the database remains private.
acme.jsonis mounted persistently, backed up and protected with restrictive permissions.- A staging certificate succeeded before the production request, when testing a new setup.
- HTTP redirects are enabled only after the selected ACME challenge has been proven from an external network.
Frequently Asked Questions
Should I use HTTP-01 or TLS-ALPN-01?
Use TLS-ALPN-01 when port 443 reaches Traefik directly and no upstream TLS terminator interferes. Use HTTP-01 when port 80 is the reliably forwarded public port and you can configure Traefik’s web entrypoint.
Why does Traefik return a 404?
The request usually does not match the router. Check the exact hostname in the Host() rule, the entrypoint, the published port, the proxy network, and the internal WordPress service port.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Why am I seeing Traefik’s default certificate?
Traefik has no matching usable certificate router for that hostname. Verify tls=true, the websecure entrypoint, the resolver label, public DNS, and ACME log messages.
Do I need to publish WordPress port 80?
No. Publish Traefik’s public ports only. The WordPress container listens on port 80 inside the shared Docker network, and the service label tells Traefik to use that internal port.
Best Value
- Docker, Docker Swarm, Docker Compose, Programmer, Developer, Coding, Programming, Software Engineer, Code, DevOps, Deploy, Deployment, Kubernetes, Salt, Puppet, Chef, Terraform, Container, AWS, Azure, Cloud, Geek, Funny, Computer, Software, Tech, IT
- Integration, Scrum, Compile, Compilation, Science, Bug, Debug, Python, Linux, Java, Javascript, Scala, Dotnet, Kotlin
- Lightweight, Classic fit, Double-needle sleeve and bottom hem
What happens if I delete or lose acme.json?
Traefik loses its account and certificate state and may need to request certificates again. Persist the file, protect it with mode 600, and include it in secure backups.
Can I enable the HTTPS redirect before obtaining a certificate?
Wait until issuance succeeds. With HTTP-01, verify that the redirect still allows /.well-known/acme-challenge/; otherwise validation can fail even though ordinary browser requests redirect correctly.
Why does a router on two Docker networks time out?
Traefik may choose the wrong network. Keep Traefik and WordPress on the proxy network and set traefik.docker.network=proxy when the container has multiple attachments.
How should I test without hitting production rate limits?
Use Let’s Encrypt’s staging directory, inspect the resulting untrusted staging certificate, then remove the staging file and flag before requesting the trusted production certificate.
Can this run behind a home router or load balancer?
Yes, if public DNS points to the reachable address and the router or load balancer forwards the selected ACME port to Traefik. TLS-ALPN-01 needs direct 443 handling; HTTP-01 needs port 80 and the configured web entrypoint.
Which Traefik version should I copy examples from?
Match the example to the Traefik image you run. Current v3 configurations and older v2 examples can differ in image tags and option names, so validate the flags against your installed release.
Recommended Free Tools
The Bottom Line
Put Traefik in front, expose only the required public ports, point DNS at the host, and explicitly label WordPress with a matching HTTPS router. Choose one reachable ACME challenge, persist and protect acme.json, test with staging, then add redirects and monitor renewals.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
