Host a WordPress site on a Linux VPS

On a VPS, WordPress is not a pre-installed option: you assemble the stack yourself. A web server, PHP and a database are enough. In exchange, you keep control of the configuration, the versions and the backups.

• WordPress on a VPS relies on Nginx, PHP-FPM and MariaDB: you install and maintain all three.
• A dedicated database per site and limited rights reduce the impact of a flaw.
• Back up the files and the database together, and copy the backups off the server.

Install the software stack

WordPress needs three components: a web server (Nginx in this example), PHP with its FPM manager, and a MariaDB or MySQL database. On a VPS, you install and update these components yourself.

• sudo apt update && sudo apt install -y nginx mariadb-server php-fpm php-mysql php-curl php-gd php-mbstring php-xml php-zip php-intl unzip
• php -v gives the PHP version, and ls /run/php/ shows the FPM socket, for example php8.3-fpm.sock.
• sudo mysql_secure_installation removes anonymous access and sets the administrator password of the database.

Create the database and download WordPress

A dedicated database, with a user who can only access it, limits the damage in case of a flaw. The code is downloaded from the official WordPress site and placed in the web folder.

• sudo mysql -e "CREATE DATABASE wp_exemple CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci; CREATE USER 'wp_user'@'localhost' IDENTIFIED BY 'long-password'; GRANT ALL ON wp_exemple.* TO 'wp_user'@'localhost';"
• cd /tmp && curl -O https://wordpress.org/latest.tar.gz && tar xzf latest.tar.gz
• sudo mv /tmp/wordpress /var/www/exemple.fr && sudo chown -R www-data:www-data /var/www/exemple.fr

Configure Nginx and wp-config.php

The server block tells Nginx where the site is and passes the .php files to PHP-FPM. In wp-config.php, fill in the database settings, then protect the file and disable the file editor.

• In /etc/nginx/sites-available/exemple.fr: root /var/www/exemple.fr; and a location block that sends .php files to the PHP-FPM socket.
• sudo ln -s /etc/nginx/sites-available/exemple.fr /etc/nginx/sites-enabled/ && sudo nginx -t && sudo systemctl reload nginx
• In wp-config.php: define('DISALLOW_FILE_EDIT', true); and chmod 640, because the file contains the database credentials.

Back up and update

A WordPress site has two parts: the files and the database. Back up both, since one without the other does not restore the site. On a VPS, updates of the core, the plugins and PHP are your responsibility.

• mysqldump wp_exemple > /root/wp_exemple-$(date +%F).sql: a copy of the database for the day.
• tar czf /root/site-$(date +%F).tar.gz /var/www/exemple.fr: an archive of the files, to copy outside the VPS afterwards.
• Test plugin updates on a copy of the site before applying them in production.