WordPress can run efficiently on Ubuntu 24.04 with Nginx, PHP-FPM, and MariaDB. This setup gives you full control over the web server, PHP runtime, database, files, backups, and security configuration instead of placing the site inside a shared hosting environment.
In this tutorial, you will install the required LEMP components, create an isolated WordPress database account, download WordPress from the official source, configure Nginx, secure the configuration file, enable HTTPS, and complete the browser-based installation.
Step 1 — Confirm DNS and Update Ubuntu
Point your domain's DNS A record to the public IP address of your Raff Linux VM. If you also publish an AAAA record, make sure it points to the same server over IPv6.
Check the records from your workstation:
dig +short A example.com dig +short AAAA example.com
Replace example.com throughout this tutorial with your real domain.
Connect to the server over SSH, then update installed packages:
sudo apt update sudo apt upgrade -y
Step 2 — Install Nginx, MariaDB, and PHP-FPM
Install the web server, database server, PHP-FPM, and the PHP extensions commonly used by WordPress:
sudo apt install -y \ nginx \ mariadb-server \ php-fpm \ php-mysql \ php-curl \ php-gd \ php-intl \ php-mbstring \ php-soap \ php-xml \ php-zip \ php-imagick
Enable the main services:
sudo systemctl enable --now nginx mariadb php8.3-fpm
Confirm they are running:
systemctl is-active nginx mariadb php8.3-fpm
Each command should return active. Ubuntu 24.04 uses PHP 8.3 by default. Check your installed version with:
php -v
If the version differs, adjust the PHP-FPM service name and socket path used later.
Step 3 — Secure MariaDB
Run MariaDB's security helper:
sudo mariadb-secure-installation
Keep Unix socket authentication enabled for the local MariaDB root account. Remove anonymous users, disallow remote root login, remove the test database, and reload privileges when prompted.
WordPress should not use the MariaDB root account. The next step creates a dedicated database and local-only user.
Step 4 — Create the WordPress Database and User
Generate a strong password and save it in your password manager:
openssl rand -base64 24
Open MariaDB:
sudo mariadb
Create the database and account. Replace use_a_unique_password with the generated password:
CREATE DATABASE wordpress CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci; CREATE USER 'wpuser'@'localhost' IDENTIFIED BY 'use_a_unique_password'; GRANT ALL PRIVILEGES ON wordpress.* TO 'wpuser'@'localhost'; EXIT;
Test the account:
mariadb -u wpuser -p wordpress
After entering the password, run:
SELECT DATABASE(), CURRENT_USER(); EXIT;
Keep MariaDB port 3306 closed to the public internet for this single-server deployment.
Step 5 — Download WordPress from the Official Source
Install the tools used to download and extract WordPress:
sudo apt install -y curl tar
Download the current WordPress archive:
cd /tmp curl -fLO https://wordpress.org/latest.tar.gz
Extract it:
tar -xzf latest.tar.gz
Create the site directory and move the WordPress files into it:
sudo mkdir -p /var/www/example.com/public sudo cp -a /tmp/wordpress/. /var/www/example.com/public/
Step 6 — Configure wp-config.php
Create the configuration file from the sample:
sudo cp /var/www/example.com/public/wp-config-sample.php \ /var/www/example.com/public/wp-config.php
Open it:
sudo nano /var/www/example.com/public/wp-config.php
Set the database values created earlier:
define( 'DB_NAME', 'wordpress' ); define( 'DB_USER', 'wpuser' ); define( 'DB_PASSWORD', 'use_a_unique_password' ); define( 'DB_HOST', 'localhost' ); define( 'DB_CHARSET', 'utf8mb4' );
WordPress needs the database password in wp-config.php, so protect the file with restrictive permissions rather than placing it in the public document body or shell history.
Generate fresh authentication salts from the official WordPress API:
curl -s https://api.wordpress.org/secret-key/1.1/salt/
Copy the generated lines and replace the placeholder authentication-key and salt definitions in wp-config.php.
You can also disable plugin and theme editing from the WordPress dashboard by adding this above the final stop-editing comment:
define( 'DISALLOW_FILE_EDIT', true );
Step 7 — Set Ownership and File Permissions
Set Nginx and PHP-FPM's service account as the owner:
sudo chown -R www-data:www-data /var/www/example.com
Apply standard directory and file permissions:
sudo find /var/www/example.com -type d -exec chmod 755 {} \; sudo find /var/www/example.com -type f -exec chmod 644 {} \;
Restrict the configuration file further:
sudo chmod 640 /var/www/example.com/public/wp-config.php
Do not apply 777 permissions to WordPress directories. Broad write access makes it easier for a compromised process or account to modify application files.
Step 8 — Configure the Nginx Server Block
Create a new site configuration:
sudo nano /etc/nginx/sites-available/example.com
Add:
server { listen 80; listen [::]:80; server_name example.com www.example.com; root /var/www/example.com/public; index index.php index.html; client_max_body_size 64M; access_log /var/log/nginx/example.com.access.log; error_log /var/log/nginx/example.com.error.log; location / { try_files $uri $uri/ /index.php?$args; } location ~ \.php$ { include snippets/fastcgi-php.conf; fastcgi_pass unix:/run/php/php8.3-fpm.sock; } location ~ /\.(?!well-known).* { deny all; } location = /xmlrpc.php { deny all; } location ~* \.(css|gif|ico|jpeg|jpg|js|png|svg|webp|woff|woff2)$ { expires 7d; access_log off; } }
The try_files rule supports WordPress permalinks. The PHP block sends PHP requests to PHP-FPM through its local Unix socket.
The example blocks xmlrpc.php, which is appropriate when you do not use Jetpack, the WordPress mobile app, remote publishing, or another XML-RPC-dependent integration. Remove that location block when your workflow requires XML-RPC.
Enable the site and disable the default configuration:
sudo ln -s /etc/nginx/sites-available/example.com \ /etc/nginx/sites-enabled/example.com sudo rm -f /etc/nginx/sites-enabled/default
Test and reload Nginx:
sudo nginx -t sudo systemctl reload nginx
Step 9 — Configure the Firewall
If UFW is enabled, allow SSH, HTTP, and HTTPS:
sudo ufw allow OpenSSH sudo ufw allow 'Nginx Full' sudo ufw status
Confirm that ports 80 and 443 are allowed before requesting a TLS certificate.
Step 10 — Enable HTTPS with Let's Encrypt
Install Certbot and its Nginx plugin:
sudo apt install -y certbot python3-certbot-nginx
Request a certificate and configure the HTTP-to-HTTPS redirect:
sudo certbot --nginx --redirect \ -d example.com \ -d www.example.com
Only request hostnames that resolve to this server. For certificate verification, renewal testing, and troubleshooting, follow How to Secure Nginx with Let's Encrypt on Ubuntu 24.04.
Step 11 — Complete the WordPress Installation
Open:
https://example.com
Choose the site language and enter:
- Site title
- Administrator username
- Strong administrator password
- Administrator email address
- Search-engine visibility preference
Avoid predictable administrator names such as admin. Complete the installer, then sign in at:
https://example.com/wp-admin/
Step 12 — Verify and Harden the Site
Check the HTTPS response:
curl -I https://example.com
Check for PHP, Nginx, and database errors:
sudo tail -n 50 /var/log/nginx/example.com.error.log sudo journalctl -u php8.3-fpm -n 50 --no-pager sudo journalctl -u mariadb -n 50 --no-pager
Before publishing production content:
- Update WordPress core, themes, and plugins.
- Delete unused themes and plugins.
- Configure automated backups for both files and the MariaDB database.
- Test a restore instead of assuming a backup is usable.
- Use multi-factor authentication for administrator accounts.
- Keep Ubuntu and PHP packages patched.
- Add caching only after measuring the site's real bottleneck.
Raff Linux VMs start at $8.49 per month with 2 vCPU, 2 GB RAM, 40 GB NVMe storage, and 3 Gbps unmetered bandwidth. The 2 vCPU and 4 GB RAM plan at $13.99 per month provides more headroom for PHP workers, MariaDB, plugins, updates, and traffic spikes.
Conclusion
You now have WordPress running on Ubuntu 24.04 with Nginx, PHP-FPM, MariaDB, protected configuration permissions, and HTTPS.
For a broader explanation of the underlying services, see How to Set Up a LEMP Stack on Ubuntu 24.04. Protect the site with scheduled backups and consider object storage for large media libraries or off-server backup copies.