To install WordPress on Ubuntu 24.04 with Nginx, build the stack in this order: point DNS at the server, update Ubuntu, install Nginx, MariaDB and PHP-FPM, create a least-privilege database, place WordPress outside the default site, configure an Nginx front controller, enable the firewall, obtain a TLS certificate with Certbot, and finish the WordPress browser wizard. This guide ends with checks for PHP-FPM, database access, HTTPS redirects, permalinks and upload-file protection.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What this Ubuntu 24.04 WordPress LEMP stack includes
A LEMP stack is Linux, Nginx, MariaDB (or MySQL) and PHP. On one Ubuntu 24.04 virtual machine, Nginx accepts HTTP and HTTPS traffic, PHP-FPM executes WordPress PHP files, MariaDB stores content and settings, and the WordPress files live under a domain-specific document root. TLS certificates, backups and monitoring also run on that server in this design.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →WordPress.org recommends PHP 8.3 or newer, MariaDB 10.11 or newer or MySQL 8.0 or newer, HTTPS, and Nginx or Apache as robust web servers. Ubuntu 24.04’s packaged PHP 8.3 is a practical compatibility baseline. The WordPress Hosting Handbook recommends PHP 8.4 or later for production; it records PHP 8.3 as security-only after 31 December 2025 and says WordPress 7.1 is compatible with PHP 8.2 through 8.5. Therefore, use 8.3 when it is the supported Ubuntu package you need, but evaluate a newer supported branch for a new production deployment and test every plugin before switching.
| Choice | What this guide does | When another choice fits |
|---|---|---|
| Single VM | Runs Nginx, PHP-FPM, MariaDB, WordPress, TLS and backups together; simple and inexpensive for a small site. | Split database, application and storage services when you need independent scaling, isolation or high availability. |
| MariaDB | Uses a local MariaDB service and a dedicated WordPress database user. | Use MySQL 8.0 or newer if that is your operational standard; the WordPress steps are equivalent. |
| PHP 8.3 | Matches the Ubuntu 24.04 baseline and WordPress compatibility requirements. | Use a newer supported PHP branch when available, after checking themes, plugins and the PHP-FPM socket name. |
| Self-managed VM | Requires SSH, sudo, DNS control, patching, backups and incident recovery. | Managed WordPress hosting removes much of the server administration but gives you less control over the stack. |
Prerequisites and resource planning
- A fresh Ubuntu 24.04 VM with a public IPv4 address, SSH access and a non-root account that can use
sudo. - At least 2 GB of RAM for a small site. Leave headroom for MariaDB, PHP workers, backups and traffic spikes.
- Control of the domain’s DNS zone. Create an A record pointing the hostname to the VM’s public IPv4 address. Publish an AAAA record only when IPv6 is configured, routed and reachable on the server.
- A real mailbox for certificate expiry notices and a unique, randomly generated database password and WordPress administrator password.
- A plan for off-server backups of both the MariaDB database and the WordPress files.
Use example.com below as a stand-in for your real hostname. Substitute it consistently; do not leave sample credentials in shell history, screenshots or configuration files.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
1. Point DNS at the VM and update Ubuntu
- In your DNS provider, set the domain’s A record to the VM’s public IPv4 address. Add
wwwonly if you intend to serve that hostname and will include it in the certificate. - Connect with SSH as the non-root administrator and update the operating system:
sudo apt update
sudo apt upgrade -yReboot when the package upgrade requests it, then reconnect:
sudo rebootCheck that public DNS has propagated before requesting a certificate:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11dig +short A example.com
dig +short AAAA example.comThe A query should return the VM address. An empty AAAA response is correct when you are not using IPv6; an AAAA record pointing somewhere else can make browsers reach the wrong machine.
2. Install Nginx, MariaDB, PHP-FPM and WordPress extensions
Install the web server, database, PHP runtime and extensions used by WordPress media, translations, XML, archives and image processing:
sudo apt install -y nginx mariadb-server php-fpm php-mysql php-curl php-gd php-intl php-mbstring php-soap php-xml php-zip php-imagick curl tar openssl unzipUbuntu’s php-fpm package selects the supported PHP branch available in your repositories. Check the versions before creating the Nginx socket path:
nginx -v
php -v
mariadb --version
systemctl list-unit-files 'php*-fpm.service'On a stock Ubuntu 24.04 installation the service is normally php8.3-fpm. If your repository supplies another supported branch, replace 8.3 in the service and socket names below with the version shown by the commands.
Recommended Free Tools
sudo systemctl enable --now nginx
sudo systemctl enable --now mariadb
sudo systemctl enable --now php8.3-fpm
sudo systemctl status nginx mariadb php8.3-fpm --no-pagerA status of active (running) for all three services confirms that the processes started. If PHP-FPM has a different unit name, enable that unit instead of trying to create a nonexistent php8.3-fpm service.
3. Harden MariaDB and create a dedicated WordPress database
Run the hardening utility supplied by the installed MariaDB release. Its questions differ slightly between releases; remove anonymous users, disallow remote root login, remove the test database and reload privilege tables when prompted.
sudo mariadb-secure-installationCreate a database and a local account used only by WordPress. Log in through the local administrative socket:
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
sudo mariadbCREATE DATABASE wordpress CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'wpuser'@'localhost' IDENTIFIED BY 'REPLACE_WITH_A_LONG_RANDOM_PASSWORD';
GRANT ALL PRIVILEGES ON wordpress.* TO 'wpuser'@'localhost';
FLUSH PRIVILEGES;
EXIT;The grant is limited to wordpress.*; do not use the MariaDB root account in wp-config.php. Generate a password that is unique to this database, store it in a password manager and avoid putting it in a command that will remain in shell history.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Test the account before proceeding:
mariadb -u wpuser -p -h localhost wordpress -e 'SELECT 1;'Enter the database password when prompted. A result containing 1 proves that the user, password, host and database name agree.
4. Download WordPress from WordPress.org
Download the current archive from the official endpoint https://wordpress.org/latest.zip, extract it under Nginx’s web directory and rename the directory to the domain. Keeping each site in its own directory makes future virtual-host changes safer.
cd /tmp
wget https://wordpress.org/latest.zip
sudo unzip latest.zip -d /usr/share/nginx/
sudo mv /usr/share/nginx/wordpress /usr/share/nginx/example.comConfirm that the expected files exist:
sudo test -f /usr/share/nginx/example.com/wp-settings.php && echo 'WordPress files are present'5. Configure wp-config.php, salts and permissions
Copy the sample configuration, then edit it with a root-capable editor:
sudo cp /usr/share/nginx/example.com/wp-config-sample.php /usr/share/nginx/example.com/wp-config.php
sudo nano /usr/share/nginx/example.com/wp-config.phpSet these four database values to the database created above:
DB_NAME:wordpressDB_USER:wpuserDB_PASSWORD: the unique database passwordDB_HOST:localhost
Replace every sample authentication-key and salt value with fresh values from the official WordPress.org secret-key generator. Salts invalidate existing authentication cookies, so generate them for this installation rather than copying values from another site. Save the file, then restore restrictive permissions after editing.
The following baseline keeps the code tree owned by root, allows the Nginx/PHP account to use the content directory, and avoids world-writable files:
sudo chown -R root:www-data /usr/share/nginx/example.com
sudo find /usr/share/nginx/example.com -type d -exec chmod 755 {} +
sudo find /usr/share/nginx/example.com -type f -exec chmod 644 {} +
sudo chown -R www-data:www-data /usr/share/nginx/example.com/wp-content
sudo chmod 640 /usr/share/nginx/example.com/wp-config.phpThis layout gives PHP-FPM write access where uploads, installed plugins and themes normally live without making the entire document root writable. If you want WordPress to update core files through the dashboard, either grant narrowly scoped write access during a controlled maintenance window or deploy updates as the administrator; do not solve update prompts by changing the whole tree to mode 777.
6. Create and enable the Nginx server block
Write a site configuration with the correct document root, WordPress front-controller fallback and PHP-FPM socket. The uploads rule must appear before the general PHP rule because Nginx evaluates regular-expression locations in order.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
sudo nano /etc/nginx/sites-available/example.comserver {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
root /usr/share/nginx/example.com;
index index.php index.html;
location / {
try_files $uri $uri/ /index.php?$args;
}
location ~* ^/wp-content/uploads/.*[.]php$ {
deny all;
}
location = /wp-config.php {
deny all;
}
location ~* /[.]ht {
deny all;
}
location ~* /(?:readme[.]html|license[.]txt) {
deny all;
}
location ~ [.]php$ {
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/run/php/php8.3-fpm.sock;
}
}If your PHP-FPM service is not 8.3, change the socket to the matching file under /run/php/. List the directory to confirm the exact name:
ls -l /run/php/Enable the site and remove Ubuntu’s default conflicting site:
sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/example.com
sudo rm -f /etc/nginx/sites-enabled/default
sudo nginx -t
sudo systemctl reload nginxnginx -t must report a successful syntax test before you reload. A failure usually means a missing semicolon, an incorrect root path or a PHP socket name that does not exist.
7. Configure UFW without locking yourself out
Allow SSH before enabling the firewall. Keep the current SSH session open while testing a second connection from your administrator workstation.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchessudo ufw allow 'OpenSSH'
sudo ufw allow 'Nginx Full'
sudo ufw enable
sudo ufw status verboseNginx Full opens ports 80 and 443. If you use a nonstandard SSH port, add a rule for that port before running ufw enable; otherwise a typo in the SSH rule can cut off remote access.
8. Enable HTTPS with Certbot
Install Certbot’s Nginx integration:
sudo apt install -y certbot python3-certbot-nginxRequest a certificate only after every hostname in the command resolves to this VM and port 80 is reachable. The following command covers the apex domain and www, redirects HTTP to HTTPS, enables HSTS and requests OCSP stapling:
sudo certbot --nginx --agree-tos --redirect --hsts --staple-ocsp --email [email protected] -d example.com -d www.example.comReplace the mailbox and hostnames with real values. Omit www.example.com if you did not create that DNS record. Certbot edits the Nginx configuration and schedules renewal; verify the result rather than assuming a successful command means every hostname works.
sudo certbot certificates
sudo systemctl status certbot.timer --no-pager
curl -I http://example.com
curl -I https://example.comThe HTTP request should return a redirect to an HTTPS URL. The HTTPS request should return a normal response from Nginx without a certificate-name warning.
Free tools Windows power users keep installed
One-click scans. No signup required.
9. Complete the WordPress browser installer
Open https://example.com. The WordPress wizard asks for the site language and database connection details. Enter:
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
- Database name:
wordpress - Username:
wpuser - Password: the database password
- Database host:
localhost - Table prefix: a short, site-specific prefix rather than the unchanged sample prefix
Continue only after the connection test succeeds. Choose a site title, create an administrator account with a unique password, and use an administrator email address that you monitor. Never reuse the database password for the WordPress administrator. Finish installation, sign in over HTTPS and confirm that the dashboard does not show a mixed-content or insecure-connection warning.
10. Prove that the stack works
Run these checks after the wizard. They test each layer rather than relying on a page that happens to load.
Service and version checks
sudo systemctl is-active nginx
sudo systemctl is-active mariadb
sudo systemctl is-active php8.3-fpm
nginx -v
php -v
mariadb --versionReplace php8.3-fpm with the installed service name when necessary. All three is-active commands should print active.
DNS and TLS checks
dig +short A example.com
curl -I http://example.com
curl -I https://example.comThe A record must identify this VM. HTTP should redirect to HTTPS, and HTTPS should return a response using the certificate for the requested hostname.
Permalinks and login
In the dashboard, open Settings > Permalinks, choose the desired structure and save it. Visit a post URL in a private browser window, sign out and sign back in, then revisit the dashboard. The try_files fallback is what sends a clean post URL to index.php; without it, Nginx commonly returns 404 for every permalink except the home page.
Media upload and PHP execution blocking
Upload a normal JPEG or PNG through Media > Add New. The image should appear in the media library and in wp-content/uploads. To verify that an uploaded PHP file cannot execute, create a temporary probe and request it:
sudo mkdir -p /usr/share/nginx/example.com/wp-content/uploads/security-test
sudo sh -c 'printf "<?php echo 1; ?>" > /usr/share/nginx/example.com/wp-content/uploads/security-test/probe.php'
curl -i https://example.com/wp-content/uploads/security-test/probe.php
sudo rm -rf /usr/share/nginx/example.com/wp-content/uploads/security-testThe request should be denied rather than returning the PHP output. Remove the probe immediately even when the response is correct. A successful response containing the script output means the uploads deny rule is missing, ordered after the general PHP location, or overridden by another server block.
11. Troubleshoot the failures that occur most often
502 Bad Gateway
Check that PHP-FPM is running and that the socket in the Nginx server block exists:
sudo systemctl status php8.3-fpm --no-pager
ls -l /run/php/
sudo journalctl -u php8.3-fpm -n 50 --no-pagerCorrect the socket path to match the installed PHP branch, run sudo nginx -t and reload Nginx.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
WordPress cannot connect to the database
Re-run the interactive MariaDB test with mariadb -u wpuser -p -h localhost wordpress -e 'SELECT 1;'. Check spelling, the database host, the username and the password in wp-config.php. Confirm that the user was created as 'wpuser'@'localhost'; a user created for a different host is not the same account.
Every post URL returns 404
Confirm that the request is reaching the intended server block, that the document root contains index.php, and that the location / block contains try_files $uri $uri/ /index.php?$args;. Save the permalink settings again after fixing Nginx, then reload the service.
Certificate issuance fails
Check both A and AAAA records, remove stale records, verify that port 80 is allowed in UFW and ensure every -d hostname resolves to this VM. Do not include a hostname whose DNS points to another server.
Uploads fail or are too large
Check free disk space, ownership of wp-content, PHP’s upload_max_filesize and post_max_size, and any Nginx client_max_body_size setting. Increase limits deliberately in the active PHP-FPM configuration and Nginx server block, reload both services, and keep the values consistent. Never grant write access to the entire document root as a workaround.
12. Set PHP memory and plan maintenance
The Hosting Handbook lists 128 MB as sufficient for a vanilla WordPress installation and 256 MB as a recommended default for a typical production site with several plugins and a modern theme. Treat those as planning values, not a reason to allocate unlimited memory to every PHP worker.
| Site profile | PHP memory starting point | What to watch |
|---|---|---|
| Vanilla install | 128 MB | Import jobs, image processing and plugin activation errors. |
| Typical production site | 256 MB recommended default | PHP-FPM worker memory, concurrent requests, swap activity and disk space. |
Measure before raising limits: one oversized value multiplied across many PHP-FPM workers can exhaust a 2 GB VM. Recheck the PHP support policy before every major upgrade; PHP 8.3 is security-only after 31 December 2025 according to the Hosting Handbook, while a newer supported branch may be preferable when your extensions and plugins are ready.
Updates
- Apply Ubuntu security updates and restart services when required.
- Keep Nginx, PHP, MariaDB, WordPress core, themes and plugins current.
- Read plugin compatibility notes before changing PHP branches or MariaDB versions.
- Keep SSH restricted to the administrators who need it and review UFW rules after network changes.
Backups and restoration tests
Back up the database and files as separate artifacts outside the web root. A database dump can be created with:
sudo install -d -m 700 /var/backups/wordpress
sudo sh -c 'mysqldump --single-transaction -u wpuser -p wordpress > /var/backups/wordpress/wordpress.sql'
sudo tar -czf /var/backups/wordpress/wordpress-files.tar.gz -C /usr/share/nginx example.com
sudo chmod 600 /var/backups/wordpress/*Copy backups to storage that is not the VM, retain versions according to your recovery needs and periodically restore them to a test environment. A backup that has never been restored is an unverified assumption, not a recovery plan. Monitor disk usage, PHP-FPM memory, certificate renewal status and MariaDB logs.
Quick Recap
Final success checklist
- DNS A records resolve to the VM, and no incorrect AAAA record is published.
- Nginx, MariaDB and the matching PHP-FPM service are active.
- The MariaDB account is dedicated to the WordPress database and uses a unique password.
wp-config.phpcontains the correct database details and fresh salts, with restrictive permissions.- Nginx serves the domain directory, routes unknown paths to
index.php, denies sensitive files and blocks PHP execution in uploads. - UFW allows SSH, HTTP and HTTPS without locking out the administrator.
- Certbot issued a certificate, HTTP redirects to HTTPS and renewal is scheduled.
- The browser installer completed, the administrator can log in, permalinks work and a media upload succeeds.
- Database and file backups exist off the VM and a restoration test is scheduled.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
