Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →A fresh WordPress installation is not ready for public traffic until Apache serves the correct site, WordPress and Ubuntu are patched, HTTPS and permalinks work, permissions are intentional, and a full restore has been tested. Complete the steps below in order, then run the acceptance checks before sharing the domain.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
1. Verify Apache is serving the right WordPress site
Start at the web-server layer. A successful browser installer does not prove that the intended virtual host, document root, or rewrite rules are active. Confirm that the domain resolves to this Ubuntu server and that Apache’s enabled site points to the directory containing wp-admin, wp-content, and wp-includes.
As an Amazon Associate I earn from qualifying purchases.
Check the enabled virtual host and document root
List Apache’s loaded virtual hosts and inspect the configuration that answers your hostname:
sudo apache2ctl -S
sudo apache2ctl configtestThe first command shows which virtual host Apache selects for each address and port. The second must return Syntax OK before you reload anything. Open the selected configuration and verify its DocumentRoot, ServerName, and any aliases match the final domain and WordPress directory.
Enable the site and URL rewriting
If you created a site file such as /etc/apache2/sites-available/example.com.conf, enable it and the rewrite module. Replace the file name with your own configuration:
sudo a2ensite example.com.conf
sudo a2enmod rewrite
sudo a2dissite 000-default.conf
sudo apache2ctl configtest
sudo systemctl reload apache2Disabling the default site prevents Apache from answering with its generic page when the host header does not match as expected. On a server hosting several domains, disable or replace only the default configuration after confirming that every required site has its own virtual host.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Confirm directory overrides are allowed
Pretty permalinks normally need WordPress rules in .htaccess. The directory block for the document root must permit the required overrides (commonly AllowOverride All or a narrower policy that permits the rewrite directives). Do not broaden permissions globally without understanding the security impact. After changing the Apache configuration, run apache2ctl configtest and reload Apache again.
Load the domain in a private browser window and confirm that it shows your WordPress site rather than the Apache default page, a different virtual host, or a directory listing.
2. Finish the browser installer with separate credentials
Open the installation URL and complete the WordPress setup screen using the site’s final public name, hostname, administrator email address, and a newly generated administrator password. WordPress credentials must not be reused for MySQL, Ubuntu, or an SSH account.
Choose an administrator identity that is not predictable
Do not use admin, the domain name, a company name, or a publicly known personal name as the administrator username. Create a distinct account name and store its unique password in a password manager. If the installer already created a predictable account, create a new administrator, test it, and remove or demote the old account after confirming that no content or scheduled task still depends on it.
Keep database and shell access separate
The database user in wp-config.php, the Ubuntu user that owns deployment files, and the WordPress administrator are different security identities. Give each only the access it needs. A database password should never be used as an SSH password, and an operating-system password should never be placed in a WordPress login field.
3. Patch Ubuntu, WordPress, plugins, and themes before adding features
Updates belong to the initial setup, not a later maintenance task. Vulnerability details for older WordPress versions become public, so leaving core or extensions unpatched increases exposure even when the site has little traffic.
Apply supported Ubuntu updates
Use the normal update process for your supported Ubuntu release, with a maintenance window if the server is already serving another site:
sudo apt update
sudo apt upgradeRead the proposed changes, especially kernel, Apache, PHP, and database packages. Reboot when Ubuntu reports that a reboot is required, then verify the services:
systemctl --failed
sudo systemctl status apache2Ubuntu documents unattended-upgrades for automatic security updates on supported releases. Automatic patching reduces the time a known security fix remains unapplied, while manual updates provide more change control. Whichever approach you choose, keep a rollback or recovery path and review failures rather than assuming a scheduled job succeeded.
Update WordPress from the Dashboard
Sign in and open Dashboard → Updates. Update WordPress core, then plugins and themes, checking the site after each meaningful group of changes. Remove inactive extensions that you do not intend to use; an unused plugin still creates maintenance and vulnerability exposure if it remains installed.
Take the first complete backup before a major update, and do not update several unrelated components at once when you are diagnosing an existing problem. If an update fails, record the error, restore the known-good backup if necessary, and investigate compatibility before trying again.
4. Harden administrator access
After choosing a non-obvious username and unique password, review every account under Users → All Users. Remove abandoned accounts, lower privileges that are no longer needed, and verify that each administrator has a current email address for recovery.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
Use two-step authentication
Enable two-step authentication for administrator accounts when your chosen security solution supports it. Store the recovery codes offline in a protected location. Test a complete sign-in and recovery path before enforcing a policy that could lock out every administrator.
Protect the recovery channel
The email account attached to a WordPress administrator can reset the site password, so protect that mailbox with a unique password and two-step authentication as well. Keep at least two trusted administrators only when the site genuinely needs them; extra privileged accounts expand the number of identities that must be monitored.
5. Put the public hostname on HTTPS
Install a valid TLS certificate for the real public hostname at the web-server layer before opening the site to visitors. WordPress’s Hosting Handbook strongly recommends HTTPS because it protects both WordPress logins and site visitors.
Configure the certificate and redirect
Complete the certificate installation in Apache, enable the HTTPS virtual host, and configure an HTTP-to-HTTPS redirect for the same hostname. Keep the certificate’s renewal method documented and verify that renewal can reload Apache without breaking the site. Do not redirect an unrelated hostname or an internal address to the public site.
Recommended Free Tools
Change WordPress’s URL fields deliberately
In the dashboard, open Settings → General and inspect both WordPress Address (URL) and Site Address (URL). For a normal single-site installation, both should use the final HTTPS domain consistently, with no accidental trailing path or mixed http value. These fields are distinct because special deployments can place the WordPress files at a different address from the public site.
Back up before changing either field. A URL change can require corresponding Apache and .htaccess work, and an incorrect value can make the dashboard appear inaccessible. After saving, test the home page, an administrator login, a logout, and an internal link in a private browser window. Check the browser for certificate errors and mixed-content warnings rather than assuming the padlock proves every asset uses HTTPS.
6. Select and test a permanent permalink structure
Permalinks are the permanent URLs for posts and pages, so choose a readable structure before publishing links that others may bookmark. Go to Settings → Permalinks, select the structure that fits the site, and click Save Changes even if you did not alter the visible selection.
Choose for stability, not fashion
| Choice | When it fits | Main consideration |
|---|---|---|
| Post name | Most new editorial and personal sites | Readable URLs, but changing a post slug later requires redirects to preserve existing links. |
| Date-based structure | Archives where publication date is part of the identity | Longer URLs and a stronger commitment to the original publication date. |
| Existing custom structure | Migrations or sites with an established link format | Changing it can break search, social, and referral links unless redirects are planned. |
The table describes practical trade-offs, not a universal ranking. If this is a migration, preserve the established format unless you have a tested redirect plan.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Handle a non-writable .htaccess
After saving, WordPress may display rewrite rules that it could not write automatically. Copy those exact rules into the .htaccess file in the WordPress document root using an administrator method on the server, then save and test again. Do not paste rules into an unrelated directory, and do not make the entire filesystem writable merely to silence the warning.
Open a post or page with a pretty URL in a private browser window. A 404 usually means the rewrite module, virtual-host override policy, or .htaccess placement is wrong; return to the Apache checks instead of switching back to plain query-string URLs as a permanent fix.
7. Review ownership and file permissions
Permissions must match how the site is administered. There is no single safe ownership command for every Ubuntu installation. The Ubuntu tutorial warns that making every file owned by www-data can be insecure on a multi-site server.
Single-site versus multi-site isolation
| Arrangement | Benefit | Risk or cost |
|---|---|---|
| One deployment user and the web-server group | Simpler updates and troubleshooting on a dedicated, single-site server | A mistake can expose more of the installation; web-server write access must remain limited. |
| Per-site Unix users and separated directories | Better isolation when several sites share one Ubuntu host | More setup, ownership rules, deployment documentation, and monitoring. |
Inspect the path from the filesystem root to the document root with namei -l /var/www/example.com, then inspect the files that matter most. The web server needs to read the site, WordPress may need controlled write access for uploads or updates, and administrators need a reliable way to deploy changes. Keep wp-config.php more restrictive than ordinary public files, and give .htaccess only the permissions required for your chosen update workflow.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Do not copy a permissions recipe from a different hosting model without checking which Unix user performs updates and which user runs Apache. After every ownership change, verify that the front end, media upload, dashboard update screen, and backup job still work.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.8. Create a backup you can actually restore
A WordPress backup is complete only when it contains both the database and the files. The database holds posts, settings, users, and metadata; the files include WordPress core, wp-content/uploads, themes, plugins, and configuration such as wp-config.php.
Best Value
Choose storage and operating responsibility
| Approach | Strength | Responsibility |
|---|---|---|
| Local, administrator-managed copies | Direct control and no dependency on a third-party dashboard | You must provide off-site copies, retention, monitoring, encryption, and restore testing. |
| Managed backup service | Automated scheduling, off-site retention, and possible restore assistance | Verify geography, retention, access controls, export capability, and the service’s actual restore process. |
Keep at least one copy outside the Ubuntu host. Protect backups from the same credentials used by the live site, and document who can retrieve them.
Perform a first restore test
- Record the backup timestamp and the WordPress, plugin, theme, PHP, database, and Ubuntu versions involved.
- Restore the database and files into an isolated staging location, never over the only production copy.
- Confirm that the restored site can load, authenticate, display an uploaded image, open a pretty permalink, and read its configuration without pointing visitors at the staging host.
- Record what worked, what manual steps were required, and when the first successful restore was completed.
A backup that has never been restored is an unverified hope rather than a recovery plan. Repeat the restore test after changing the backup method or making a major architectural change.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems9. Run an acceptance test before announcing the site
Use a private browser session and a second device or network when possible. Work through this list in order:
- Open the canonical HTTPS home page and confirm the certificate hostname is correct.
- Log in with the new administrator account, visit the dashboard, and log out.
- Create a draft post or page without publishing it.
- Upload an image, insert it into the draft, save, and view the resulting media URL.
- Open the draft preview or a published test page using its pretty permalink.
- Follow internal navigation and confirm that no link switches back to HTTP or an unintended hostname.
- Submit the contact form or comment workflow if the site enables one, then verify delivery, moderation, and spam handling.
- Check the dashboard’s update screen and confirm that no required component is silently failing.
- Verify that the backup job completed and that the restore procedure is documented with an owner and location.
Delete test content only after you have verified the workflows it was created to exercise. Keep any required legal, privacy, cookie, or accessibility pages appropriate to your audience before public launch; those requirements depend on the site’s jurisdiction and features.
10. Decide which operating model fits your server
Apache or another web server
Stay with Apache when it is already integrated with the Ubuntu stack, your team understands its virtual-host and rewrite configuration, and the current PHP setup is working. A different web server can be appropriate for a deliberate architecture change, but migrating introduces new configuration, rewrite, logging, TLS, and PHP-process assumptions. Do not switch servers as a “fix” for a fresh-install problem until the current virtual host and permissions have been verified.
Automatic or manual updates
Automatic security updates favor rapid response and less routine work. Manual updates favor review, maintenance windows, and tightly controlled rollback. A small personal site may accept automation with tested backups; a site with custom code or strict change control may require review. In either case, monitor failures and keep the restore path usable.
One Unix user or per-site users
One user is easier on a dedicated host. Per-site users are safer when unrelated sites share a server because a compromise or ownership mistake is less likely to cross site boundaries. The additional setup is justified when the host has multiple owners, applications, or trust levels.
11. Keep the site ready after launch
After the first successful launch, retain a short operational record containing the domain and document root, virtual-host file name, Unix and database identities, certificate renewal method, WordPress administrator owners, backup location, last restore-test date, and the procedure for recovering access. Store secrets in a password manager rather than in that document.
Review updates, failed backup jobs, certificate renewal, disk space, and administrator accounts on a regular schedule. Re-run the acceptance checks after changing the domain, permalink structure, PHP version, web server, backup system, or a security-sensitive plugin. Those changes can invalidate assumptions that were correct on installation day.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
