Host WordPress on a Linux VPS: complete guide (2026)

Prerequisites

Before starting, the following must already be in place on your VPS:

• Nginx and PHP 8.4-FPM installed → Nginx + PHP-FPM guide
• UFW firewall configured (ports 80 and 443 open) → UFW guide
• SSH access secured with a key → SSH key guide
• A domain name pointing to the VPS IP address (A record configured)

PHP extensions required by WordPress (source: wordpress.org/about/requirements/): make sure they are installed:

• php8.4-mysql, php8.4-curl, php8.4-gd, php8.4-mbstring, php8.4-xml, php8.4-zip, php8.4-intl, php8.4-opcache

If these extensions are missing, add them:

sudo apt install -y php8.4-mysql php8.4-curl php8.4-gd php8.4-mbstring php8.4-xml php8.4-zip php8.4-intl php8.4-opcache

Nginx and PHP-FPM are not set up yet? First follow our guide install Nginx and PHP-FPM on a Linux VPS. And for secure access from the start, set up an SSH key.

Step 1 - Create the dedicated MariaDB database

WordPress requires a dedicated database and user. Never use root for application connections.

Connect to MariaDB:

sudo mariadb -u root

Create the database, the user and the privileges (replace the placeholder values):

CREATE DATABASE wordpress_db CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'wordpress_user'@'localhost' IDENTIFIED BY 'strong_password';
GRANT ALL PRIVILEGES ON wordpress_db.* TO 'wordpress_user'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Note: utf8mb4 is the character set recommended by WordPress for full support of emojis and Unicode characters (source: developer.wordpress.org/advanced-administration/before-install/howto-install/).

Step 2 - Install WP-CLI

WP-CLI is the official command-line tool for WordPress. It lets you install, configure and maintain WordPress without a graphical interface.

curl -O https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
chmod +x wp-cli.phar
sudo mv wp-cli.phar /usr/local/bin/wp

Verify the installation:

wp --info

Source: wp-cli.org/docs/installing/

Step 3 - Download and configure WordPress

Download WordPress

sudo mkdir -p /var/www/example.com
sudo chown -R www-data:www-data /var/www/example.com
cd /var/www/example.com
sudo -u www-data wp core download --locale=en_US

Create wp-config.php

sudo -u www-data wp config create \
  --dbname=wordpress_db \
  --dbuser=wordpress_user \
  --dbpass=strong_password \
  --dbhost=localhost \
  --dbcharset=utf8mb4 \
  --locale=en_US

Run the WordPress installation

sudo -u www-data wp core install \
  --url=https://example.com \
  --title="My site" \
  --admin_user=admin \
  --admin_password=admin_strong_password \
  [email protected]

Note: replace all the quoted values with your own. Use a strong admin password (16 characters minimum, uppercase letters, digits, symbols).

Step 4 - Configure the Nginx vhost for WordPress

The Nginx configuration for WordPress requires specific directives for permalinks and security. Create a dedicated configuration file:

sudo nano /etc/nginx/sites-available/example.com

File contents (replace example.com with your domain):

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    root /var/www/example.com;
    index index.php;

    # Maximum upload size (keep aligned with PHP)
    client_max_body_size 64M;

    # WordPress permalinks
    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    # PHP processing via PHP-FPM
    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.4-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }

    # Block access to sensitive files
    location ~ /\.(ht|git|env) {
        deny all;
    }

    # Block direct access to xmlrpc.php if unused
    location = /xmlrpc.php {
        deny all;
    }

    # Browser cache for static assets
    location ~* \.(css|js|jpg|jpeg|png|gif|ico|svg|woff|woff2)$ {
        expires 30d;
        add_header Cache-Control "public, no-transform";
    }
}

Enable the site and reload Nginx:

sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

Note: the try_files $uri $uri/ /index.php?$args; directive is essential for WordPress permalinks to work correctly (source: nginx.org/en/docs/http/ngx_http_core_module.html).

Step 5 - Enable HTTPS with Certbot

Certbot's advanced options (renewal, wildcard, Apache) are covered in detail in our dedicated Certbot guide.

The SSL certificate is essential. Follow our dedicated guide to obtain it and renew it automatically.

Once the certificate is issued, Certbot automatically updates the vhost to redirect HTTP to HTTPS and adds the SSL directives.

Step 6 - PHP optimizations for WordPress

OPcache

OPcache caches compiled PHP bytecode, reducing the processing time of every request. Check that it is enabled in /etc/php/8.4/fpm/conf.d/10-opcache.ini:

opcache.enable=1
opcache.memory_consumption=128
opcache.interned_strings_buffer=8
opcache.max_accelerated_files=4000
opcache.revalidate_freq=2
opcache.fast_shutdown=1

These values are suited to a VPS with 4 GB of RAM. Source: php.net/manual/en/opcache.configuration.php.

Maximum upload size

Align the PHP upload limit with the Nginx client_max_body_size directive:

sudo nano /etc/php/8.4/fpm/php.ini

Edit or add:

upload_max_filesize = 64M
post_max_size = 64M
max_execution_time = 120

Restart PHP-FPM:

sudo systemctl restart php8.4-fpm

Step 7 - Secure wp-admin

In addition, lock down the server itself: UFW firewall and Fail2ban against brute-force attacks.

Restrict wp-admin by IP (optional but recommended)

If you access the admin area from a fixed IP address, restrict access in the Nginx vhost:

location /wp-admin {
    allow 203.0.113.10;  # Replace with your IP
    deny all;
}

Protect wp-login.php against brute-force attacks

Add this to the Nginx vhost to rate-limit login attempts:

location = /wp-login.php {
    limit_req zone=login burst=3 nodelay;
    include snippets/fastcgi-php.conf;
    fastcgi_pass unix:/run/php/php8.4-fpm.sock;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    include fastcgi_params;
}

Declare the rate-limiting zone in the http block of /etc/nginx/nginx.conf:

http {
    limit_req_zone $binary_remote_addr zone=login:10m rate=1r/m;
    ...
}

Fail2ban for WordPress

For additional protection against repeated login attempts, configure Fail2ban with a WordPress filter: see the Fail2ban guide.

Which VPS configuration for WordPress?

Estimated monthly traffic	Recommended RAM	OuiHeberg plan
Up to 10,000 visits	4 GB	VPS Linux 04G - €7.00 incl. VAT/month
10,000 to 50,000 visits	8 GB	See the Linux VPS range
More than 50,000 visits	16 GB+	See the Linux VPS range

These estimates assume a standard WordPress site with caching enabled (WP Super Cache or W3 Total Cache). A WooCommerce site or a site with heavy concurrent traffic needs more RAM.

Frequently asked questions

Can you host several WordPress sites on a single VPS?

Yes. Create a separate Nginx vhost and a dedicated MariaDB database for each site. Each site then has its own isolated space. The VPS RAM is the limiting factor: plan for roughly 256-512 MB per active WordPress site with OPcache.

Do you need a managed VPS for WordPress?

No. This guide covers installation on an unmanaged VPS with full root access. A managed VPS delegates system maintenance (OS updates, backups) but reduces control and increases cost. For most projects, an unmanaged VPS with good security practices (key-based SSH, UFW, Fail2ban) is enough.

Is WP-CLI required, or can WordPress be installed manually?

WP-CLI is optional. Manual installation consists of downloading the archive from wordpress.org/download/, extracting it into /var/www/example.com, then filling in wp-config.php by hand. WP-CLI automates these steps and makes future updates easier (wp core update).

How to update WordPress via WP-CLI?

cd /var/www/example.com
sudo -u www-data wp core update
sudo -u www-data wp plugin update --all
sudo -u www-data wp theme update --all

How to back up WordPress on a VPS?

Two things to back up: the files and the database.

# Database backup
sudo -u www-data wp db export /var/www/example.com/backup-$(date +%F).sql

# Files backup
tar -czf /root/backup-wordpress-$(date +%F).tar.gz /var/www/example.com

Automate this via cron or use the automatic backups included with your OuiHeberg VPS plan.

Is your WordPress site already running on shared hosting? The procedure for moving it to a VPS without downtime (rsync, database, DNS switch) is detailed in our migration guide.