WordPress VPS

Who it suits

Blogs, small business sites and shops where you want full control of plugins, PHP settings and the server, and are happy to keep it all updated. It isn't managed WordPress: there's no staging site, page cache or malware scanning unless you add them.

Which plan

Budget (2 GB) runs a typical WordPress site comfortably. Choose Standard (4 GB) for WooCommerce, heavy page builders, or several sites on one server.

What we install

The latest WordPress from wordpress.org with its own MariaDB database and user, served by nginx and PHP-FPM. The database password is in /root/wordpress-db.txt, and the installer page asks for a one-time login kept in /root/wordpress-install.txt.

From order to ready

1. Server ready. We email you when the server is running, and you can log in with SSH. The installer starts on that same first boot.
2. Installer running. It logs to /var/log/vps9-setup.log; tail -f it to watch.
3. Application ready. This can be minutes after SSH works. The installer writes its exit code to /var/lib/vps9-setup.exit; a value of 0 means installation succeeded. WordPress is ready when http://<your IPv4>/ asks for the installer login. The site itself doesn't exist until you finish the installer.

What you still do

1. Over SSH, run cat /root/wordpress-install.txt: it holds the login that guards the WordPress installer.
2. Open http://<your IPv4>/, enter that login, and finish the install with a site title, an admin username that isn't admin, and a strong password.
3. Point your domain at the server and change both addresses in Settings -> General to it.
4. Run certbot --nginx -d example.com for HTTPS.

Exposure and security

Ports 80 and 443 are open for nginx. WordPress's installer normally lets the first visitor create the admin account; here it sits behind an HTTP login whose password is only in /root/wordpress-install.txt. Until you add HTTPS, that login and your admin password cross the network unencrypted, so do the domain and Certbot steps soon after. MariaDB listens on localhost only.

Backups and upgrades

WordPress installs minor core updates itself; plugins, themes and major versions are yours to update, and outdated plugins are the usual way in. We turn on unattended-upgrades for Ubuntu's or Debian's security fixes, once a day, and PHP-FPM restarts when one replaces PHP; the server never reboots by itself, so reboot after kernel updates, and run apt upgrade for everything else. rack4.io/help/php2shell-check-and-patch-php shows how to check PHP is patched. Back up the database and wp-content nightly and copy them off the server. We run the hardware, the network and the first-boot install; after that, WordPress is yours to run, and we don't manage or update it for you. Off-site backups of the whole disk are an optional paid add-on; they copy the disk as it is at one moment, so keep the app's own backups as well.