How to Install WordPress on Ubuntu 24.04 with NGINX, MariaDB, PHP 8.3, and SSL

This tutorial shows you how to install WordPress on Ubuntu 24.04 LTS with NGINX, MariaDB, PHP 8.3, and a free Let’s Encrypt SSL certificate. The commands are intended for a new VPS and use the packages included with Ubuntu 24.04.

What you will have at the end: a working WordPress website at https://example.com, an HTTP-to-HTTPS redirect, automatic SSL renewal, sensible file permissions, and an NGINX configuration that supports WordPress permalinks.

Requirements

Before starting, you need:

• An Ubuntu 24.04 LTS VPS with a public IPv4 or IPv6 address
• A non-root user with sudo access
• A registered domain name
• SSH access to the server
• Inbound TCP ports 80 and 443 allowed by your VPS provider’s firewall

WordPress currently recommends PHP 8.3 or newer, MariaDB 10.11 or newer (or MySQL 8.0 or newer), NGINX or Apache, and HTTPS. Ubuntu 24.04 provides a suitable PHP 8.3 and MariaDB 10.11 base through its standard repositories. You can check the current recommendations on the official WordPress requirements page.

Connect to your server, replacing the username and address with your own:

ssh your_user@your_server_ipCopy

All examples below use example.com. Replace it with your actual domain in every command and configuration block.

Step 1: Point the domain to your VPS

Open the DNS manager at your domain registrar or DNS provider and create these records:

Type	Name	Value
A	@	Your server’s IPv4 address
A	www	Your server’s IPv4 address

If the server uses IPv6, add equivalent AAAA records. Do not create an IPv6 record unless IPv6 is configured and reachable on the VPS.

Check the records from your computer or server:

dig +short example.com
dig +short www.example.comCopy

Both results should show your server’s public address. DNS changes can take time to propagate, so wait until the records resolve correctly before requesting the SSL certificate.

Cloudflare users: if certificate validation fails, temporarily set the records to DNS only, obtain the certificate, and then enable the proxy again. Also make sure Cloudflare SSL/TLS mode is set to Full (strict) after the origin certificate is active.

Step 2: Update Ubuntu and configure the firewall

Refresh the package index and install available updates:

sudo apt update
sudo apt upgrade -yCopy

If the upgrade installs a new kernel, you can finish this guide first and reboot during a maintenance window. Check whether a reboot is requested with:

test -f /var/run/reboot-required && cat /var/run/reboot-requiredCopy

Install UFW if it is not already present:

sudo apt install ufw -yCopy

Allow SSH before enabling the firewall. This step is important because enabling UFW without an SSH rule can lock you out of the server.

sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'
sudo ufw enable
sudo ufw statusCopy

The Nginx Full profile permits HTTP on port 80 and HTTPS on port 443.

Step 3: Install NGINX, MariaDB, and PHP 8.3

Install the web server, database server, PHP-FPM, and the PHP extensions commonly required by WordPress and popular plugins:

sudo apt install -y nginx mariadb-server \
php-fpm php-mysql php-curl php-gd php-intl \
php-mbstring php-soap php-xml php-zip php-imagick \
curlCopy

Enable the services now and at boot:

sudo systemctl enable --now nginx mariadb php8.3-fpmCopy

Confirm that all three services are running:

systemctl is-active nginx
systemctl is-active mariadb
systemctl is-active php8.3-fpmCopy

Each command should return active. You can also verify the installed versions:

nginx -v
php -v
mariadb --versionCopy

If you want a deeper explanation of the web stack, see our existing guide to installing an NGINX, PHP, and MySQL LEMP stack. That article targets Ubuntu 20.04, so use the commands on this page for Ubuntu 24.04.

Secure the MariaDB installation

Run MariaDB’s interactive security script:

sudo mariadb-secure-installationCopy

On Ubuntu, the MariaDB administrative account normally uses Unix socket authentication. Read each prompt rather than entering Y blindly. For a new standalone VPS, it is generally appropriate to remove anonymous users, prevent remote root login, remove the test database, and reload the privilege tables.

Step 4: Create a database and user for WordPress

Generate a strong database password and copy it to a password manager:

openssl rand -base64 24Copy

Open the MariaDB console:

sudo mariadbCopy

Run the following SQL statements. Replace PASTE_A_STRONG_PASSWORD_HERE with the password you just generated.

CREATE DATABASE wordpress CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'wordpressuser'@'localhost' IDENTIFIED BY 'PASTE_A_STRONG_PASSWORD_HERE';
GRANT ALL PRIVILEGES ON wordpress.* TO 'wordpressuser'@'localhost';
FLUSH PRIVILEGES;
EXIT;Copy

WordPress now has access only to its own database. Do not use the MariaDB root account in WordPress.

You will need these values during the browser-based installer:

• Database name: wordpress
• Database username: wordpressuser
• Database password: the password you generated
• Database host: localhost

Step 5: Download WordPress and set file permissions

Move to a temporary directory and download the latest WordPress release from the official website:

cd /tmp
curl -O https://wordpress.org/latest.tar.gz
tar -xzf latest.tar.gzCopy

Create the document root and copy the WordPress files into it:

sudo mkdir -p /var/www/example.com
sudo cp -a /tmp/wordpress/. /var/www/example.com/Copy

Give the NGINX/PHP user ownership and apply standard permissions:

sudo chown -R www-data:www-data /var/www/example.com
sudo find /var/www/example.com -type d -exec chmod 755 {} \;
sudo find /var/www/example.com -type f -exec chmod 644 {} \;Copy

These permissions allow WordPress to manage updates and media while preventing files from being executable merely because they are writable. Later, after WordPress creates wp-config.php, we will restrict that file further.

Step 6: Configure NGINX for WordPress

Create a new NGINX server block:

sudo nano /etc/nginx/sites-available/example.comCopy

Paste this configuration, replacing both occurrences of example.com:

server {
    listen 80;
    listen [::]:80;

    server_name example.com www.example.com;
    root /var/www/example.com;
    index index.php index.html;

    access_log /var/log/nginx/example.com.access.log;
    error_log /var/log/nginx/example.com.error.log;

    client_max_body_size 64M;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
    }

    location ~* /(?:uploads|files)/.*\.php$ {
        deny all;
    }

    location ~ /\.(?!well-known).* {
        deny all;
    }
}Copy

The try_files directive sends requests that do not match a real file or directory to index.php. This is what makes WordPress “pretty” permalinks work with NGINX.

The second security location prevents PHP execution inside WordPress upload directories. The final location blocks access to hidden files while leaving /.well-known/ available for Let’s Encrypt validation.

Save the file in Nano with Ctrl+O, press Enter, and exit with Ctrl+X.

Enable the new site:

sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/example.comCopy

If this is a new VPS and you do not need the default NGINX page, remove only its enabled symlink:

sudo unlink /etc/nginx/sites-enabled/defaultCopy

Always test the configuration before reloading NGINX:

sudo nginx -t
sudo systemctl reload nginxCopy

Do not reload if nginx -t reports an error. Correct the indicated file and line first.

Open http://example.com in your browser. You should see the WordPress setup page. Do not complete it yet—we will enable HTTPS first so your database and administrator details are not submitted over an unencrypted connection.

Step 7: Install a free Let’s Encrypt SSL certificate

Install Certbot and its NGINX plugin from Ubuntu’s repository:

sudo apt install -y certbot python3-certbot-nginxCopy

Request a certificate for the root domain and www hostname:

sudo certbot --nginx -d example.com -d www.example.com --redirectCopy

Enter your email address, accept the terms, and let Certbot update the NGINX configuration. The --redirect option redirects visitors from HTTP to HTTPS.

Let’s Encrypt’s HTTP validation requires the domain to resolve to this server and port 80 to be reachable from the internet. The Let’s Encrypt documentation recommends keeping port 80 open and redirecting it to HTTPS.

Test automatic renewal:

sudo certbot renew --dry-runCopy

You can inspect the renewal timer with:

systemctl list-timers | grep certbotCopy

Certbot installations normally configure automated renewal. The dry run confirms that a future renewal can complete without changing your live certificate.

Step 8: Complete the WordPress installer over HTTPS

Visit:

https://example.comCopy

Select your language and enter the database information created earlier:

WordPress field	Value
Database Name	wordpress
Username	wordpressuser
Password	Your generated database password
Database Host	localhost
Table Prefix	wp_, or another short prefix

When WordPress asks for the site administrator:

• Do not use admin as the username.
• Use a long, unique password stored in a password manager.
• Use an email account you actively monitor.
• Leave search-engine indexing disabled until the site has real content and is ready for visitors.

After installation, sign in at:

https://example.com/wp-admin/Copy

In WordPress, open Settings → Permalinks, choose the structure you want—Post name is common for content sites—and save it. No .htaccess file is required because NGINX uses the try_files rule configured above.

Step 9: Apply basic WordPress security hardening

A new installation should be secured before you add many plugins or expose it to regular traffic.

Protect wp-config.php

Restrict the configuration file after the installer creates it:

sudo chmod 640 /var/www/example.com/wp-config.phpCopy

Disable the built-in theme and plugin editors

Open the configuration file:

sudo nano /var/www/example.com/wp-config.phpCopy

Add this line above the comment that says That's all, stop editing!:

define('DISALLOW_FILE_EDIT', true);Copy

This prevents an administrator account—or an attacker using a stolen administrator session—from editing plugin and theme PHP files in the WordPress dashboard.

Keep WordPress and the server updated

Install Ubuntu security updates regularly:

sudo apt update
sudo apt upgradeCopy

In WordPress, keep the core, themes, and plugins current. Remove plugins and themes you do not use rather than merely deactivating them.

Use backups that leave the server

Back up both /var/www/example.com and the MariaDB database. Store at least one copy outside the VPS and test a restoration before you need it. A backup that has never been restored is only an assumption.

Add two-factor authentication

Enable two-factor authentication for every administrator account. Use the fewest administrator accounts necessary, and give editors or authors only the permissions their work requires.

The official WordPress hardening guide explains additional controls, including backups, permissions, database security, monitoring, and protection of sensitive files. You can also strengthen the web layer with our guide to HTTP security headers on NGINX.

Optional: Increase the WordPress upload limit

The NGINX configuration above permits requests up to 64 MB, but PHP has separate limits. Check the active values:

php -i | grep -E 'upload_max_filesize|post_max_size'Copy

Edit the PHP-FPM configuration:

sudo nano /etc/php/8.3/fpm/php.iniCopy

Find and adjust these directives:

upload_max_filesize = 64M
post_max_size = 64M
memory_limit = 256M
max_execution_time = 120Copy

Then restart PHP-FPM:

sudo systemctl restart php8.3-fpmCopy

The effective upload limit is the smallest limit enforced by WordPress, PHP, NGINX, or any proxy/CDN in front of the server.

Common WordPress installation problems

502 Bad Gateway

A 502 error usually means NGINX cannot reach PHP-FPM. Check the service and available socket:

sudo systemctl status php8.3-fpm
ls -l /run/php/Copy

If the installed PHP version differs, update fastcgi_pass in the NGINX server block to match the actual socket, test with sudo nginx -t, and reload NGINX.

Error establishing a database connection

Verify that MariaDB is running:

sudo systemctl status mariadbCopy

Test the WordPress account directly:

mariadb -u wordpressuser -p wordpressCopy

If login fails, check the database name, username, password, and host. The database host should be localhost for the setup in this guide.

WordPress permalinks return 404

Confirm that the NGINX location / block contains:

try_files $uri $uri/ /index.php?$args;Copy

Test and reload after making changes:

sudo nginx -t
sudo systemctl reload nginxCopy

Certbot cannot validate the domain

Confirm all of the following:

• The domain’s A/AAAA records point to this VPS.
• Port 80 is allowed in UFW and the hosting provider’s external firewall.
• NGINX is running and the site opens over plain HTTP.
• An incorrect IPv6 record is not sending validation to another server.
• A CDN proxy is not interfering with the validation request.

Uploaded files are rejected or time out

Make sure client_max_body_size in NGINX is at least as large as PHP’s upload_max_filesize and post_max_size. Restart PHP-FPM and reload NGINX after changing their configurations.

403 Forbidden or files cannot be written

Restore ownership and standard permissions:

sudo chown -R www-data:www-data /var/www/example.com
sudo find /var/www/example.com -type d -exec chmod 755 {} \;
sudo find /var/www/example.com -type f -exec chmod 644 {} \;
sudo chmod 640 /var/www/example.com/wp-config.phpCopy

For a more general diagnostic process, follow our complete guide to troubleshooting a broken website.

Conclusion

You now have WordPress running on Ubuntu 24.04 with NGINX, MariaDB, PHP 8.3, and HTTPS. You also configured WordPress permalinks, automatic certificate renewal, firewall access, safer file permissions, and several basic hardening measures.

The next useful steps are to configure reliable off-server backups, add page caching, connect a CDN if your visitors are geographically distributed, and monitor uptime and server resources. Before making performance changes, establish a baseline; our guide to optimizing NGINX for high-traffic websites explains the main settings and tradeoffs.