Web
Difficulty: Beginner
4 min read

WordPress: Build a Website with the CMS

Tutorial to install and configure WordPress, the most popular content management system (CMS), on a Linux server (LAMP/LEMP).

Back to tutorials
What is WordPress?
WordPress is an open-source content management system (CMS) that powers more than 40% of the web. It lets you easily build websites, blogs or complex applications thanks to a massive ecosystem of themes and plugins.

Why use WordPress?

  • Ease of use: Its admin interface is famous for its simplicity.
  • Flexibility: Thousands of themes and plugins let you adapt it to almost any need (blog, e-commerce, portfolio, brochure site, etc.).
  • Large community: You will find help and resources everywhere on the internet.
  • SEO-friendly: Many tools exist to help with your site's search engine optimization.

Prerequisites: The LAMP or LEMP stack

WordPress needs a server environment to run. The two most common setups are:

  • LAMP: Linux, Apache (web server), MySQL/MariaDB (database), PHP (scripting language).
  • LEMP: Linux, ENGINX (Nginx, web server), MySQL/MariaDB, PHP.

This guide assumes you already have a server with one of these stacks up and running.

Installation

Step 1: Create a database and a user

WordPress stores all of its content in a MySQL or MariaDB database.

-- Connect to the MySQL/MariaDB shell
sudo mysql -u root -p

-- Create a database for WordPress
CREATE DATABASE wordpress_db DEFAULT CHARACTER SET utf8 COLLATE utf8_unicode_ci;

-- Create a dedicated user and grant it privileges on this database
CREATE USER 'wp_user'@'localhost' IDENTIFIED BY 'a_strong_password';
GRANT ALL ON wordpress_db.* TO 'wp_user'@'localhost';

-- Apply the changes
FLUSH PRIVILEGES;

-- Quit
EXIT;

Step 2: Download and extract WordPress

Go to your web server's root directory (e.g. `/var/www/html/`) and download the latest version of WordPress.

cd /var/www/html/
sudo wget https://wordpress.org/latest.tar.gz
sudo tar -xzvf latest.tar.gz
# The files will be in a "wordpress" folder. We can move them if needed.
sudo mv wordpress/* .
sudo rm -rf wordpress latest.tar.gz

Step 3: Set the permissions

The web server (usually the `www-data` user) must be able to write to these files for updates and uploads.

sudo chown -R www-data:www-data /var/www/html
sudo find /var/www/html -type d -exec chmod 755 {} \;
sudo find /var/www/html -type f -exec chmod 644 {} \;

Step 4: Configure `wp-config.php`

This is the file that connects WordPress to its database.

# Copy the example
sudo cp /var/www/html/wp-config-sample.php /var/www/html/wp-config.php
# Edit it
sudo nano /var/www/html/wp-config.php

Edit these lines with the details of the database you created in step 1:


define( 'DB_NAME', 'wordpress_db' );
define( 'DB_USER', 'wp_user' );
define( 'DB_PASSWORD', 'a_strong_password' );

It is also strongly recommended to fill in the unique security keys (SALT). You can generate a fresh set via the official WordPress API.

Step 5: The web installation wizard

Open your browser and go to your site's address. The WordPress installation wizard, famous for its simplicity, will greet you.

It will ask you for:

  • Your site title.
  • The administrator username (do NOT use "admin").
  • A strong password.
  • Your email address.

Click "Install WordPress" and you're done!

Your site is live!
You can now log in to your WordPress dashboard via `http://your-domain.com/wp-admin`.

Next steps (Crucial)

  • Permalinks: Go to `Settings -> Permalinks` and choose "Post name". It's better for SEO.
  • Security: Install a security plugin such as Wordfence or iThemes Security.
  • Backups: Set up an automated backup solution (e.g. UpdraftPlus).
  • Caching: Install a caching plugin (e.g. W3 Total Cache or WP Super Cache) to improve performance.
  • HTTPS: Configure an SSL/TLS certificate (with Let's Encrypt) on your web server to switch your site to HTTPS.
WordPress security
WordPress's popularity makes it a target. Security is not optional. Always keep the WordPress core, your themes and your plugins up to date.

Conclusion

Installing WordPress is a quick process, but it's only the beginning. The real work of managing a WordPress site lies in its ongoing maintenance, hardening, and optimization. By following these first steps, you have a solid foundation to build your web project.

Written by

Morgann Riu

Cybersecurity and Linux administration expert. I share my knowledge through free tutorials and training to help system administrators and developers secure their infrastructures.

Frequently asked questions

WordPress cannot connect to the database, what should I check first?
The three values in wp-config.php must match exactly what you created: DB_NAME is wordpress_db, DB_USER is wp_user, and the password is the one given in the CREATE USER statement. Then confirm the user was declared with the @localhost host, that it holds privileges through GRANT ALL ON wordpress_db.*, and that FLUSH PRIVILEGES was run. The decisive test is mysql -u wp_user -p wordpress_db from the server: if the manual connection works, the mistake is in wp-config.php, otherwise it is on the SQL privileges side.
Why does WordPress ask me for FTP credentials to install a plugin or an update?
Because the PHP process cannot write to the installation directory, so WordPress falls back to its FTP method. The fix is to give ownership of the files to the web server user with sudo chown -R www-data:www-data /var/www/html, then restore 755 on directories and 644 on files. The same symptom shows up when uploading media from the library.
Are the SALT keys in <code>wp-config.php</code> really necessary?
Yes. They are what secures the site's authentication cookies, and leaving the sample values from wp-config-sample.php amounts to using publicly known secrets. Generate a full set at https://api.wordpress.org/secret-key/1.1/salt/ and replace the matching block. Useful side effect: regenerating those keys invalidates every open session, which is the first thing to do after a suspected compromise.
Why should the administrator account not be called "admin"?
Because it is the first username tried by the brute-force bots that constantly sweep /wp-admin pages: with a predictable name, the attacker only has one secret left to guess instead of two. Pick a non-obvious username and a strong password right in the installation wizard, since changing it afterwards is considerably more painful. Back it up with a security plugin such as Wordfence or iThemes Security to throttle attempts.
What should I do right after clicking "Install WordPress" so the site is not left fragile?
Five actions, in this order. Settings then Permalinks set to "Post name" for clean, readable URLs. A Let's Encrypt certificate on the web server to move the site to HTTPS. A security plugin (Wordfence or iThemes Security). An automated backup such as UpdraftPlus, tested at least once by actually restoring it. A caching plugin (W3 Total Cache or WP Super Cache) to absorb traffic. And on an ongoing basis, keep the core, themes and plugins updated, because that is what closes the vast majority of the doors.

Share this tutorial

Did you enjoy this article?

Comments

Checklist Sécurité Linux

30 points essentiels pour sécuriser un serveur Linux. Recevez aussi les nouveaux tutoriels par email.

Pas de spam. Désabonnement en 1 clic.