How to Install WordPress on Ubuntu

What you are actually building

WordPress on a bare Ubuntu server is four pieces: a web server, a database, PHP, and the WordPress files. This page uses Apache because it is the default on Ubuntu and the module you need for permalinks is one command away. Every step ends with a check, so a failure is caught where it happens.

You need a server you control, either a VPS or a machine on your network, and a domain that points at it. If you would rather not touch a shell, managed WordPress hosting does all of this for you.

Install Apache, MySQL and PHP in one pass

Install the stack in a single apt command so the packages settle together, then restart Apache once so it loads the PHP module.

1. Update and install everything: sudo apt update && sudo apt install apache2 ghostscript libapache2-mod-php mysql-server php php-bcmath php-curl php-imagick php-intl php-json php-mbstring php-mysql php-xml php-zip.
2. Check the web server with systemctl status apache2 and load the server's IP in a browser. The default Apache page proves the port is open.
3. Check PHP with php -v, then confirm the Apache module with apache2ctl -M | grep php.
4. Start MySQL with sudo systemctl enable --now mysql and log in with sudo mysql. Ubuntu uses socket authentication for root, so no password is asked.

Those PHP extensions are not optional. Without php-mysql the wizard cannot reach the database, without php-gd or php-imagick image editing fails, and without php-zip plugin uploads fail with a vague error.

Create the database and a dedicated user

WordPress should never connect as root. Create one database and one user, then grant only that database. Run these inside the MySQL prompt.

• CREATE DATABASE wordpress CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci; matches what WordPress expects for emoji and non-Latin text.
• CREATE USER 'wpuser'@'localhost' IDENTIFIED BY 'a-long-random-password'; keeps the account local to this machine.
• GRANT ALL PRIVILEGES ON wordpress.* TO 'wpuser'@'localhost'; gives WordPress what it needs and nothing beyond that schema.
• FLUSH PRIVILEGES; then EXIT; applies the grant and leaves the prompt.

Test the account before you continue with mysql -u wpuser -p wordpress. It worked when the prompt changes and SHOW TABLES; returns an empty set rather than an access error.

Download WordPress into its own directory

Take the release from wordpress.org rather than the Ubuntu archive package, because upstream supports that route and plugin authors test against it. Keep the site in its own folder so the server root can hold more than one site later.

1. Create the folder: sudo mkdir -p /var/www/wordpress, then set ownership with sudo chown www-data:www-data /var/www/wordpress.
2. Download and extract as the web user: curl https://wordpress.org/latest.tar.gz | sudo -u www-data tar zx -C /var/www/wordpress --strip-components=1.
3. Confirm the files landed where Apache will look: ls /var/www/wordpress/wp-load.php should print the path with no error.

Avoid chmod -R 777 on the site folder, which some tutorials still suggest. It makes every file executable and world-writable, and it is the fastest way to turn a small plugin bug into a defaced site. Ownership by www-data plus 755 on folders and 644 on files is enough.

The Apache VirtualHost WordPress needs

WordPress permalinks need AllowOverride so its own .htaccess can rewrite URLs. Without that line, every page except the home page returns 404 after you change permalinks.

1. Create /etc/apache2/sites-available/wordpress.conf with a VirtualHost on port 80 whose DocumentRoot is /var/www/wordpress.
2. Inside a Directory block for that path, set AllowOverride All, DirectoryIndex index.php, and Require all granted.
3. Add ServerName example.com and an alias for www if you use one, so Apache answers for the domain rather than the first vhost.
4. Enable the site and the rewrite module: sudo a2ensite wordpress, sudo a2enmod rewrite, sudo a2dissite 000-default.
5. Test and reload: sudo apachectl configtest for Syntax OK, then sudo systemctl reload apache2.

You know this step worked when the domain serves a WordPress page rather than the Apache default page. A directory listing instead means the DirectoryIndex line is missing; a 403 means the folder permissions or the Directory block is wrong.

wp-config: database keys, salts, and permissions

The configuration file holds the database credentials and eight random keys. Copy the sample, edit the credentials, then replace the salt block with fresh values from the WordPress secret-key service.

1. Copy the sample as the web user: sudo -u www-data cp /var/www/wordpress/wp-config-sample.php /var/www/wordpress/wp-config.php.
2. Set DB_NAME, DB_USER, and DB_PASSWORD to the values created earlier, and leave DB_HOST as localhost.
3. Open https://api.wordpress.org/secret-key/1.1/salt/ and replace the eight placeholder key lines with what it returns. These change on every load, so paste a fresh set once.
4. Set the file to 640 and keep it owned by www-data: sudo chmod 640 wp-config.php.

Those keys encrypt login cookies. A site that keeps the placeholder text from the sample file can have sessions forged, which is why the salt step is not cosmetic. Keep a copy of wp-config.php somewhere safe, since it is excluded from WordPress backups by design.

Finish in the browser, then add HTTPS

Open the domain and the setup wizard asks for a site title, an admin username, a password, and an email. Choose an admin name that is not "admin", because that is the first username every login attempt tries.

Then install a certificate before you invite anyone: sudo apt install certbot python3-certbot-apache, run sudo certbot --apache -d example.com -d www.example.com, and accept the redirect. Certbot edits the VirtualHost and sets up renewal.

After HTTPS works, confirm the site address in Settings, then General reads https. If it still says http, the admin area will redirect in a loop, and the fix is to update the siteurl and home values directly in the wp_options table.

When the install does not come up

Five failures account for most first installs on Ubuntu. Read the message, check the one thing it points at, and reload before changing anything else.

Every one of those is diagnosable from two files: the Apache error log and wp-content/debug.log after you enable WP_DEBUG. Guessing at plugins before reading either is how a ten-minute fix becomes an afternoon.

Managed hosting instead of a shell

Running this stack yourself means owning PHP upgrades, certificate renewal, and database backups. On WordPress hosting, those are handled, and the plans start at ₹400 per month before 18% GST with a one-year term at ₹3,000. For a self-managed install that stays yours, a VPS is quoted by email at support@webji.services before payment.

Support is 24/7 by email in Hindi and English, with an average first reply under 60 minutes. Send the Ubuntu version, the PHP version, and the exact error text if a step stalls.