Before this post, I was hosting my website using a shared web hosting provider. Shared web hosting is convenient because the provider takes care of the software platform and its security updates (though I am still responsible to update a PHP application like WordPress). And if there is a problem with the platform, the provider is responsible to fix it. Unfortunately, shared web hosting may have performance and scalability issues (resulting from overcrowded websites on the single shared server and strict restrictions on CPU and memory usage) and disallows non-PHP software installation such as a Subversion server.
With the above in mind, I decided to look into unmanaged VPS (virtual private server) hosting as an alternative to shared web hosting. A virtual server is cheaper than a physical server and an unmanaged server is cheaper than a managed server. A managed VPS provider would install the software stack for me and provide support for about $30 or more per month. An unmanaged VPS depends on me to install the software and only costs $5 per month with DigitalOcean. The downside to unmanaged VPS is that if anything goes wrong with the software, I am responsible to fix it.
Note: If you decide to, please use this referral link to signup for a DigitalOcean account and get $10 in credit. Once you spend $25, I will get a $25 credit. It’s a win-win for both of us.
In this post, I will outline the steps I took to install WordPress on an unmanaged VPS hosted by DigitalOcean. Most of these instructions may be applicable to other VPS providers.
Update: I’ve provided updated instructions using the latest Ubuntu 20.04 LTS at Ubuntu 20.04 to WordPress From Scratch.
Create VPS
When creating a VPS, the most important choice is the operating system. I recommend getting the latest Ubuntu Server LTS (long-term support) version, currently 12.04.4. All up-to-date software packages should support the LTS version of Ubuntu so it is a safe choice to make. Unfortunately, DigitalOcean only offered the LTS version 12.04.3 so I chose that. Because it will be a long time, if ever, before I would need a VPS with more than 4GB memory, I decided to choose the 32bit version to keep memory usage as minimal as possible.
Note: Ubuntu 12.04 LTS comes with PHP version 5 pre-installed.
You should have an IP address and root password for your VPS before proceeding.
Secure VPS
Remote access to the VPS is accomplished by SSH (Secure Shell). (If you know telnet, think of SSH as an encrypted version of telnet.) By default, servers are setup to use SSH with port 22 and user root. Unsophisticated hackers would attempt to gain access to a server using those settings and a brute force password generator. While a very hard to guess root password would make the server more secure, it is even better to change the SSH port number and use a non-root user.
Note: While Mac OS X comes with a built-in SSH client, Windows does not. I recommend downloading the free DeltaCopy SSH client “ssh.exe” for Windows. Alternatively, you can download the free PuTTY SSH client “putty.exe” if you want a GUI client, instead of a command line client.
Note: Lines below that start with the pound character # are comments and you don’t need to input them.
Run these commands:
ssh root@mydomain.com
# Change the root password.
passwd
# Create a new non-root user.
adduser mynewuser
We will configure the new user to execute commands with root privileges by using the sudo (super user) tool. Sudo involves pre-pending all commands with the word “sudo”. Sudo will prompt for the root password. (You can also configure sudo to log all commands issued using it.) We will grant all sudo privileges to the new user by adding to “/etc/sudoers” under the “User privilege specification” section like so:
# It is equivalent to "sudo vi /etc/sudoers" or "sudo nano /etc/sudoers" but includes validation.
visudo
# Add mynewuser to the "User privilege specification" section
root ALL=(ALL:ALL) ALL
mynewuser ALL=(ALL:ALL) ALL
To disallow SSH root login and to change the SSH port number (say from 22 to 3333), edit the SSH configuration “sshd_config” file and make the following changes:
# Change the default listen "Port 22" to the custom port:
Port 3333
# Do not permit root user login by changing "PermitRootLogin yes" to:
PermitRootLogin no
# Allow only mynewuser to connect using SSH
AllowUsers mynewuser
# Optionally, disable useDNS as it provides no real security benefit
UseDNS no
Reload the SSH service so the changes can take effect:
Test the new settings by opening up a command window on your client and running the following commands:
ssh -p 3333 mynewuser@mydomain.com
The attempt to SSH using the root user should fail. The attempt using the new user should succeed. If you cannot SSH into the server with the new user, double-check the changes using your original SSH window (which should still be connected to your server). If you don’t have that original SSH window still connected, your VPS provider should provide console access (like having a virtual keyboard and monitor connected directly to the VPS) through their website for recovery scenarios such as this.
Tip: You can log into the root account after you SSH into the mynewuser account by running the “su -” superuser command. You will be prompted for the root password.
The UFW (Uncomplicated Firewall) tool allows us to easily configure the iptables firewall service, which is built into the Ubuntu kernel. Run these commands on the server:
sudo ufw allow 3333/tcp
sudo ufw allow http
# Enable the firewall and view its status.
sudo ufw enable
sudo ufw status
The above steps configure a basic level of security for the VPS.
Install LEMP
WordPress requires an HTTP server, PHP, and MySQL. The LEMP (Linux, Nginx, MySQL, PHP) software stack matches those requirements. (Nginx is pronounced “engine-ex” which explains where the “E” acronym came from.) You may be more familiar with the LAMP stack, which uses Apache instead of Nginx as the HTTP server. Nginx is a high-performance HTTP server which uses significantly less CPU and memory than Apache would under high load situations. By using Nginx, we allow for the capability of handling greater numbers of page requests than usual.
On the server, run these commands:
sudo apt-get update
# Install MySQL.
sudo apt-get install mysql-server php5-mysql
sudo mysql_install_db
# Secure MySQL.
sudo /usr/bin/mysql_secure_installation
# Do a test connect to MySQL service.
mysql -u root -p
mysql> show databases;
mysql> quit
When installing MySQL, you will be prompted to input a MySQL root password. If you leave it blank, you will have another opportunity to change it when running the “mysql_secure_installation” script. You will want to answer yes to all the prompts from the “mysql_secure_installation” script to remove anonymous MySQL users, disallow remote MySQL root login, and remove the test database.
MySQL is not configured to start on boot by default. To start MySQL at boot time, run only the first command below:
sudo update-rc.d mysql defaults
# FYI, undo start MySQL at boot time.
sudo update-rc.d -f mysql remove
If you have issues connecting to MySQL, you can start MySQL in an unsecured safe mode (which bypasses the password requirement) to perform a recovery action such as resetting the MySQL root password like so:
sudo service mysql stop
sudo mysqld_safe --skip-grant-tables &
# Connect to MySQL, change root password, and exit.
mysql -u root
mysql> use mysql;
mysql> update user set password=PASSWORD("newrootpassword") where User='root';
mysql> flush privileges;
mysql> quit
# Stop MySQL safe mode and start normal MySQL service.
sudo mysqladmin -u root -p shutdown
sudo service mysql start
Install and start Nginx by running these commands on the server:
sudo service nginx start
Browse to your server’s IP address and you should see a “Welcome to nginx!” page.
To make it possible for Nginx to serve PHP scripts, we need to install the PHP-FPM (FastCGI Process Manager for PHP) service. PHP-FPM enables Nginx to call the PHP platform to interpret PHP scripts. PHP-FPM should be already installed as dependencies of the “php5-mysql” package (part of the MySQL installation instructions above). We can make sure that PHP-FPM (and its dependency, the PHP platform) is installed by trying to re-install it again (trying to install an already installed package doesn’t do any harm).
dpkg --get-selections | grep -i php
# Install PHP-FPM package.
sudo apt-get install php-fpm
# Test the install by displaying the version of PHP-FPM.
php5-fpm -v
Secure and optimize the PHP-FPM service by running these commands on the server:
sudo nano /etc/php5/fpm/php.ini
# Change the "cgi.fix_pathinfo=1" value to:
cgi.fix_pathinfo=0
# Configure PHP to use a Unix socket for communication, which is faster than default TCP socket.
sudo nano /etc/php5/fpm/pool.d/www.conf
# Change the "listen = 127.0.0.1:9000" value to:
listen = /var/run/php5-fpm.sock
# Restart the PHP-FPM service to make the changes effective.
sudo service php5-fpm restart
Nginx defines the site host (and each virtual host) in a server block file. The server block file links the domain name to a directory where the domain’s web files (HTML, PHP, images, etc.) are located. When you browse to the VPS, Nginx will serve files from the directory that corresponds to the domain name given by your browser. That is simple explanation of how Nginx can support hosting more than one domain on a single VPS.
Edit the default server block file to support PHP scripts:
In the “default” server block file, change the following:
# Add index.php to front of "index" to execute it first by default (if it exists)
index index.php index.html index.htm;
# Optionally, WordPress sites only need the index.php value like so:
#index index.php
# Change "server_name localhost;" to:
server_name mydomain.com www.mydomain.com;
# Use these directives if URL is matched to root / location.
location / {
# try_files will try a directory if file does not exist, and then
# if directory does not exist, will try a default like index.html.
# For WordPress site, we need to change "try_files $uri $uri/ /index.html;" to:
try_files $uri $uri/ /index.php?$args;
# The $args is necessary to support the Wordpress post preview function.
# If you don't change this, then non-default permalink URLs will fail with 500 error.
}
# Uncomment the whole "location ~ \.php$" block except for the "fast_cgi_pass 127.0.0.1:9000;" line.
# "location ~\.php$" means to match against any files ending in .php.
# Leave the default "fastcgi_pass unix:/var/run/php5-fpm.sock" line
# (it already matches what is in /etc/php5/fpm/pool.d/www.conf above).
location ~ \.php$ {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
# With php5-cgi alone:
#fastcgi_pass 127.0.0.1:9000;
# With php5-fpm:
fastcgi_pass unix:/var/run/php5-fpm.sock;
fastcgi_index index.php;
include fastcgi_params;
}
Restart the Nginx service to have the changes take effect:
Create a PHP test script by running this edit command:
In “info.php” file, input the following text:
phpinfo();
?>
Browse to “http://mydomain.com/info.php” and you should see a page containing information about the PHP installation.
Both PHP-FPM (php5-fpm) and Nginx are configured to start at boot time by default. You can double-check by running the chkconfig utility to list the services and their runlevel configurations:
sudo apt-get install chkconfig
# List all services and their runlevels configurations.
chkconfig --list
Note: You won’t be able to use chkconfig to change the runlevels because it is not compatible with the new Upstart runlevel configuration used by Ubuntu. Instead, use update-rc.d or sysv-rc-conf to make runlevel changes.
Debugging LEMP
To debug issues with LEMP, look at these log files:
Nginx: /var/log/nginx/error.log
PHP: /var/log/php5-fpm.log
For performance reasons, the debug logs from the PHP-FPM worker threads are discarded by default. If you wish to see error logs from your PHP applications, you will need to enable logging from worker threads.
Run the following commands on the server:
sudo nano /etc/php5/fpm/pool.d/www.conf
# Uncomment this line:
catch_workers_output = yes
# Reload the PHP-FPM service to make the changes take effect.
sudo service php5-fpm reload
You should now see error logs from the PHP worker threads outputted to the “/var/log/php5-fpm.log” file.
Install WordPress
Install WordPress by running the following commands on the server:
cd /tmp
wget http://wordpress.org/latest.tar.gz
# Uncompress the WordPress archive file.
tar zxvf latest.tar.gz
# Create a wp-config.php configuration file by copying from the sample.
cd wordpress
cp wp-config-sample.php wp-config.php
# Move the WordPress files to the Nginx root document directory.
sudo mv wordpress/* /usr/share/nginx/www/
# Change ownership to www-data user (which Nginx worker threads are configured to run under).
sudo chown -R www-data:www-data /usr/share/nginx/www/*
Note: If WordPress detects its configuration file “wp-config.php” is missing, it will offer to run a web-based wizard to create it. However, the wizard won’t work because our MySQL root user requires a password. Besides, using the wizard would not be very secure because the WordPress database’s MySQL user password would be sent in the clear over HTTP. Instead, we manually created the “wp-config.php” file in the above steps and will modify it below.
Create a MySQL database and user for WordPress by running these commands on the server:
mysql -u root -p
# Create a MySQL WordPress database.
mysql> create database wordpress;
# Create a MySQL user and password.
mysql> create user wordpress@localhost;
mysql> set password for wordpress@localhost = PASSWORD('mypassword');
# Grant the MySQL user full privileges on the WordPress database.
mysql> grant all privileges on wordpress.* to wordpress@localhost identified by 'mypassword';
# Make the privilege changes effective.
mysql> flush privileges;
# Double-check by showing the privileges for the user.
mysql> show grants for wordpress@localhost;
# Exit the MySQL interactive shell.
mysql> quit
Update the WordPress configuration file by running this command:
In the “wp-config.php” file, input the newly-created MySQL database, user, and password like so:
define('DB_USER', 'wordpress');
define('DB_PASSWORD', 'mypassword');
Browse to your server’s IP address and follow the WordPress instructions to complete the installation.
Change WordPress Document Root
This section is optional. If you wish to store the WordPress installation into an alternative directory path, say “/var/www/wordpress”, instead of “/usr/share/nginx/www”, follow the steps below. (I suggest “/var/www/wordpress” instead of “/var/www” so that later, when you host additional domains, the WordPress installation will be in its own separate directory.)
To move WordPress to a new directory, run these commands on the server:
sudo mkdir -p /var/www/wordpress
sudo mv /usr/share/nginx/www/* /var/www/wordpress/
# Rename the existing Nginx server block file.
sudo mv /etc/nginx/sites-available/default /etc/nginx/sites-available/wordpress
# Update the Nginx server block file with new location.
sudo nano /etc/nginx/sites-available/wordpress
# Change document root from "root /usr/share/nginx/www;" to "root /var/www/wordpress;".
# Enable the renamed Nginx server block by creating soft link.
sudo ln -s /etc/nginx/sites-available/wordpress /etc/nginx/sites-enabled/wordpress
# Remove the old Nginx server block soft link (which points at a non-existing file).
sudo rm /etc/nginx/sites-enabled/default
# Reload the Nginx service so the changes can take effect.
sudo service nginx reload
Test this change by browsing to your server’s IP address. You should see the WordPress website.
Migrate WordPress
When migrating an existing WordPress site to your new VPS, I suggest doing the following steps:
- On your old WordPress server, update WordPress and all plugins to the latest versions.
- On the new WordPress server, browse to “http://mydomain.com/wp-admin/” to install the same theme and plugins as exist on the old server. Activate the theme. Leave all the plugins inactive. When we do the WordPress database restore, the plugins will be configured and activated to match what was in the old server.
- Copy the old image uploads directory to the new server. Supposing that the WordPress on the old server is located at “/home/username/public_html/wordpress”, run the following commands on the new server:
sudo scp -r username@oldserver:/home/username/public_html/wordpress/wp-content/uploads /var/www/wordpress/wp-content/
sudo chown -R www-data:www-data /var/www/wordpress/wp-content/uploadsNote: If the old server uses a custom SSH port number, scp will require the custom port number as a “-P” input parameter; for example, “sudo scp -r -P 2222 username@oldserver…”.
- Export the WordPress database from the old server using the recommended phpMyAdmin interface (which generates a more human-friendly SQL output than mysqldump) or by running the following command on the old server:
mysqldump -u oldusername -p olddatabasename > wordpress.sql
- Before importing the WordPress database into the new server, we will need to change references to the image uploads directory (and other directories) in the exported SQL file. If you don’t make this change, then images may not be visible in the WordPress postings. Following the example above, replace any occurance of “/home/username/public_html/wordpress/” with “/var/www/wordpress/” in the exported database SQL file.
- Copy the exported SQL file to the new server, say to the “/tmp” directory.
- On the new server, run these commands:
# Open up MySQL command shell.
mysql -u root -p
# Empty the existing WordPress database.
mysql> drop database wordpress;
mysql> create database wordpress;
# Exit the MySQL command shell.
mysql> quit
# Import the exported SQL file.
mysql -u root -p wordpress < /tmp/wordpress.sqlNote: Dropping and re-creating the WordPress database does not affect the WordPress database user and its privileges.
Browse to your new server’s IP address and you should see your WordPress website. Unfortunately, we cannot verify that the images are loading correctly on the new server because the image URLs use the domain name which points at the old server (the images are loaded from the old server, not the new server). We now need to point the domain at our new server.
Migrate Domain
I used DigitalOcean’s DNS (Domain Name System) “Add Domain” tool to create an A (Address) record (“@” => “server_ip_address”) linking mydomain.com to the new server’s IP address. I also added a CNAME (Canonical name) record (“www” => “@”) to have www.mydomain.com point at mydomain.com. I tested whether DigitalOcean’s DNS servers were updated or not by repeatedly running one of these two commands on the server (or any Linux machine):
nslookup www.mydomain.com ns1.digitalocean.com
Note: DigitalOcean’s DNS servers took about 20 minutes to update.
Once DigitalOcean’s DNS servers had lookup entries for my domain name, I went to my domain registrar and updated my domain’s name servers to point at DigitalOcean’s DNS servers. To test whether DigitalOcean’s DNS servers were being used or not, I occasionally ran the following commands on my client machine to check the IP address returned:
ping mydomain.com
Once the new IP address was returned consistently (it took 24 hours before my internet provider’s DNS servers were updated), I then browsed to mydomain.com and checked that the images were loading correctly.
You can empty the DNS caches on your machine and browser by using any of these commands:
ipconfig /flushdns
# On Mac OS X:
sudo dscacheutil -flushcache
# On Chrome, browse to URL below and click on the "clear host cache" button.
chrome://net-internals/#dns
If you want to check the DNS change propagation across the whole world, try the What’s My DNS? website. It will make calls to DNS name servers located all over the planet.
At this point, I have a working VPS that is reasonably secured and successfully hosting my migrated WordPress website. Some rough page load tests resulted in 0.5-1 second load times, as opposed to the 2-4 seconds on the old server (which was shared web hosting with a LAMP stack). I hope that this guide will help you should you decide to move your WordPress website to an unmanaged VPS.
See my followup post, Nginx Multiple Domains, Postfix Email, and Mailman Mailing Lists, to configure Nginx to support multiple domains, get Postfix email flowing, and get Mailman mailing lists working.
Most info above is derived from the following sources:
- Initial Server Setup with Ubuntu 12.04
- How to Setup a Firewall with UFW on an Ubuntu and Debian Cloud Server
- How To Install Linux, nginx, MySQL, PHP (LEMP) stack on Ubuntu 12.04
- How to list all installed packages?
- ERROR 1045 (28000): Access denied for user ‘root’@’localhost’ (using password: NO)
- PHP-FPM doesn’t write to error log
- How To Install WordPress with nginx on Ubuntu 12.04
- How To Set Up a Host Name with DigitalOcean
Hello,
Thanks for sharing this. I have been struggling from last 2 days to get a VPS running.
Also, I wanted to know which version of Ubuntu did you choose? 14.x or 12.x?
Hi Harish,
Glad to help. I ended up with Ubuntu version 12.04.3, which is the latest LTS (long-term support) version provided by Digital Ocean.
Regards.
Hi,
nice tutorial,
should it be wp-config.php, not php-config.php?
sudo nano /usr/share/nginx/www/php-config.php
In the “php-config.php” file, input the newly-created MySQL database, user, and password like so:
Hi Egon,
Thanks for the catch. I’ve updated the post to include that correction.
Chanh