How to Install WordPress on Ubuntu 24.04 with Caddy, PHP 8.4 and MariaDB

WordPress still powers a huge share of the web, and the cheapest way to run it well is on a server you control. This guide installs WordPress 7.1 on Ubuntu 24.04 LTS with the stack the WordPress Hosting Team recommends today — PHP 8.4, MariaDB and HTTPS — served by Caddy, the web server that obtains and renews TLS certificates on its own.

You will see every command for a manual install, the security settings most tutorials skip, and how to get the same result in a few minutes with Hanoo.

WordPress requirements in 2026

WordPress's minimum requirements are deliberately low (PHP 7.4 still runs it), but minimums are not what you want for a new site. The WordPress Hosting Team's recommendations for WordPress 7.1 are:

Option 1: install WordPress manually on Ubuntu 24.04

1. Update the server and create a site user

Each site should run as its own Linux user, so a compromised plugin on one site cannot read another site's files:

sudo apt update && sudo apt upgrade -y
sudo adduser --system --group --home /srv/blog blog

2. Install PHP 8.4 and WordPress's extensions

Ubuntu 24.04 ships PHP 8.3. For PHP 8.4, add the Ondřej Surý PPA:

sudo add-apt-repository ppa:ondrej/php && sudo apt update
sudo apt install php8.4-fpm php8.4-mysql php8.4-curl php8.4-gd php8.4-intl \
  php8.4-mbstring php8.4-xml php8.4-zip php8.4-imagick php8.4-opcache

Give the site its own PHP-FPM pool, running as the site's user, in /etc/php/8.4/fpm/pool.d/blog.conf:

[blog]
user = blog
group = blog
listen = /run/php/php8.4-fpm-blog.sock
listen.owner = caddy
listen.group = caddy
pm = dynamic
pm.max_children = 10
pm.start_servers = 2
pm.min_spare_servers = 1
pm.max_spare_servers = 4
php_admin_value[upload_max_filesize] = 64M
php_admin_value[post_max_size] = 64M
php_admin_value[memory_limit] = 256M

Then sudo systemctl reload php8.4-fpm.

3. Create the database

sudo apt install mariadb-server
sudo mariadb

CREATE DATABASE blog CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'blog'@'127.0.0.1' IDENTIFIED BY 'a-long-random-password';
GRANT ALL PRIVILEGES ON blog.* TO 'blog'@'127.0.0.1';
FLUSH PRIVILEGES;

4. Download WordPress

cd /srv/blog
sudo -u blog curl -fsSLO https://wordpress.org/wordpress-7.1.tar.gz
sudo -u blog tar -xzf wordpress-7.1.tar.gz --strip-components=1
sudo -u blog rm wordpress-7.1.tar.gz

WordPress publishes checksums next to every release; compare the SHA-1 or MD5 of the archive with the one on wordpress.org before extracting it on a production server.

5. Write wp-config.php

Copy wp-config-sample.php to wp-config.php, fill in the database name, user, password and DB_HOST of 127.0.0.1, and replace the eight AUTH_KEY … NONCE_SALT lines with fresh values from https://api.wordpress.org/secret-key/1.1/salt/. Add two hardening lines above the "That's all, stop editing!" comment:

define('DISALLOW_FILE_EDIT', true); // no theme/plugin code editor in wp-admin
define('WP_DEBUG', false);

Make the file readable only by the site user and the web server: chmod 640 wp-config.php.

6. Install Caddy and serve the site

Install Caddy from its official repository (the version in Ubuntu's archive is older), then describe the site in /etc/caddy/Caddyfile:

blog.example.com {
    root * /srv/blog
    encode zstd gzip

    # Never serve the config file, and never run PHP someone managed to upload.
    @sensitive path /wp-config.php /readme.html /license.txt
    respond @sensitive 404
    @uploaded_php path_regexp (?i)^/wp-content/uploads/.*\.php$
    respond @uploaded_php 404

    php_fastcgi unix//run/php/php8.4-fpm-blog.sock
    file_server
}

sudo systemctl reload caddy. As soon as blog.example.com resolves to the server, Caddy obtains a Let's Encrypt certificate and redirects HTTP to HTTPS — no Certbot, no renewal cron.

7. Run the famous five-minute install

Open https://blog.example.com and complete WordPress's installer: site title, admin username (not admin), a strong password and your email. That's it — WordPress is live.

8. Add an object cache

Every WordPress page load runs dozens of database queries; a persistent object cache keeps their results in memory between requests. Install Redis or Valkey, bind it to localhost with a password, add the PHP extension and an object-cache plugin, and point the plugin at the server.

Option 2: install WordPress with Hanoo

Hanoo does all of the above on your own server, from one form.

Step 1: connect an Ubuntu server

Any provider works. WordPress needs Ubuntu 22.04, 24.04 or 26.04 LTS with at least 1 CPU core, 1 GB of RAM and 10 GB of disk. Run the install command from Connect server; the agent connects out over mutually authenticated TLS, opens no inbound management port, and asks you to approve the server.

Step 2: create a WordPress application

Choose Create application → WordPress, name it, pick the server and a PHP version (8.4 is recommended; 8.3 and 8.5 are available). Hanoo then:

• downloads the pinned official WordPress 7.1 release from wordpress.org and verifies its checksum;
• creates an isolated Linux user and a dedicated PHP-FPM pool for the site;
• creates a private MariaDB database and user;
• writes wp-config.php with the database credentials and eight unique salts, DISALLOW_FILE_EDIT on and debug output off;
• keeps wp-content/uploads in a shared directory that survives updates and clones;
• configures Caddy to refuse wp-config.php, readme.html, license.txt and any PHP file under uploads/.

The site is immediately reachable on its temporary Hanoo address with HTTPS. Open it and finish WordPress's own five-minute installer to create your admin account.

Step 3: add your domain

Under the application's Domains tab, add blog.example.com. Hanoo checks that its DNS points at your server, issues the certificate and switches the site over with zero downtime. Then update Settings → General → WordPress Address and Site Address in wp-admin to the new domain.

Step 4: optimize

The application's Optimize WordPress tab scans the site for common slowdowns and measures time to first byte. From there you can turn on a per-site Valkey object cache in one click — Hanoo installs Valkey if the server does not have it yet — and enable compression and browser caching for static files. Every change is reversible from the same tab.

Step 5: staging and backups

Need a staging copy? Clone the application onto the same server or another one; the copy gets its own database. Backups and SSH/SFTP access per application are on the application's own tabs.

WordPress security checklist

• One Linux user and PHP-FPM pool per site.
• wp-config.php not web-readable; no PHP execution in uploads/.
• DISALLOW_FILE_EDIT on, so a stolen admin session cannot edit PHP from wp-admin.
• Unique admin username, strong password and two-factor authentication via a plugin.
• Automatic minor-version updates left on; plugins and themes updated weekly.
• Database bound to 127.0.0.1, never exposed publicly.
• Regular off-server backups of the database and wp-content.

Frequently asked questions

Which PHP version is best for WordPress?

PHP 8.4 for new sites. The WordPress Hosting Team recommends PHP 8.4 or 8.5 for WordPress 7.1; PHP 8.3 still works, and PHP 8.2 reaches end of life at the end of 2026.

Is Caddy good for WordPress?

Yes. Caddy serves PHP through PHP-FPM just like Nginx, and it obtains and renews HTTPS certificates automatically. WordPress's pretty permalinks work with php_fastcgi without extra rewrite rules.

MariaDB or MySQL for WordPress?

Either. MariaDB 10.11 or newer and MySQL 8.4 are both recommended. On Ubuntu 24.04, mariadb-server from the default archive is MariaDB 10.11, which is fine for WordPress.

How much RAM does a WordPress server need?

1 GB runs a small site comfortably. Plan for 2 GB or more if you run WooCommerce, page builders or an object cache alongside the database on the same server.

Can I run several WordPress sites on one server?

Yes — give each its own Linux user, PHP-FPM pool, database and database user so they are isolated from each other. Hanoo does this automatically for every application.

What is an object cache and do I need one?

An object cache stores the results of repeated database queries in memory (Redis or Valkey) between requests. It noticeably speeds up wp-admin, WooCommerce and logged-in traffic, and is worth enabling on any site with dynamic content.