# How to Install WordPress on Ubuntu 24.04 with Caddy, PHP 8.4 and MariaDB

> Install WordPress on Ubuntu 24.04 with PHP 8.4-FPM, MariaDB and Caddy for automatic HTTPS, plus hardening and an object cache — by hand or in minutes with Hanoo.

Source: https://hanoo.io/blog/install-wordpress-ubuntu-24-04-caddy · Published 2026-10-16 · Updated 2026-10-16 · By the Hanoo team

WordPress still powers a huge share of the web, and the cheapest way to run it well is on a server you control. This guide installs **WordPress 7.1 on Ubuntu 24.04 LTS** with the stack the WordPress Hosting Team recommends today — **PHP 8.4, MariaDB and HTTPS** — served by **Caddy**, the web server that obtains and renews TLS certificates on its own.

You will see every command for a manual install, the security settings most tutorials skip, and how to get the same result in a few minutes with Hanoo.

> **In short:** install PHP 8.4-FPM with WordPress's extensions, create a MariaDB database and user, download WordPress, write `wp-config.php` with unique salts, give the site its own PHP-FPM pool and Linux user, and let Caddy serve it with automatic HTTPS. Then block `wp-config.php` and PHP inside `uploads/`, and add an object cache.

## WordPress requirements in 2026

WordPress's *minimum* requirements are deliberately low (PHP 7.4 still runs it), but minimums are not what you want for a new site. The WordPress Hosting Team's recommendations for WordPress 7.1 are:

| Component | Recommended for new sites | Notes |
| --- | --- | --- |
| PHP | 8.4 or 8.5 | 8.3 works; PHP 8.2 reaches end of life on 31 December 2026 |
| Database | MariaDB 10.11, 11.4 or 11.8, or MySQL 8.4 | Ubuntu 24.04's own `mariadb-server` is 10.11 |
| Web server | Any server with HTTPS | Caddy, Nginx or Apache |
| PHP extensions | `mysqli`, `curl`, `gd` or `imagick`, `intl`, `mbstring`, `xml`, `zip` | Plus OPcache for performance |

## Option 1: install WordPress manually on Ubuntu 24.04

### 1. Update the server and create a site user

Each site should run as its own Linux user, so a compromised plugin on one site cannot read another site's files:

```bash
sudo apt update && sudo apt upgrade -y
sudo adduser --system --group --home /srv/blog blog
```

### 2. Install PHP 8.4 and WordPress's extensions

Ubuntu 24.04 ships PHP 8.3. For PHP 8.4, add the Ondřej Surý PPA:

```bash
sudo add-apt-repository ppa:ondrej/php && sudo apt update
sudo apt install php8.4-fpm php8.4-mysql php8.4-curl php8.4-gd php8.4-intl \
  php8.4-mbstring php8.4-xml php8.4-zip php8.4-imagick php8.4-opcache
```

Give the site its own PHP-FPM pool, running as the site's user, in `/etc/php/8.4/fpm/pool.d/blog.conf`:

```ini
[blog]
user = blog
group = blog
listen = /run/php/php8.4-fpm-blog.sock
listen.owner = caddy
listen.group = caddy
pm = dynamic
pm.max_children = 10
pm.start_servers = 2
pm.min_spare_servers = 1
pm.max_spare_servers = 4
php_admin_value[upload_max_filesize] = 64M
php_admin_value[post_max_size] = 64M
php_admin_value[memory_limit] = 256M
```

Then `sudo systemctl reload php8.4-fpm`.

### 3. Create the database

```bash
sudo apt install mariadb-server
sudo mariadb
```

```sql
CREATE DATABASE blog CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'blog'@'127.0.0.1' IDENTIFIED BY 'a-long-random-password';
GRANT ALL PRIVILEGES ON blog.* TO 'blog'@'127.0.0.1';
FLUSH PRIVILEGES;
```

### 4. Download WordPress

```bash
cd /srv/blog
sudo -u blog curl -fsSLO https://wordpress.org/wordpress-7.1.tar.gz
sudo -u blog tar -xzf wordpress-7.1.tar.gz --strip-components=1
sudo -u blog rm wordpress-7.1.tar.gz
```

WordPress publishes checksums next to every release; compare the SHA-1 or MD5 of the archive with the one on wordpress.org before extracting it on a production server.

### 5. Write `wp-config.php`

Copy `wp-config-sample.php` to `wp-config.php`, fill in the database name, user, password and `DB_HOST` of `127.0.0.1`, and replace the eight `AUTH_KEY` … `NONCE_SALT` lines with fresh values from `https://api.wordpress.org/secret-key/1.1/salt/`. Add two hardening lines above the "That's all, stop editing!" comment:

```php
define('DISALLOW_FILE_EDIT', true); // no theme/plugin code editor in wp-admin
define('WP_DEBUG', false);
```

Make the file readable only by the site user and the web server: `chmod 640 wp-config.php`.

### 6. Install Caddy and serve the site

Install Caddy from its official repository (the version in Ubuntu's archive is older), then describe the site in `/etc/caddy/Caddyfile`:

```caddy
blog.example.com {
    root * /srv/blog
    encode zstd gzip

    # Never serve the config file, and never run PHP someone managed to upload.
    @sensitive path /wp-config.php /readme.html /license.txt
    respond @sensitive 404
    @uploaded_php path_regexp (?i)^/wp-content/uploads/.*\.php$
    respond @uploaded_php 404

    php_fastcgi unix//run/php/php8.4-fpm-blog.sock
    file_server
}
```

`sudo systemctl reload caddy`. As soon as `blog.example.com` resolves to the server, Caddy obtains a Let's Encrypt certificate and redirects HTTP to HTTPS — no Certbot, no renewal cron.

### 7. Run the famous five-minute install

Open `https://blog.example.com` and complete WordPress's installer: site title, admin username (not `admin`), a strong password and your email. That's it — WordPress is live.

### 8. Add an object cache

Every WordPress page load runs dozens of database queries; a persistent object cache keeps their results in memory between requests. Install Redis or Valkey, bind it to localhost with a password, add the PHP extension and an object-cache plugin, and point the plugin at the server.

## Option 2: install WordPress with Hanoo

[Hanoo](/) does all of the above on your own server, from one form.

### Step 1: connect an Ubuntu server

Any provider works. WordPress needs Ubuntu 22.04, 24.04 or 26.04 LTS with at least 1 CPU core, 1 GB of RAM and 10 GB of disk. Run the install command from **Connect server**; the agent connects out over mutually authenticated TLS, opens no inbound management port, and asks you to approve the server.

### Step 2: create a WordPress application

Choose **Create application → WordPress**, name it, pick the server and a PHP version (**8.4** is recommended; 8.3 and 8.5 are available). Hanoo then:

- downloads the pinned official **WordPress 7.1** release from wordpress.org and verifies its checksum;
- creates an isolated Linux user and a dedicated **PHP-FPM pool** for the site;
- creates a private **MariaDB** database and user;
- writes `wp-config.php` with the database credentials and **eight unique salts**, `DISALLOW_FILE_EDIT` on and debug output off;
- keeps `wp-content/uploads` in a shared directory that survives updates and clones;
- configures **Caddy** to refuse `wp-config.php`, `readme.html`, `license.txt` and any PHP file under `uploads/`.

The site is immediately reachable on its temporary Hanoo address with HTTPS. Open it and finish WordPress's own five-minute installer to create your admin account.

### Step 3: add your domain

Under the application's **Domains** tab, add `blog.example.com`. Hanoo checks that its DNS points at your server, issues the certificate and switches the site over with zero downtime. Then update **Settings → General → WordPress Address and Site Address** in wp-admin to the new domain.

### Step 4: optimize

The application's **Optimize WordPress** tab scans the site for common slowdowns and measures time to first byte. From there you can turn on a **per-site Valkey object cache** in one click — Hanoo installs Valkey if the server does not have it yet — and enable compression and browser caching for static files. Every change is reversible from the same tab.

### Step 5: staging and backups

Need a staging copy? **Clone** the application onto the same server or another one; the copy gets its own database. Backups and SSH/SFTP access per application are on the application's own tabs.

## WordPress security checklist

- One Linux user and PHP-FPM pool per site.
- `wp-config.php` not web-readable; no PHP execution in `uploads/`.
- `DISALLOW_FILE_EDIT` on, so a stolen admin session cannot edit PHP from wp-admin.
- Unique admin username, strong password and two-factor authentication via a plugin.
- Automatic minor-version updates left on; plugins and themes updated weekly.
- Database bound to `127.0.0.1`, never exposed publicly.
- Regular off-server backups of the database and `wp-content`.

## Frequently asked questions

### Which PHP version is best for WordPress?

PHP 8.4 for new sites. The WordPress Hosting Team recommends PHP 8.4 or 8.5 for WordPress 7.1; PHP 8.3 still works, and PHP 8.2 reaches end of life at the end of 2026.

### Is Caddy good for WordPress?

Yes. Caddy serves PHP through PHP-FPM just like Nginx, and it obtains and renews HTTPS certificates automatically. WordPress's pretty permalinks work with `php_fastcgi` without extra rewrite rules.

### MariaDB or MySQL for WordPress?

Either. MariaDB 10.11 or newer and MySQL 8.4 are both recommended. On Ubuntu 24.04, `mariadb-server` from the default archive is MariaDB 10.11, which is fine for WordPress.

### How much RAM does a WordPress server need?

1 GB runs a small site comfortably. Plan for 2 GB or more if you run WooCommerce, page builders or an object cache alongside the database on the same server.

### Can I run several WordPress sites on one server?

Yes — give each its own Linux user, PHP-FPM pool, database and database user so they are isolated from each other. Hanoo does this automatically for every application.

### What is an object cache and do I need one?

An object cache stores the results of repeated database queries in memory (Redis or Valkey) between requests. It noticeably speeds up wp-admin, WooCommerce and logged-in traffic, and is worth enabling on any site with dynamic content.