WIUNIX ACADEMY
Install WordPress on Nginx with a privacy-safe FastCGI cache
Page 2 of 8. Review the earlier steps and prerequisites before continuing.
YOUR SYSTEM. YOUR STEPS.
Where are you working?
Choose your OS and version. The prerequisites, commands and troubleshooting follow your environment.
USE YOUR OWN VALUES
Configure this tutorial
Set the example values for your environment; related explanations and copy panels update together. Never enter passwords, private keys or tokens. Values stay in this tab and are not sent to the server or share links. Check actual DNS, certificates and network policy before running commands.
Different IP addresses, domains or ports? Open the settings below, change the values and select “Apply to tutorial”, then copy the updated commands.
Set values for my environment4 editable values
Open the dedicated PHP pool
The stock www pool may remain in this single-site lab; this host never uses its socket. Do not disable another site’s pool. Save the next panel using nano (Ctrl+O, Enter, Ctrl+X).
WordPress server, Bash, existing sudo administrator.
sudo nano /etc/php/8.5/fpm/pool.d/wordpress.conf
Check succeeds; stop on an error before continuing.
LET’S BUILD
Run PHP with a dedicated Unix identity
Use the selected version’s file path. The fixed socket name is deliberate; versioned directories/services still follow your OS. Five children and 128 MB are small-lab starting values, not a production capacity promise.
File contents; save in the named file, not the shell.
[wordpress]
user = wp-php
group = wp-php
listen = /run/php/wordpress.sock
listen.owner = www-data
listen.group = www-data
listen.mode = 0660
pm = ondemand
pm.max_children = 5
pm.process_idle_timeout = 10s
pm.max_requests = 500
chdir = /var/www/wordpress
security.limit_extensions = .php
php_admin_value[upload_max_filesize] = 16M
php_admin_value[post_max_size] = 16M
php_admin_value[memory_limit] = 128M
php_admin_flag[display_errors] = off
php_admin_flag[log_errors] = on
Dedicated wp-php pool defines the www-data-owned 0660 socket.
LET’S BUILD
Validate FPM before restarting
Restart briefly interrupts all pools of this PHP version. The test must succeed before restart.
WordPress server, Bash, existing sudo administrator.
(
set -euo pipefail
sudo php-fpm8.5 -t
sudo systemctl restart php8.5-fpm
systemctl is-active php8.5-fpm
sudo stat -c '%U:%G %a %n' /run/php/wordpress.sock
)
FPM validates, service is active, socket reports www-data:www-data 660.
Generate independent authentication salts
Run privately; keep output out of screenshots/logs/Git. Use one different value for each of the eight key/salt placeholders below.
WordPress server, Bash, existing sudo administrator.
for n in $(seq 1 8); do openssl rand -hex 48; done
Check succeeds; stop on an error before continuing.
Create the protected configuration file
Fresh installation only: the guard refuses an existing configuration. Do not rerun this on a live site. Save the following file panel, not shell commands.
WordPress server, Bash, existing sudo administrator.
(
set -euo pipefail
sudo test ! -e /var/www/wordpress/wp-config.php
sudo install -o root -g wp-php -m 0640 /dev/null /var/www/wordpress/wp-config.php
sudo nano /var/www/wordpress/wp-config.php
)
Check succeeds; stop on an error before continuing.
LET’S BUILD
Connect WordPress to MariaDB
Replace every placeholder and both hostname values. The table prefix is not a security control. Direct TLS termination is assumed; never trust arbitrary forwarded-HTTPS headers. The dashboard code editor is disabled. Root-owned core/themes/plugins need administrator-controlled timely updates; do not make the whole tree writable to solve an update prompt.
File contents; save in the named file, not the shell.
<?php
define( 'DB_NAME', 'wordpress' );
define( 'DB_USER', 'wp_site' );
define( 'DB_PASSWORD', 'REPLACE_WITH_THE_DATABASE_PASSWORD' );
define( 'DB_HOST', 'localhost' );
define( 'DB_CHARSET', 'utf8mb4' );
define( 'DB_COLLATE', '' );
// Replace every placeholder with a DIFFERENT local random value.
define( 'AUTH_KEY', 'REPLACE_1' );
define( 'SECURE_AUTH_KEY', 'REPLACE_2' );
define( 'LOGGED_IN_KEY', 'REPLACE_3' );
define( 'NONCE_KEY', 'REPLACE_4' );
define( 'AUTH_SALT', 'REPLACE_5' );
define( 'SECURE_AUTH_SALT', 'REPLACE_6' );
define( 'LOGGED_IN_SALT', 'REPLACE_7' );
define( 'NONCE_SALT', 'REPLACE_8' );
$table_prefix = 'wp_';
define( 'WP_HOME', 'https://blog.example.com' );
define( 'WP_SITEURL', 'https://blog.example.com' );
define( 'FORCE_SSL_ADMIN', true );
define( 'DISALLOW_FILE_EDIT', true );
define( 'WP_DEBUG', false );
if ( ! defined( 'ABSPATH' ) ) { define( 'ABSPATH', __DIR__ . '/' ); }
require_once ABSPATH . 'wp-settings.php';
Check succeeds; stop on an error before continuing.