Prerequisites
- Fresh Debian 13 server with SSH access and a user with sudo or root privileges
- A domain name pointing to your server’s public IP (recommended for HTTPS)
- Ports 80 and 443 open to the server
- Correct system time and NTP sync (chrony or systemd-timesyncd)
Optional: if a host-based firewall is enabled, plan to allow HTTP and HTTPS. With UFW you will use the Apache or Apache Full profiles below.
Step 1: Update the system
Update all packages and reboot if needed.
sudo apt update
sudo apt -y full-upgrade
sudo reboot
Log back in over SSH after the reboot.
Step 2: Install Apache
Install Apache and enable it at boot.
sudo apt install -y apache2
sudo systemctl enable apache2 --now
If UFW is in use, allow web traffic.
sudo ufw allow "Apache"
Quick test: visit your server’s IP address in a browser. You should see Apache’s default page.
Step 3: Install MariaDB and secure the instance
Install the MariaDB server and start it.
sudo apt install -y mariadb-server mariadb-client
sudo systemctl enable mariadb --now
Run the hardening assistant, then follow the prompts to set a root SQL password, remove anonymous users, disable remote root login, and remove the test database.
sudo mariadb-secure-installation
Step 4: Install PHP and required extensions
Install PHP with the Apache module and the extensions required by WordPress.
sudo apt install -y php libapache2-mod-php php-mysql php-xml php-curl php-gd php-mbstring php-zip
Verify the PHP version.
php -v
Step 5: Create the WordPress database and user
Connect to MariaDB as root and create a dedicated database and a least-privilege user. Replace the password with a strong, unique one.
sudo mysql -u root -p
CREATE DATABASE wordpress CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'wpuser'@'localhost' IDENTIFIED BY 'UltraStrongPassword!';
GRANT ALL PRIVILEGES ON wordpress.* TO 'wpuser'@'localhost';
FLUSH PRIVILEGES;
EXIT;
Step 6: Download and place WordPress
Move into the web directory, fetch the official archive, extract it, and clean up. This guide installs WordPress into /var/www/wordpress.
cd /var/www
sudo wget https://wordpress.org/latest.tar.gz
sudo tar -xzf latest.tar.gz
sudo rm latest.tar.gz
Set the ownership and permissions so Apache (www-data) can serve and update files safely.
sudo chown -R www-data:www-data /var/www/wordpress
sudo find /var/www/wordpress -type d -exec chmod 755 {} \;
sudo find /var/www/wordpress -type f -exec chmod 644 {} \;
Copy and edit the sample configuration.
cd /var/www/wordpress
sudo cp wp-config-sample.php wp-config.php
sudo nano wp-config.php
In wp-config.php, adjust these four constants: DB_NAME, DB_USER, DB_PASSWORD, and DB_HOST.
define( 'DB_NAME', 'wordpress' );
define( 'DB_USER', 'wpuser' );
define( 'DB_PASSWORD', 'UltraStrongPassword!' );
define( 'DB_HOST', 'localhost' );
Recommended: add unique security keys and salts using the WordPress API and replace the defaults. You may also disable file editing from the WordPress admin.
define( 'DISALLOW_FILE_EDIT', true );
Step 7: Create a dedicated Apache VirtualHost
Create a site definition for your domain. Replace example.com with your real domain.
sudo nano /etc/apache2/sites-available/wordpress.conf
<VirtualHost *:80>
ServerName example.com
ServerAlias www.example.com
DocumentRoot /var/www/wordpress
<Directory /var/www/wordpress>
AllowOverride All
Require all granted
</Directory>
DirectoryIndex index.php index.html
ErrorLog ${APACHE_LOG_DIR}/wordpress-error.log
CustomLog ${APACHE_LOG_DIR}/wordpress-access.log combined
</VirtualHost>
Enable the site and mod_rewrite, then disable the default site if you do not want it answering on the bare IP.
sudo a2ensite wordpress.conf
sudo a2enmod rewrite
sudo a2dissite 000-default.conf
sudo apache2ctl configtest
sudo systemctl reload apache2
If UFW is active, allow HTTPS now.
sudo ufw allow "Apache Full"
Step 8: Enable HTTPS with Let’s Encrypt
Install Certbot and its Apache plugin, then obtain a certificate for your domain. Choose the option to redirect HTTP to HTTPS when prompted.
sudo apt install -y certbot python3-certbot-apache
sudo certbot --apache -d example.com -d www.example.com
Renewal is handled automatically via a systemd timer. You can test a dry run.
sudo certbot renew --dry-run
Step 9: Finish the WordPress installer in your browser
Open your browser and go to your site over HTTPS.
Select the language, set the site title, create the administrator user, and submit. Then:
- Go to Settings > Permalinks and choose a friendly structure such as Post name
- Remove sample content
- Apply any pending updates
Step 10: Verification and troubleshooting
Quick checks:
- Apache is active and listening on 80 and 443
- The VirtualHost is enabled; no DocumentRoot conflicts
- Correct permissions on /var/www/wordpress
- Database access works with user wpuser
- HTTPS is working and HTTP redirects to HTTPS
Helpful logs:
- Apache logs: /var/log/apache2/wordpress-access.log and wordpress-error.log
- Apache service: sudo systemctl status apache2
- MariaDB service: sudo systemctl status mariadb
Common issues:
- Blank page or internal error: temporarily enable WP_DEBUG in wp-config.php and check Apache logs
- Permalinks returning 404: ensure mod_rewrite is enabled and that AllowOverride All is present in the Directory block
- Let’s Encrypt failures: verify DNS resolution for your domain and that no proxy or firewall blocks ACME paths
Step 11: Optional hardening and performance
Performance and security:
- Install a WordPress caching plugin and enable compression and caching headers in Apache
- Consider php-imagick and php-intl if needed
- Set up regular backups for the database and the wp-content directory
- Keep system security updates automatic or regularly scheduled
Example of basic security headers inside the SSL VirtualHost:
<IfModule mod_headers.c>
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>
Summary
You now have a working WordPress on Debian 13 with Apache, MariaDB, PHP, and HTTPS. Keep credentials safe, apply updates regularly, and implement backups. Happy deploying.