كيفية تثبيت ووردبريس بالطريقة الصحيحة (دليل شامل خطوة بخطوة)

sudo apt install python-software-properties
sudo add-apt-repository ppa:ondrej/nginx
sudo add-apt-repository ppa:ondrej/php
sudo apt update && sudo apt upgrade -y
sudo apt install -y nginx nginx-extras mariadb-server unzip curl redis-server imagemagick acl less file
sudo apt install -y php8.4-fpm php8.4-mysql \
 php8.4-curl php8.4-xml php8.4-zip php8.4-gd php8.4-mbstring php8.4-bcmath \
 php8.4-intl php8.4-soap php8.4-imagick php8.4-cli

# Allow NGINX in the Firewall (For this instance UFW)
sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'
sudo ufw enable

sudo mysql_secure_installation

# Change the DB/User Names, Password as you wish
CREATE DATABASE wp CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'wpuser'@'localhost' IDENTIFIED BY 'VERY_STRONGPASS!';
GRANT ALL PRIVILEGES ON wp.* TO 'wpuser'@'localhost';
FLUSH PRIVILEGES;

[mysqld]
bind-address            = 127.0.0.1
# Adjust as you like.
# ~50-70% of RAM on DB-only servers
innodb_buffer_pool_size = 1G 
innodb_log_file_size    = 256M
innodb_flush_method     = O_DIRECT
max_connections         = 200
query_cache_size        = 0
query_cache_type        = 0

sudo systemctl restart mariadb

memory_limit = 256M
; These values are kinda low. So adjust as you like
upload_max_filesize = 64M
; Post_Max_size always needs to be the same as file max upload or higher. Never lower
post_max_size = 64M
max_execution_time = 120

; Security: prevent path-info exploits
cgi.fix_pathinfo = 0
expose_php = Off

; Enable OPcache, dramatically improves performance
zend_extension=opcache
opcache.enable=1
opcache.memory_consumption=128
opcache.max_accelerated_files=10000
opcache.validate_timestamps=1

# Reload PHP-fpm
sudo systemctl reload php8.4-fpm # or 8.4

# Login as a user other than the root, for better security
sudo -u ubuntu -i
curl -sS -o /usr/local/bin/wp https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
chmod +x /usr/local/bin/wp
# You shoulod see WP-Cli Version now
wp --info

curl -fsSL https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar \
| sudo tee /usr/local/bin/wp >/dev/null
sudo chmod +x /usr/local/bin/wp

mkdir -p /var/www/blog
sudo chown -R www-data:www-data /var/www/blog
cd /var/www/blog

sudo -u www-data wp core download --locale=en_US
# The DB/User/Password you created earlier
sudo -u www-data wp config create --dbname=wp --dbuser=wpuser --dbpass=VERY_STRONGPASS! --dbhost=localhost --dbprefix=wp_
# Do not use default username: admin, Choose something more secure
sudo -u www-data wp core install --url="https://example.com" --title="My Site" --admin_user="myusername" --admin_password="ANOTHERSTRONGPASS" --admin_email="me@example.com"

find /var/www/blog -type d -exec chmod 755 {} \;
find /var/www/blog -type f -exec chmod 644 {} \;
rm /var/www/blog/wp-config-sample.php
rm /var/www/blog/readme.html

chown ubuntu:www-data /var/www/blog/wp-config.php
chown ubuntu:www-data /var/www/blog/wp-admin
chown ubuntu:www-data /var/www/blog/wp-includes
# WP-CONFIG should always have 600 (-rw-------) or 440 (-r--r-----+) permission
chmod 440 /var/www/blog/wp-config.php
sudo setfacl -m u:www-data:r /var/www/blog/wp-config.php
# ensure mask allows read
sudo setfacl -m m::r /var/www/blog/wp-config.php
getfacl /var/www/blog/wp-config.php
# https://developer.wordpress.org/advanced-administration/security/hardening/#file-permissions
# Clear Session Command History
history -c

# Set unique salts & keys
sudo -u ubuntu wp config shuffle-salts

# Disable file editing inside WP-Admin
define('DISALLOW_FILE_EDIT', true);
# Limit Revisions to 5
define('WP_POST_REVISIONS', 5);
# Disable WP cron (use system cron)
define('DISABLE_WP_CRON', true);
# Save/Exit the file

sudo -u www-data crontab -e
# Append the following at the end of the file
* * * * * /usr/local/bin/wp --path=/var/www/blog cron event run --due-now --quiet

# To list upcoming scheduled events
sudo -u www-data wp cron event list

# To run all pending (due) cron events immediately
sudo -u www-data -H wp cron event run --due-now

sudo apt install -y certbot python3-certbot-dns-cloudflare
sudo mkdir -p /etc/letsencrypt
echo "dns_cloudflare_api_token = YOUR_API_TOKEN_HERE" > /etc/.cloudflare.ini
sudo chmod 600 /root/.cloudflare.ini

# Issue a Certificate
sudo certbot certonly -d example.com -d "*.example.com" \
  --dns-cloudflare \
  --dns-cloudflare-credentials /etc/.cloudflare.ini \
  --key-type rsa \
  --rsa-key-size 2048 \
  --agree-tos \
  --force-renewal\
  --no-eff-email\
  --email YOUR@EMAIL.COM
# The cert output should be in /etc/letsencrypt/live/example.com/

nano /etc/nginx/nginx.conf
# Apend/Modify the following inside http{} block
http2 on;
ssl_protocols TLSv1.2 TLSv1.3; # Drop v1, v1.1 - Keep only 1.2 & 1.3

cd /etc/nginx/sites-available/
wget -O /etc/nginx/sites-available/blog.conf https://raw.githubusercontent.com/abdessalllam/cloud-setup/refs/heads/main/wordpress/blog.conf
# Disable directory browsing
echo "autoindex off;" > /etc/nginx/snippets/no-autoindex.conf
# Enable the Website and Reload NGINX
sudo ln -s /etc/nginx/sites-available/blog.conf /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx

wget -O /etc/nginx/conf.d/realip.conf https://raw.githubusercontent.com/abdessalllam/cloud-setup/refs/heads/main/wordpress/realip.conf
sudo nginx -t && sudo systemctl reload nginx

<?php
header('Content-Type: text/plain');
foreach (['REMOTE_ADDR','HTTP_CF_CONNECTING_IP','HTTP_X_FORWARDED_FOR'] as $h) {
    echo "$h: " . ($_SERVER[$h] ?? '') . "\n";
}

sudo systemctl enable redis-server
sudo systemctl start redis-server

# Append/Uncomment/Modify the following
supervised systemd
maxmemory 256mb                # adjust for your RAM
maxmemory-policy allkeys-lru   # evict least-used keys

sudo -u www-data wp plugin install redis-cache --activate
sudo -u www-data wp redis enable
sudo -u www-data wp plugin install nginx-helper --activate

# Only with ppa:ondrej/nginx Repo
sudo apt install libnginx-mod-http-brotli-filter libnginx-mod-http-brotli-static

nano /etc/nginx/nginx.conf

# Append the following to inside http{} block, above "gzip on"
brotli on;
brotli_comp_level 5;
brotli_static on;  # serve precompressed .br if present (harmless if not)
brotli_types
  text/plain text/css text/javascript application/javascript
  application/json application/xml application/rss+xml
  application/vnd.ms-fontobject application/font-sfnt
  application/x-font-ttf font/ttf font/otf image/svg+xml;
  
# Append/Uncomment the following
gzip on;
gzip_comp_level 6;
gzip_types text/plain text/css application/javascript application/json application/xml image/svg+xml;

sudo nginx -t && sudo systemctl reload nginx
# Brotli client
curl -sI -H 'Accept-Encoding: br' https://yourdomain | grep -i content-encoding
# Response → Content-Encoding: br

# Gzip client
curl -sI -H 'Accept-Encoding: gzip' https://yourdomain | grep -i content-encoding
# Response → Content-Encoding: gzip (or nothing if already tiny)

# Create a /etc/systemd/system/nginx-auto-reload.service
[Unit]
Description=Validate and reload Nginx when watched files change

[Service]
Type=oneshot
# Validate config & Stop if there are errors
ExecStart=/usr/sbin/nginx -t
# Reload ONLY if ExecStart succeeded
ExecStartPost=/bin/systemctl reload nginx

# Create /etc/systemd/system/nginx-auto-reload.path
[Unit]
Description=Watch specific Nginx-related files

[Path]
# Add one line per file you want to monitor for changes
# Add/Remove Lines as needed
PathChanged=/var/www/blog/file1.conf
PathChanged=/var/www/blog/file2.conf
PathChanged=/var/www/blog/file3.conf

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable --now nginx-auto-reload.path
# (optional first run)
sudo systemctl start nginx-auto-reload.service

journalctl -u nginx-auto-reload.service -n 20 --no-pager
# You should see nginx: configuration file /etc/nginx/nginx.conf test is successful followed by a reload. If the config is broken, nginx -t will fail and no reload happens.

# Reload PHP
sudo systemctl reload php8.4-fpm
sudo systemctl status php8.4-fpm --no-pager

mkdir -p /var/log/blog
sudo chown www-data:www-data /var/log/blog
sudo chmod 750 /var/log/blog
sudo tee /etc/logrotate.d/wordpress >/dev/null <<'EOF'
/var/log/blog/debug.log {
weekly
rotate 12
compress
missingok
notifempty
create 640 www-data www-data
}
EOF

# Enable file logging only in wp-config.php
if ( ! defined( 'WP_DEBUG' ) ) {
        define( 'WP_DEBUG', true );
}
// Set display to false, We don't want errors displayed on our frontend
define( 'WP_DEBUG_DISPLAY', false );
@ini_set( 'display_errors', 0 );
// Log to a file (outside web root is best)
define('WP_DEBUG_LOG', '/var/log/blog/debug.log');

# Let's create a Must-Use folder
mkdir -p /var/www/blog/wp-content/mu-plugins 
chown ubuntu:www-data //var/www/blog/wp-content/mu-plugins
wget -O /var/www/blog/wp-content/mu-plugins/protect-my-email.php https://raw.githubusercontent.com/abdessalllam/cloud-setup/refs/heads/main/wordpress/protect-my-email.php