The first time I installed WordPress manually, the upload itself was easy; the uneasy part was wondering whether the database, domain, and permissions were actually right. This walkthrough stays with that moment—from an empty hosting account to a site you can sign into, secure, and confidently put online.

What “self-hosted WordPress” actually means

Self-hosted WordPress is the open-source software from WordPress.org, installed on hosting you control or rent. The software is free, but the domain, hosting, email, backups, and operational care are yours. That freedom is the appeal: you choose the host, theme, plugins, data location, and deployment workflow.

This is different from a hosted website service where the provider operates most of the stack. Here, “self-hosted” does not necessarily mean a server under your desk. A managed WordPress plan, shared hosting account, VPS, or cloud instance can all host the same WordPress software; they simply give you different levels of control and responsibility.

Choose the hosting path that fits your patience

  • Managed WordPress hosting: the least operational work; the provider usually handles caching, backups, certificates, and some updates.

  • Shared hosting: affordable and friendly to a first site, often with a control panel and one-click installer, but with fewer server-level controls.

  • VPS or cloud server: useful when you genuinely need shell access and custom services; you also own patching, firewall rules, backups, monitoring, and recovery.

Check the platform before paying

The current WordPress requirements recommend PHP 8.3 or newer, MariaDB 10.11 or newer or MySQL 8.0 or newer, and HTTPS. Apache and Nginx are both established choices. Older PHP and database versions may still run WordPress, but using end-of-life software turns a simple website into a security liability.

  • A domain you can point with DNS records.

  • A hosting account with a document root for that domain.

  • A database name, database user, password, and database host.

  • SFTP credentials or a host-provided file manager.

  • An HTTPS certificate, usually issued through the hosting panel.

  • A tested backup or snapshot mechanism—not merely a checkbox that says backups exist.

Prepare the domain and HTTPS first

Add the domain in the hosting control panel, note the DNS records it supplies, and update those records at your registrar. DNS changes can take time to appear globally, so do this before you expect the WordPress installer to be reachable. Issue the TLS certificate as soon as the domain resolves, then use the https:// address consistently.

Create a dedicated database

In the host’s database panel, create one database and one user for this site. Assign that user to the database and keep the four connection values nearby: database name, username, password, and host. On many shared hosts the database and username receive an account prefix; copy the displayed values instead of guessing them.

Download WordPress from its real home

Download the current release only from the official WordPress download page. The version 5.8.2 shown in the old article was current in 2021; it is historical now and should not be installed on a new public site.

~/Downloadsbash
curl -O https://wordpress.org/latest.tar.gz
tar -xzf latest.tar.gz

What these two commands are doing

  • curl -O keeps the remote filename, so the archive is saved locally as latest.tar.gz.

  • tar -xzf extracts a gzip-compressed tar archive; it does not install WordPress or modify the server.

  • The extracted wordpress directory contains the application files that must go into the domain’s document root.

Upload the files without exposing your password

Open FileZilla or another trusted client and create an SFTP connection using the host, username, password or SSH key, and port supplied by your provider. WordPress’s hardening guidance recommends SFTP when it is available because ordinary FTP sends credentials and data without transport encryption.

  1. Open the remote document root, commonly named public_html, www, or a domain-specific directory.

  2. Open the extracted wordpress directory locally.

  3. Upload the contents of that directory—not the enclosing folder—when the site should open at the domain root.

  4. Wait for the transfer queue to finish and investigate failed transfers before opening the installer.

Run the installer in the browser

Visit the HTTPS URL for the domain. WordPress asks for the database values you created, writes its configuration when the host permits it, and then requests the site title and first administrator account. Use a non-obvious administrator username, a unique password, and an email address you monitor.

The table prefix is not a substitute for access controls, patching, or backups. More importantly, never paste database credentials into a public issue, screenshot, or tutorial. If the installer cannot write wp-config.php, follow its displayed instructions and create the file through the hosting file manager or SFTP.

Pause before you announce the site

  • Open both the homepage and `/wp-admin/`: confirm that each loads over HTTPS without a certificate warning.

  • Check Settings → General: make sure both WordPress addresses use the intended HTTPS domain.

  • Set the permalink structure once: then open a sample page to confirm rewrite rules work.

  • Install updates: update WordPress core, the active theme, and every plugin before adding content.

  • Remove what you will not use: unused themes and plugins expand the maintenance surface.

  • Run a real restore test: a backup becomes trustworthy only after you know where it is and how to restore it.

When the blank screen is not very informative

Error establishing a database connection

Recheck the database name, username, password, and host exactly as the hosting panel shows them. Also confirm that the user was assigned to the database. localhost is common, but it is not universal.

The domain shows a directory listing or placeholder page

The files may be in the wrong document root, or the host’s placeholder index.html may still take precedence. Confirm the domain mapping and make sure index.php, wp-admin, wp-content, and wp-includes sit in the intended root.

Uploads or updates ask for FTP credentials

That often points to file ownership or write-access problems. Do not “solve” it by making the whole site world-writable. Ask the host which ownership model it uses and apply the narrow permissions recommended for that environment.

The site works on HTTP but not HTTPS

Confirm the certificate covers the exact hostname, including www if you use it. Then check the WordPress URL settings and clear host-level caches. A redirect cannot compensate for a missing or invalid certificate.

A small launch, done carefully, beats a rushed one

You now have more than uploaded files: you have a domain, encrypted transport, isolated database credentials, an administrator account, and a recovery path. That foundation is quiet and unglamorous, but it is what lets the creative part of building a site feel enjoyable instead of fragile.

Continue building the site