Installing manually

Module 2: Installing and setting up · Reading time: 9 minutes

Learning objective: After this lesson you can install WordPress without an installer and you understand what an installer does for you.

Key concepts: download from wordpress.org, checksum, SFTP, database, database user, least privilege, wp-config-sample.php, keys and salts, table prefix, installation script, WP-CLI

Why you do it by hand once

Even if you always use an installer, it's worth installing WordPress by hand once. You'll see which parts there are and how they fit together. That helps later with a migration, with a database that won't connect, or with a website you take over from someone without an installer. And not every host has an installer.

The steps: download WordPress, upload it, create a database, fill in wp-config.php and run the installation script.

Step 1: downloading, and only from wordpress.org

Always download WordPress from https://wordpress.org/download/ (or the localised version at https://nl.wordpress.org/ for Dutch). Never from another website: a modified version could contain a backdoor.

On the releases page of wordpress.org, each version comes with a checksum (SHA-1 or MD5). You can use this to check whether your download wasn't altered along the way. On your own computer, for example:

sha1sum wordpress-7.1.4.zip            (Linux)
shasum -a 1 wordpress-7.1.4.zip        (macOS)
certutil -hashfile wordpress-7.1.4.zip SHA1   (Windows)

The result must exactly match the value on wordpress.org.

Step 2: uploading

Unzip the zip file. You'll get a folder called wordpress containing wp-admin, wp-includes, wp-content and the individual files. Put the contents of that folder into your web directory (public_html), not the folder itself; otherwise your website ends up at example.com/wordpress/.

You can upload in two ways:

• With an FTP program such as FileZilla. Use SFTP or FTPS, not plain FTP: with plain FTP your password travels over the internet unencrypted.
• As a zip file via File Manager in your panel, then extract it there. This is often much faster than uploading thousands of individual files.

Step 3: database and database user

Create a new database and a database user in your panel. Pay attention to two things:

• A dedicated user per website. Don't use one database user for all your websites, and certainly not your main hosting account. If one website gets hacked, the intruder can only reach that one database with those credentials.
• Privileges: for normal use, WordPress only needs to read, write, change and delete data (SELECT, INSERT, UPDATE, DELETE). For installation and updates that change the table structure, CREATE, ALTER, INDEX and DROP are also needed. In practice, most panels give the user all privileges on that one database. That's acceptable, as long as it's only that one database.

Note down the database name, the username, the password and the host. With most hosts, the host is localhost. With DirectAdmin, the database and user get your account name as a prefix, such as user_wp1.

Step 4: wp-config.php

In the folder you'll find wp-config-sample.php. Copy it to wp-config.php and fill in:

define( 'DB_NAME', 'user_wp1' );
define( 'DB_USER', 'user_wp1' );
define( 'DB_PASSWORD', 'the-password-from-step-3' );
define( 'DB_HOST', 'localhost' );

Then replace the eight lines containing put your unique phrase here with new keys and salts. Get these from https://api.wordpress.org/secret-key/1.1/salt/: every time you open that page, you get new random values. Paste them in place of the example lines.

You can optionally choose a different table prefix than wp_, for example if you're putting multiple installations in one database. Only letters, digits and an underscore.

Save wp-config.php. If you skip this step, WordPress will open a form in step 5 where you fill in the database details yourself. That works, but then you won't choose the keys and the prefix yourself.

Step 5: the installation script

Open https://example.com/wp-admin/install.php in your browser. WordPress asks for the language, the website name, the administrator's username and password, the email address, and whether search engines may index the website. It then creates the tables and your website is ready.

Do this straight after uploading. An uploaded, not yet installed WordPress is dangerous: whoever opens install.php first gets to choose the administrator. There are bots that search specifically for this. So don't upload today and install next week.

The same with WP-CLI

WP-CLI is a command line program that lets you install and manage WordPress without a browser. Many hosts make it available via SSH or a terminal in the panel. The whole installation then becomes:

wp core download --locale=nl_NL
wp config create --dbname=user_wp1 --dbuser=user_wp1 --prompt=dbpass
wp core install --url=https://example.com --title="My Site" \
  --admin_user=admin_k7 --admin_email=admin@example.com --prompt=admin_password

wp config create creates wp-config.php and fetches new keys and salts itself. With --prompt you type the password instead of putting it in the command (otherwise it stays in your terminal history).

WP-CLI is also handy later on: wp core update, wp plugin list, wp core verify-checksums (lesson 7.5) and wp search-replace (lesson 3.2). You don't have to use it, but it's good to know it exists.

What an installer adds

Now that you've done it by hand, you can see what an installer adds: it creates the database and user with a strong password, fetches new salts, installs straight away (no open install.php), and keeps track of the installation for updates, backups and cloning. If you install by hand, you'll need to arrange those last things yourself (module 7 and 8), or import the installation into your installer afterwards.

Summary

• Only download WordPress from wordpress.org, and check the checksum if you want to be sure.
• Upload via SFTP or FTPS, or as a zip file via File Manager.
• Give each website its own database and database user.
• Fill in wp-config.php with the database details and new keys and salts from api.wordpress.org.
• Run the installation script straight after uploading; an open install.php is a risk.

Quiz

Exercise

Exercise D2.3: A second installation by hand. Install WordPress by hand on a test subdomain, for example handmatig.example.com (using your own domain). Download from wordpress.org, create your own database and database user, fill in wp-config.php yourself with new salts, and run the installation script. Tick off each step and answer: which privileges did your database user get, and why is that (un)wise? What was the difference compared with the installer from lesson 2.2? Remove the test installation (files and database) once you're done, or import it into your installer.

Further reading

These articles describe the steps in WebOké's panels; in other panels the process is similar.

• DirectAdmin guide 11.7: Connecting with FileZilla (FTP, FTPS and SFTP)
• DirectAdmin guide 11.3: Extracting and creating zip files
• DirectAdmin guide 12.1: Creating a database
• DirectAdmin guide 12.2: Database users, privileges and passwords
• DirectAdmin guide 15.2: SSH Keys and logging in with SSH
• DirectAdmin guide 15.3: Terminal in your browser
• Installing WordPress (wordpress.org, English): https://developer.wordpress.org/advanced-administration/before-install/howto-install/