How to Set Up Apache for Serving WordPress Websites

WordPress powers a huge chunk of the web, and behind a massive number of those sites sits a quiet workhorse: Apache. If you’re setting up a new server and want a rock-solid, well-understood platform to host WordPress on, Apache is still one of the best choices out there — not because it’s flashy, but because it’s mature, well-documented, and forgiving of mistakes in a way that newer servers sometimes aren’t.

Why Apache for WordPress?

Apache has been the default pairing for WordPress since WordPress existed. A few reasons that pairing has stuck around:

• .htaccess support — WordPress relies heavily on .htaccess files for permalinks, redirects, and security rules. Apache’s per-directory configuration override system makes this trivial; other servers require workarounds.
• Massive ecosystem — Nearly every hosting tutorial, plugin doc, and Stack Overflow answer assumes Apache.
• Module flexibility — mod_rewrite, mod_ssl, mod_security, and dozens of other modules can be toggled on as needed.
• Battle-tested stability — Apache has been running production workloads for three decades.

None of this means Apache is objectively “better” than Nginx or LiteSpeed — it just means it’s an extremely safe, well-supported default, especially for people who want config flexibility over raw throughput.

Prerequisites

Before starting, make sure you have:

• A server running Ubuntu 22.04/24.04 or a similar Debian-based distro (commands below use apt; adjust for CentOS/RHEL with yum/dnf)
• Root or sudo access
• A domain name pointed at your server’s IP (optional for local testing, required for a real launch)
• Basic comfort with the command line
• MySQL or MariaDB available or installable
• PHP 8.1+ (WordPress 6.x recommends PHP 8.0 or newer)

Step 1: Update the Server and Install Apache

sudo apt update && sudo apt upgrade -y
sudo apt install apache2 -y
sudo systemctl enable apache2
sudo systemctl start apache2

Verify it’s running:

sudo systemctl status apache2

Visit http://your-server-ip in a browser — you should see the default Apache welcome page.

Step 2: Install PHP and Required Extensions

WordPress needs PHP along with several extensions for media handling, database access, and caching.

sudo apt install php php-mysql php-curl php-gd php-mbstring \
  php-xml php-xmlrpc php-soap php-intl php-zip libapache2-mod-php -y

Restart Apache to load the PHP module:

sudo systemctl restart apache2

Confirm PHP works by creating a test file:

echo "<?php phpinfo(); ?>" | sudo tee /var/www/html/info.php

Visit http://your-server-ip/info.php, confirm the PHP info page loads, then delete this file — leaving it exposed is a common and easily avoidable security mistake.

sudo rm /var/www/html/info.php

Step 3: Install and Secure MySQL/MariaDB

sudo apt install mysql-server -y
sudo mysql_secure_installation

Answer the prompts to set a root password, remove anonymous users, disable remote root login, and remove the test database.

Create a dedicated database and user for WordPress:

sudo mysql -u root -p

CREATE DATABASE wordpress_db;
CREATE USER 'wp_user'@'localhost' IDENTIFIED BY 'Str0ng-Unique-Password';
GRANT ALL PRIVILEGES ON wordpress_db.* TO 'wp_user'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Never use root as your WordPress database user in production — a compromised WordPress install shouldn’t automatically mean a compromised database server.

Step 4: Download and Configure WordPress

cd /tmp
curl -O https://wordpress.org/latest.tar.gz
tar -xzvf latest.tar.gz
sudo mv wordpress /var/www/yourdomain.com

Set proper ownership and permissions:

sudo chown -R www-data:www-data /var/www/yourdomain.com
sudo find /var/www/yourdomain.com -type d -exec chmod 755 {} \;
sudo find /var/www/yourdomain.com -type f -exec chmod 644 {} \;

Create the wp-config.php file:

cd /var/www/yourdomain.com
sudo cp wp-config-sample.php wp-config.php
sudo nano wp-config.php

Fill in your database details:

define( 'DB_NAME', 'wordpress_db' );
define( 'DB_USER', 'wp_user' );
define( 'DB_PASSWORD', 'Str0ng-Unique-Password' );
define( 'DB_HOST', 'localhost' );

Also generate fresh authentication keys and salts from the WordPress secret key generator and paste them into the same file — don’t leave the placeholder values.

Step 5: Create an Apache Virtual Host

Create a new virtual host file:

sudo nano /etc/apache2/sites-available/yourdomain.com.conf

<VirtualHost *:80>
    ServerName yourdomain.com
    ServerAlias www.yourdomain.com
    DocumentRoot /var/www/yourdomain.com

    <Directory /var/www/yourdomain.com>
        AllowOverride All
        Require all granted
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/yourdomain.com-error.log
    CustomLog ${APACHE_LOG_DIR}/yourdomain.com-access.log combined
</VirtualHost>

The AllowOverride All directive is critical — without it, WordPress’s .htaccess rules (which control permalinks) will be silently ignored.

Enable the site and required modules:

sudo a2ensite yourdomain.com.conf
sudo a2enmod rewrite
sudo a2dissite 000-default.conf
sudo systemctl reload apache2

Step 6: Finish the WordPress Web Installer

Visit http://yourdomain.com in your browser. WordPress’s famous five-minute installer will walk you through choosing a site title, admin username, and password. Once complete, log in at /wp-admin.

Step 7: Enable HTTPS with Let’s Encrypt

There’s no good reason to run a WordPress site without HTTPS in 2026. Certbot makes this nearly automatic:

sudo apt install certbot python3-certbot-apache -y
sudo certbot --apache -d yourdomain.com -d www.yourdomain.com

Certbot will edit your virtual host automatically to add a :443 block and redirect HTTP to HTTPS. Confirm auto-renewal is scheduled:

sudo certbot renew --dry-run

Real-World Use Cases

• Small business and portfolio sites — the classic use case, where simplicity and .htaccess-driven plugin compatibility matter more than raw performance.
• Multi-site networks — Apache’s virtual host system scales cleanly to dozens of WordPress installs on one box.
• Agency hosting — agencies managing many client sites appreciate how predictable Apache configuration is across environments.
• Staging environments — quick to spin up, easy to tear down, and every WordPress plugin assumes it exists.

Troubleshooting Common Issues

White screen of death Usually a PHP error or memory limit issue. Check:

sudo tail -f /var/log/apache2/yourdomain.com-error.log

Increase PHP memory in wp-config.php:

define( 'WP_MEMORY_LIMIT', '256M' );

Permalinks return 404 This almost always means mod_rewrite isn’t enabled or AllowOverride isn’t set to All.

sudo a2enmod rewrite
sudo systemctl restart apache2

Then go to Settings > Permalinks in WP admin and click Save to regenerate .htaccess.

“Error establishing a database connection” Check that MySQL is running and the credentials in wp-config.php match exactly:

sudo systemctl status mysql

File upload/permission errors Usually ownership drift after manual file edits:

sudo chown -R www-data:www-data /var/www/yourdomain.com

Security Best Practices

• Keep WordPress core, themes, and plugins updated — most WordPress compromises come from outdated plugins, not Apache itself.
• Disable directory listing: <Directory /var/www/yourdomain.com> Options -Indexes</Directory>
• Block access to wp-config.php explicitly: <Files wp-config.php> Require all denied</Files>
• Limit login attempts with a plugin or mod_security rule set.
• Use strong, unique database credentials — never reuse the root MySQL account.
• Set up a Web Application Firewall (mod_security2) for an extra layer of filtering.
• Regularly back up both the database and wp-content directory.

Performance Optimization

• Enable caching with a plugin like WP Super Cache or W3 Total Cache, paired with Apache’s mod_expires and mod_deflate: <IfModule mod_deflate.c> AddOutputFilterByType DEFLATE text/html text/css application/javascript</IfModule><IfModule mod_expires.c> ExpiresActive On ExpiresByType image/jpeg "access plus 1 month" ExpiresByType text/css "access plus 1 week"</IfModule>
• Switch to PHP-FPM instead of mod_php for better concurrency handling under load.
• Enable OPcache in php.ini to cache compiled PHP bytecode.
• Use a CDN for static assets and images to reduce server load.
• Optimize images before upload — plugins like ShortPixel or Imagify help automate this.
• Tune MaxRequestWorkers in Apache’s MPM config to match your server’s RAM and expected traffic.

Frequently Asked Questions

Do I need mod_rewrite for WordPress? Yes. Pretty permalinks (/blog/my-post/ instead of /?p=123) depend entirely on it.

Can I run multiple WordPress sites on one Apache server? Yes, using separate virtual host files per domain, each pointing to its own document root and database.

Is Apache slower than Nginx for WordPress? Under typical traffic, the difference is negligible, especially when paired with PHP-FPM and caching. Nginx has an edge at very high concurrency, but most sites never reach that threshold.

Should I use mod_php or PHP-FPM? PHP-FPM is generally preferred today for better memory efficiency and concurrent request handling, even when running behind Apache via mod_proxy_fcgi. It also lets you run Apache’s more efficient event MPM, since mod_php requires the older prefork MPM to work safely.

How do I move a WordPress site from staging to production without breaking links? Export the database, then run a search-and-replace on the old domain across the SQL dump before importing it on the new server — a plugin like “Better Search Replace” handles this safely from within WP admin, since a plain text find-and-replace can corrupt PHP-serialized data stored in some WordPress fields.

Do I need a caching plugin if I already configured mod_expires and mod_deflate? They solve different problems. Apache’s mod_expires/mod_deflate control browser-side caching and compression of already-generated pages; a caching plugin (or mod_cache) avoids re-running PHP and database queries on every request by storing a static copy of the rendered page. Using both together gives the best result — fewer server-side computations and smaller, longer-cached responses on the client side.

Summary and Key Takeaways

Setting up Apache for WordPress is a well-worn path for a reason — it’s predictable, flexible, and backed by decades of documentation. The core steps are: install Apache, PHP, and MySQL; configure a virtual host with AllowOverride All; run the WordPress installer; and lock things down with HTTPS and sane file permissions.

Once the base install is running, the real work is ongoing maintenance: keeping software updated, watching logs, and tuning caching as traffic grows. Get those fundamentals right and Apache will happily serve a WordPress site for years without drama.

References

• Apache HTTP Server Documentation
• WordPress Codex: Installing WordPress
• Let’s Encrypt / Certbot Documentation
• Apache mod_rewrite Documentation