Host WordPress on OpenLiteSpeed + MariaDB, with Free HTTPS

WordPress runs on roughly two of every five websites on the internet — and the single biggest thing separating a fast one from a slow one is the web server underneath it. This guide uses OpenLiteSpeed, the free, open-source edition of the LiteSpeed web server, paired with MariaDB and a free Let's Encrypt certificate. You'll go from a fresh server to a live, HTTPS-secured WordPress site you fully own.

Every command below is meant to be copied and pasted in order. Alongside each step you'll find a short "why this matters" note — skim past them if you're a veteran, or read them if you want to understand what you're actually doing instead of just pasting blindly.

Why OpenLiteSpeed for WordPress?

Most shared hosting — cPanel included — still runs on stock Apache, often with no full-page cache at all. OpenLiteSpeed wins for WordPress specifically, for four concrete reasons:

• LiteSpeed Cache (LSCache) — a server-level, full-page cache built into the web server and controlled by the official WordPress plugin. It's dramatically faster than the bolt-on PHP caching plugins bolted onto a default cPanel/Apache setup, because the cache lives in the server itself, not in PHP.
• HTTP/3 and QUIC, out of the box — the newest, fastest transport protocols are on by default, so visitors on flaky mobile connections still get a snappy site.
• An event-driven engine that holds thousands of simultaneous connections on modest RAM — unlike Apache's one-process-per-connection model, which is why a stock cPanel box runs out of headroom so much faster.
• A built-in admin panel, free — the WebAdmin console handles virtual hosts, SSL, PHP settings, and logs from your browser, no config-file editing required. For a single site, that alone covers most of what people pay a cPanel license for.

Before you start

You'll need three things:

• A cloud server running a fresh Ubuntu 24.04 install (its packaged MariaDB is 10.11, the version WordPress recommends; 22.04 ships 10.6, which reached end of life in July 2026), with root (or sudo) SSH access. 1 GB RAM works for a single site; 2 GB+ is comfortable. An Ace-Host cloud server is an ideal home for this: the hardware under you is ours, built from components we've tested and burned in before production, and so is the network it sits on, routed on our own ASN. Same family owners since 2003.
• A domain name you control, so you can point it at the server and issue a real SSL certificate.
• Five minutes of patience. That's it.

In your DNS provider, create two A records pointing at your server's public IP address — one for the bare domain and one for www:

# Type   Name   Value
A        @      YOUR_SERVER_IP
A        www    YOUR_SERVER_IP

Give DNS a few minutes to propagate, then connect to your server over SSH and bring it fully up to date:

ssh root@YOUR_SERVER_IP
apt update && apt upgrade -y

OpenLiteSpeed isn't in Ubuntu's default repositories, so add LiteSpeed's official repo, then install the server and start it:

wget -O - https://repo.litespeed.sh | sudo bash
apt update
apt install openlitespeed -y
systemctl enable --now lshttpd

Confirm it's running:

systemctl status lshttpd --no-pager

OpenLiteSpeed uses its own PHP build called LSPHP, which talks to the server over the fast LSAPI protocol instead of PHP-FPM. Install PHP 8.4 plus the modules WordPress wants. Both 8.3 and 8.4 run WordPress fine, but 8.3 left active support at the end of 2025 and its security fixes stop a full year before 8.4's do — on a server you're building today, take the longer runway:

apt install lsphp84 lsphp84-common lsphp84-mysql lsphp84-curl \
  lsphp84-imagick lsphp84-opcache lsphp84-intl -y

MariaDB is the open-source database that stores everything WordPress remembers. Install it, start it, then run the built-in hardening wizard:

apt install mariadb-server mariadb-client -y
systemctl enable --now mariadb
mysql_secure_installation

When the wizard asks, answer like this: switch to unix_socket auth (or set a root password), then Y to remove anonymous users, Y to disallow remote root login, Y to drop the test database, and Y to reload privileges.

Open the database shell and create a dedicated database and user for this one site. Replace ChangeMe_Strong#Pass with a long random password:

mysql -u root -p

CREATE DATABASE wordpress DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'wp_user'@'localhost' IDENTIFIED BY 'ChangeMe_Strong#Pass';
GRANT ALL PRIVILEGES ON wordpress.* TO 'wp_user'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Set your OpenLiteSpeed dashboard login:

/usr/local/lsws/admin/misc/admpass.sh

Before you open that console in a browser, turn on the firewall. Replace YOUR_HOME_IP with your own public IP address:

ufw allow OpenSSH
ufw allow 80,443/tcp
ufw allow 443/udp
ufw allow from YOUR_HOME_IP to any port 7080 proto tcp
ufw enable

Now visit https://YOUR_SERVER_IP:7080 and log in with the username and password you just set. Your browser will warn about the certificate on this admin port — that's expected; continue anyway.

Back in your SSH session, download the latest WordPress into the server's web directory and hand ownership to the web-server user:

cd /usr/local/lsws/Example/html
wget https://wordpress.org/latest.tar.gz
tar -xzf latest.tar.gz
chown -R nobody:nogroup wordpress

Then, in the WebAdmin console (port 7080), make two small changes and restart:

• Virtual Hosts → Example → General: set Document Root to $VH_ROOT/html/wordpress/
• Listeners → Default → View → Example mapping: add your domain (e.g. yourdomain.com) so the server answers for it on port 80
• Click the green Graceful Restart button (top right) to apply

Open http://yourdomain.com in a browser. WordPress's famous five-minute installer appears. Choose your language, then enter the database details from Step 5:

Database Name      wordpress
Username           wp_user
Password           ChangeMe_Strong#Pass
Database Host      localhost
Table Prefix       wp_

Pick a site title, create your admin account with a strong, unique password, and click install. You now have a live WordPress site.

A live site isn't done until it's encrypted. Install Certbot and issue a free certificate for both your domain and its www version:

apt install certbot -y
certbot certonly --webroot \
  -w /usr/local/lsws/Example/html/wordpress \
  -d yourdomain.com -d www.yourdomain.com

Certbot saves your certificate to /etc/letsencrypt/live/yourdomain.com/. Now wire it into OpenLiteSpeed in the WebAdmin console:

• Listeners → Add: create a listener named SSL, Port 443, Secure = Yes, then save and map your domain to the Example virtual host
• On that listener's SSL tab, set:

Private Key File    /etc/letsencrypt/live/yourdomain.com/privkey.pem
Certificate File    /etc/letsencrypt/live/yourdomain.com/fullchain.pem

Hit Graceful Restart. Then make HTTPS the default by adding a redirect under Virtual Hosts → Example → Rewrite → Rewrite Rules:

RewriteCond %{HTTPS} !on
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Let's Encrypt certificates are short-lived by design, and getting shorter, so Certbot renews them automatically. What it won't do on its own is tell OpenLiteSpeed, which keeps serving the old certificate from memory until it restarts. Give Certbot a deploy hook that reloads OpenLiteSpeed after every successful renewal, then rehearse a renewal:

printf '#!/bin/sh\n/usr/local/lsws/bin/lswsctrl restart\n' \
  > /etc/letsencrypt/renewal-hooks/deploy/openlitespeed
chmod +x /etc/letsencrypt/renewal-hooks/deploy/openlitespeed
certbot renew --dry-run

This is the payoff step — and the one generic guides skip. In your WordPress dashboard, go to Plugins → Add New, search LiteSpeed Cache, install and activate it. It auto-detects OpenLiteSpeed and turns on server-level full-page caching, image optimization, and HTTP/3 delivery.

Finally, one last hardening touch. Your firewall has been up since Step 6 — confirm it still reads the way you left it, with 7080 restricted to your own address:

ufw status verbose

Then disable the in-dashboard file editor so a compromised login can't rewrite your site's code — add this line to /usr/local/lsws/Example/html/wordpress/wp-config.php, above the comment that says That's all, stop editing! Don't just append it to the end of the file: the file's last line loads WordPress and every plugin, so a setting pasted after it arrives too late for them:

define('DISALLOW_FILE_EDIT', true);

WordPress itself ships security releases that matter just as much: CVE-2026-87902, fixed in 7.1.2 in September 2026, was exploited within days. Our security news covers the ones worth acting on.

Prefer point-and-click? The 1-click alternative

Everything above gives you total control — and total responsibility. If you'd rather manage sites, email, DNS, SSL, and backups from a clean dashboard instead of the command line, run your cloud server with the Enhance control panel. It installs the whole stack for you and turns site creation into a few clicks, while you keep the full power of a real server underneath.

Enhance gives you a modern dashboard with one-click WordPress installs and migrations, automatic SSL, scheduled backups with one-click restore, DNS management, email, and built-in security — every site in its own container, brute-force protection, and a ModSecurity web application firewall with pre-configured OWASP rules. It's the convenience people love about shared hosting, sitting on top of a server you actually own.

Why a cloud server beats shared hosting

Shared cPanel hosting is affordable because the machine is shared: your site draws from one pool of CPU, memory, and disk alongside every other account on the server, usually on stock Apache with whatever caching the host has configured. For many sites that's the right trade. Many hosts cap each account, but the caps only divide one machine: a busy neighbor — a runaway script, a traffic spike — still shares your disks and database server, and you can't tune the server to fit your site.

A cloud server changes that. The root access is yours, the stack is your call, and on Dedicated CPU plans the cores are reserved for you alone. With Enhance handling the panel for pennies, you give up almost none of the convenience. Here's the honest comparison:

Ready to build it? Spin up an Ace-Host cloud server, or talk to a system administrator who will set the whole thing up with you. Paying for a cPanel license somewhere else today? Here is what moving off cPanel involves.

Frequently asked questions