Overview

You will learn about various types of hosting services and how to interpret CPU and storage specs. You will also look at OS distributions and images. You will provision a new virtual or dedicated server, add appropriate DNS records and pull your config repository using SSH.

You will put safe defaults in place from day one. You will create a non-root user, tune SSH and sudo, install and configure fail2ban to reduce brute force attempts, and enable a simple firewall that allows only required services. You will also enable unattended security updates and configure logrotate.

You will install Nginx and PHP-FPM, configure them for WordPress, set sane limits for workers and resources, route traffic securely via Cloudflare, verify your PHP configuration, log real client IPs, and manage logs with logrotate.

You will install MariaDB, understand its configuration and data files, tune InnoDB, create a dedicated database and user for WordPress, enable and analyze the slow query log, and install phpMyAdmin securely behind SSH.

You will install WP-CLI and use it to install WordPress core, disable dangerous commands with YAML, configure system cron for WP-Cron, and set up logging for WP-CLI errors, cron runs, and commands.

You will install Postfix and configure it to relay email through an SMTP service of your choice. You will then make sure PHP is configured to relay mail through the postdrop service. You will verify delivery and health of a test email from wp_mail().

You will install and configure Redis for object caching in WordPress. You will also install a page caching plugin of your choice. You will also ensure you can measure response times, and easily find the slowest requests from your server logs. You will run some load test against your application.

You will configure fail2ban for bruteforce protection against common attack vectors in WordPress: including application passwords, XML-RPC and wp-login.php. You will update your Nginx configuration to ensure sensitive files remain private and enable rate limiting. You will write some helper scripts to determine and quickly ban bad actors from server logs.

You will determine everything that needs to be backed up. You will create scheduled jobs to perform on-site backups, and ship them to an off-site location. You will configure a retention policy to delete old backups. You will also learn how to quickly make on-demand backups and explore existing backups.

You will ensure all your services can survive a server reboot. You will create alerts for various system resources and spikes in errors, high response times, slow queries, email delivery errors and more. You will also set up a third-party uptime monitor.

You will learn how to schedule core, theme and plugin updates. You will also write and test a helper script to roll back updates when things break. You will learn how to put your site into maintenance mode to perform PHP and MariaDB upgrades.