As its a low traffic site I can do it on one of Google’s smallest servers, again using an e2-micro configured with Ubuntu 24.04 Minimal.

Caddy installation is detailed here: https://caddyserver.com/docs/install#debian-ubuntu-raspbian

sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https curl
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
sudo apt update
sudo apt install caddy

I then installed the stuff that I need that’s missing from Ubuntu Minimal:

sudo apt install bash-completion nano htop cron

I always change the history size in the shell so it keeps more, changing HISTSIZE=100000
HISTFILESIZE=20000:

nano .bashrc

With only 1GB ram, I always install zswap:

sudo nano /etc/default/grub.d/50-cloudimg-settings.cfg
GRUB_CMDLINE_LINUX_DEFAULT="console=ttyS0,115200 zswap.enabled=1 zswap.shrinker_enabled=1 zswap.compressor=zstd zswap.zpool=zsmalloc"
sudo update-grub

sudo fallocate -l 1G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo nano /etc/fstab
/swapfile swap swap defaults 0 0

sudo crontab -e
@reboot echo zstd > /sys/module/zswap/parameters/compressor

If using btrfs then this has to be used as it needs to be created without copy-on-write:
sudo btrfs filesystem mkswapfile –size 1G /swapfile

Use swapon or reboot to activate. For some reason the zswap compressor isn’t enabled at boot time, so the kludge in a crontab activates it.
It can be checked with:

grep -R . /sys/module/zswap/parameters

I normally configure swappiness which prevents kswapd kicking in and slowing everything down:

sudo nano /etc/sysctl.conf
vm.swappiness = 1

I got the latest WordPress and installed it in the usual place:

wget https://wordpress.org/latest.tar.gz
tar zxvf latest.tar.gz
sudo mkdir -p /var/www/html
sudo mv wordpress/ /var/www/html/
sudo chown -R www-data: /var/www/html/wordpress/

I then installed mysql and php:

sudo apt install mariadb-server php-apcu php-fpm php-mysql php-curl php-xml php-imagick php-mbstring php-zip php-gd php-intl

I then configured mysql:

sudo mysql_secure_installation
sudo mysql

CREATE USER "USER"@"localhost" IDENTIFIED BY "PASSWORD";
CREATE DATABASE xyze;
GRANT ALL PRIVILEGES ON xyze.* TO "USER"@"localhost";
FLUSH PRIVILEGES;

This says that character set and collation are defaults so no need to specify explicitly: https://dev.mysql.com/doc/refman/8.0/en/charset-server.html

Caddy comes with a sample config: /etc/caddy/Caddyfile which will display a sample webpage when tested in the browser. Searching Google for a config brought up: https://caddy.community/t/setting-up-wordpress-with-caddy-on-ubuntu/18448 which I’ve altered slightly:

xyze.co.uk {
	redir https://www.xyze.co.uk
}

www.xyze.co.uk {
    # good practice to signal on behalf of who 
    # are the certs getting issue
	tls james@xyze.co.uk

    # logs are optional
	log {
		output file /var/log/caddy/xyze.co.uk
		format console
	}

	root * /var/www/html/wordpress
	encode zstd gzip
	file_server
	php_fastcgi unix//run/php/php-fpm.sock

	@disallowed {
		path /xmlrpc.php
		path *.sql
		path /wp-content/uploads/*.php
	}

	rewrite @disallowed '/index.php'
}

Letsencrypt is configured by Caddy automatically so no Certbot configuration is necessary. I then set up WordPress via the browser using the mysql config from earlier.

I then dumped the previous db and loaded it into the new one:

mysqldump -uUSER -pPASSWORD xyze > /var/www/html/wordpress/sql/wp-backup.sql
mysql -uUSER -pPASSWORD xyze < /var/www/html/wordpress/sql/wp-backup.sql

Logging into WordPress needed a db update and from there I configured the caching.
I’ve found that apcu is faster than Redis so have installed this one which needs the php-apcu I installed earlier:
https://wordpress.org/plugins/atec-cache-apcu/ This plugin gives opcache recommended settings: https://wordpress.org/plugins/atec-cache-info/ which are configured in:

sudo nano /etc/php/8.3/fpm/php.ini
sudo systemctl restart php8.3-fpm caddy

Unfortunately their page cache seems buggy and they’ve superseded it in one of their other plugins, so I’m using https://wordpress.org/plugins/powered-cache/ which I’ve used successfully before. The other plugin needed is the Cloudflare one which will update Cloudflare when a new post is made: https://wordpress.org/plugins/cloudflare/

I like to backup the db every night to make it ready for the external rsync backup:

sudo crontab -l

# m h  dom mon dow   command
@reboot echo zstd > /sys/module/zswap/parameters/compressor
35 0 * * * /usr/bin/mysqldump -uUSER -pPASSWORD xyze > /var/www/html/wordpress/sql/wp-backup.sql

I’ve been meaning to try Lighttpd for ages as I wanted to downgrade my server to save money and it takes the least amount of memory compared with apache or nginx.

Installed with the help of:
https://www.how2shout.com/linux/install-wordpress-on-lighttpd-web-server-ubuntu/
https://www.howtoforge.com/how-to-install-lighttpd-with-php-and-mariadb-on-debian-10/
But had to make changes too.

james@instance-1:~$ sudo mysql
CREATE DATABASE mydatabase CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
create user 'demoh2s'@'localhost' identified by 'password';
GRANT ALL PRIVILEGES ON `mydatabase`.* to `demoh2s`@localhost;
exit

james@instance-1:~$ sudo apt install php php-cgi php-cli php-fpm php-curl php-gd php-mysql php-mbstring zip unzip php-zip php-xml php-intl php-imagick apache2-

I’m installing on Ubuntu 22.04 Minimal https://wiki.ubuntu.com/Minimal on Google’s cloud platform. I try to keep original config files intact so have only altered the server.document-root and rewrite rules in lighttpd.conf

There is a tool similar to the one in apache to install the symlinks in /etc/lighttpd/conf-enabled

james@instance-1:~$ sudo lighty-enable-mod fastcgi fastcgi-php auth deflate rewrite accesslog

Rewriting

At first all the permalinks were showing ‘index.php’ which apache wasn’t doing before so I gathered together some rewriting rules from various places via Google. Through trial and error I ascertained that the order is significant, and I’ve included the rules I found but commented out. These still aren’t definitive but seem to be a work in progress and WordPress only seems to need the 4 uncommented ones at present. You can Google them to see where they came from:

lighttpd "^/(wp-admin.+).*/?" => "$0"

The Lighttpd wiki is very useful too: https://redmine.lighttpd.net/projects/lighttpd/wiki/Docs

james@instance-1:/etc/lighttpd$ cat lighttpd.conf
server.modules = (
	"mod_indexfile",
	"mod_access",
	"mod_alias",
 	"mod_redirect",
)

#url.rewrite = (
#"^/?$" => "/index.php",
# Exclude common directories
#"^/(wp-.+)$" => "$0",
# Exclude letsencrypt certbot
#"^/(.well-.+)$" => "$0",
#"^/xmlrpc.php" => "$0",
#"^/sitemap.xml" => "$0",
# Handle permalinks and feeds
#"^/(.+)/?$" => "/index.php/$1"
#)

url.rewrite-if-not-file = (
 "^/(wp-admin.+).*/?" => "$0",
# Exclude letsencrypt certbot
 "^/(.well-.+)$" => "$0",
# REST API for block editor & Jetpack 
 "(?:\?(.*))?$" => "/index.php?$1",
# "(\/styles\/|\/images\/|\/scripts\/)" => "$0",
 "^/(wp-.+).*/?" => "$0",
# "^/images/.*/?" => "$0",
# "^/temp/.*/?" => "$0",
# "^/keyword/([A-Za-z_0-9\-]+)/?$" => "/index.php?keyword=$1",
# "^/.*?(\?.*)?$" => "/index.php$1"
)

server.document-root        = "/var/www/html/xyze.co.uk"
.
.
.

You need to set the permalinks in wp-admin as well under Settings, Permalinks:

Custom Structure https://www.xyze.co.uk/index.php /%postname%/

WordPress (this is not needed if using Let’s Encrypt)

The way I’ve installed WordPress before is to just use http and then use the ‘Flexible’ shared Cloudflare certificate that encrypts traffic from the user to Cloudflare but then its served to Cloudflare using http. This has worked fine with apache but both the classic editor and block editor weren’t working in Lighttpd and searching with the error from the block editor I stumbled across this:
https://wordpress.org/support/topic/publishing-failed-you-are-probably-offline/

james@instance-1:~$ cat /var/www/html/xyze.co.uk/wp-config.php

/* Add any custom values between this line and the "stop editing" line. */

define( 'WP_SITEURL', 'http://xyze.co.uk' );
define( 'WP_HOME', 'http://xyze.co.uk' );

/* That's all, stop editing! Happy publishing. */

This allowed me to use http if I wanted to add or edit a post and Cloudflare’s Flexible https worked too.

Let’s Encrypt

However now we have Let’s Encrypt with certbot, its better to have proper https.

james@instance-1:~$ sudo apt install certbot
james@instance-1:~$ sudo certbot certonly --webroot -w /var/www/html/xyze.co.uk/ -d www.xyze.co.uk

https://eff-certbot.readthedocs.io/en/stable/using.html
Says that “For historical reasons, the containing directories are created with permissions of 0700 meaning that certificates are accessible only to servers that run as the root user. If you will never downgrade to an older version of Certbot, then you can safely fix this using chmod 0755 /etc/letsencrypt/{live,archive}”
Which I did.

This time I copied /etc/lighttpd/conf-available/10-ssl.conf to 10-ssl-xyze.conf and then created the symlink manually.

james@instance-1:/etc/lighttpd/conf-enabled$ sudo ln -s ../conf-available/10-ssl-xyze.conf
james@instance-1:/etc/lighttpd/conf-enabled$ cat 10-ssl-xyze.conf
# /usr/share/doc/lighttpd/ssl.txt
# -*- conflicts: mbedtls, gnutls, nss, wolfssl -*-

server.modules += ( "mod_openssl" )

# ssl.* in global scope gets inherited by
#   $SERVER["socket"] == "..." { ssl.engine = "enable" }
#ssl.pemfile = "/etc/lighttpd/server.pem"
ssl.pemfile = "/etc/letsencrypt/live/www.xyze.co.uk/fullchain.pem" # Combined Certificate
ssl.privkey = "/etc/letsencrypt/live/www.xyze.co.uk/privkey.pem"

ssl.cipher-list = "HIGH"

$SERVER["socket"] == ":443" {
ssl.engine = "enable"
}

$HTTP["scheme"] == "http" {
$HTTP["host"] == "www.xyze.co.uk" { # HTTP URL
url.redirect = ("/.*" => "https://www.xyze.co.uk$0") # Redirection HTTPS URL
}
}

include_shell "/usr/share/lighttpd/use-ipv6.pl 443"

At first I copied the example from the howtoforge link above but lighttpd kept failing to restart producing an error like this: ssl.pemfile has to be set in same $SERVER[“socket”] scope as other ssl.* directives

Eventually I worked out that the pem files had to be in the global file or in all of the socket, scheme, and host directives, so I moved it out of the socket directive so they’re now global and inherited by all of them.

Finally I changed the wp-config.php to https – or you could comment them out as long as they’re set to https in Settings, General on the WordPress Dashboard. And Cloudflare can now use ‘Full’ encryption and ‘Always Use HTTPS’.

Cloudflare

I added some Firewall rules using the dash console:

WordPress Spam Filter
(http.request.uri.path contains "wp-comments-post.php") or (http.request.uri.path contains "wp-login.php")
Managed Challenge

Protect the wp-admin Area
(http.request.uri.path contains "/wp-admin/" and not http.request.uri.path contains "/wp-admin/admin-ajax.php" and not http.request.uri.path contains "/wp-admin/theme-editor.php")
Managed Challenge

Block xmlrpc.php Attacks
(http.request.uri.path contains "/xmlrpc.php")
Block

Block wp-login
(http.request.uri.path contains "wp-login.php" and ip.geoip.country ne "GB")
Block

Postscript

I followed a guide to install Redis here except I installed the php client as it seemed to work faster. This uses a WordPress plugin from here. Php will need reloading but I rebooted as I’d also installed some kernel updates.

james@instance-1:~$ sudo apt install php-redis

I also installed a Cloudflare cache plugin from here which needs your api key from Cloudflare and works really well. There is also the W3 Total Cache in place of the redis cache plugin.