How to optimize WordPress with Ubuntu VPS
Ubuntu Virtual Private Server optimized for WordPress
It could be a goo idea to reboot the Ubuntu VPS server once a month.
Start the cron editor with the command
sudo crontab -eThen add the cron command to restart the server
15 15 15 * * root /sbin/shutdown -r now >/dev/null 2>&1
To verify that this works use this command to get the time the server has been up.
sudo uptime -p
This command will tell you when the server was booted
sudo uptime -s
When it is working, don’t fix it!
If you do not use WPcron, just skip this post.
If WPcron works for you, don’t change to cron.
Only use cron if your WPcron does not serve you as needed.
Open the WordPress config file:
sudo nano wp-config.php
To disable the unreliable WordPress cron function add the following statement
define('DISABLE_WP_CRON', true);
Open cron
sudo crontab -e
Then insert the following statement for each WordPress site on your VPS. This example is what you could enter for three WordPress sites on your VPS:
0 */1 * * * wget -q -O - http://site1.com/wp-cron.php?doing_wp_cron >/dev/null 2>&1
1 */1 * * * wget -q -O - http://site2.com/wp-cron.php?doing_wp_cron >/dev/null 2>&1
1 */1 * * * wget -q -O - http://site3.com/wp-cron.php?doing_wp_cron >/dev/null 2>&1
This command is set to run every hour. You can use whatever time you need. Cron requires resources and puts a load on your server. More often than every 15 minutes could be bad. Once every hour should be okay for most scheduling in WordPress.
If you have many WordPress websites, you should set them to run with 1 minute, 5 minutes or 10 minutes spacing to avoid slowing down the server.
If you are running WooCommerc e-commerce, membership site or have som other reason for giving your users access to the admin panel the Clef Two-Factor Authentication WordPress plugin is our recommendation. The Authy Two Factor Authentication is another excellent WordPress plugin. Use one of these plugins to lock down only the accounts with admin rights. Not the user accounts.
If there is only yourself or a few users that need access to your admin panel, then placing a .htaccess file in the /wp-admin/ folder is our choice. This enables you to limit the access by IP address, IP-range or domain names of your choice. You can customize a .htacces file to do pretty much anything. Another advantage is that .htaccess files are fast and easy to disable for a few minutes to work and then re-activating when completed. That can be useful when you need access from a cell phone connection or for some other reason. Another reason is that .htaccess files is not a plugin. The fewer plugins you need, the better.
Your .htaccess file will only work if you also use the CloudFlare IP module when using CloudFlare. This is because this module is required to show your real IP and not the address re-written by CloudFlare. Follow these instructions
sudo mv .htaccess 1htaccess
sudo mv 1htaccess .htaccess
TIP:
Use TextExpander or a similar app on your PC, mobile and tablet to enable and disable the .htaccess.
Create a file with the name .htaccess in:
cd /wp-admin
Then create the file
sudo nano .htaccess
Just replace 888.888.888.888 with your IP’s below.
Then cut-and-paste this content into your .htaccess file:
<LIMIT GET>
Require all denied
# Localhost
Require ip 127.0.0.1
Require ip 888.888.888.888
Require ip 888.888.888.888
# Home
Require ip 888.888.888.888
# VPS servers
Require ip 888.888.888.888
# Work
Require ip 888.888.888.888
# Cabin
Require ip 888.888.888.888
# John Smith
Require ip 888.888.888.888
</LIMIT>
.htaccess is disabled by default in Ubuntu 16. ModRewrite could also be disabled. Here are the two steps needed to activate pretty permalink and all the other stuff related to .htaccess.
sudo a2enmod rewrite sudo service apache2 restart
Open the main configuration file for Apache:
sudo nano /etc/apache2/apache2.conf
Search for the expression “Options Indexes FollowSymLinks“. Do this by pressing “CTRL + W” and paste the phrase into the Nano search field.
Find the following three lines:
Options Indexes FollowSymLinks AllowOverride None Require all granted
Change the word “None” to “All”.
The correct version would look like this:
Options Indexes FollowSymLinks AllowOverride All Require all granted
Then restart Apache again
sudo service apache2 restart
In line with the concept of JeOS security is handled in the cloud and not on Ubuntu or in WordPress.
CloudFlare has some security features that will protect your server and WordPress well.
The firewall is available in your AWS control panel. Block any port and service not needed. Allow only the required IP addresses. Furthermore, CloudFlare provides some WordPress specific and general security features.
The only port that needs to be open on the server is 443 for web traffic and port 22 for your administration. All other ports should be closed.
Port 443 should only be open for the IP-range belonging to CloudFlare and perhaps the IP of your PC if you choose not to use VPN as described below.
When you are using VPN as described below, then connections to port 443 should only be allowed from the IP ranges belonging to CloudFlare.
Port 22 should only be open for the IP address belonging to the IP of your devices. Most of the time this would be only a single IP or a small IP-range.
Port 11211 for ElastiCahe – default security group
Port 3306 for Amazon – defult security group
Port 443 incoming from only CloudFlare.com IP-range
Port 443 outgoing for everything 0.0.0.0
Port 22 incoming and outgoing from only your office IP address.
When out of office log in to http://AWS.Amazon.com and add your current IP in the firewall. Delete the record when back in office.
The WordPress plugin Postman SMTP Mailer/Email Log uses OAuth 2.0 for sending mail using port 443. By using this plugin then there is no need for opening additional ports for outgoing traffic in the AWS firewall.
If the bad guys should get control over your server. Sometimes they start servers and services. Then they hope for that the service can run undetected for a long time. By blocking all outgoing traffic except 22 and 443, using your server undetected would become more difficult.
You can bypass CloudFlare and connect directly to your servers WordPress admin panel. Bypassing CloudFlare enables you to use even stricter security policy rules at CloudFlare. A good practice is to connect to WordPress directly on the IP using the hosts file. We have made a list with some useful tools to manage your hosts file easier and faster.
Alternatively, could you connect directly to the WordPress admin panel by using a VPN connection through SSH.
SSH can acts as an excellent VPN server using SOCKS. When you need to access WordPress admin panel from some different IP then open port 22 for any IP. Access the server admin pages using VPN through the SOCKS proxy. SOCKS is a fast and easy to set up. It is also fast to enable and disable. VPN provides secure access to the WordPress admin panel without going through the security systems at CloudFlare. There is no software to install on the server. There is no software to install on your MAC or Windows. Another example of the JeOS concept.
Budget minded means more than dollars leaving your account. Budget minded means the working hours needed to keep servers and sites running.
WP JeOS is a budget minded VPS server. That is why running many servers is always an option and often makes sense. It might come a day when you just can’t afford downtime on your WooCommerce. Then it might make sense to move WooCommerce to a dedicated WP JeOs server that just runs this single site. Furter down the road there might be a WP site that just won’t behave, so you decide to put it on another dedicated WP JeOS server to more easily debug it. Suddenly you ended up with 5 WP JeOS servers with a total of 25 WordPress sites. That’s where WordShell comes in.
A great timesaver with WordShell is the way it handles plugins that come from other places than the WordPress.ORG repository. This usually paid WordPress plugins will often end up as an orphan somewhere hidden on your hard drive. With WordShell, they are all gathered in a folder and can be used for both upgrade and install.
You need to get a list of plugins on all 25 WordPress sites on 5 VPS servers that needs updating. With your mobile, tablet or PC SSH into your server and issue the command.
wordshell all --listupdates --everything
Then update Akismet on all 25 WordPress sites on five servers from your mobile, tablet or PC by typing:
wordshell all kismet --update --latest
If you have TextExpander on your mobile, tablet and PC, you could just type the abbreviation
Zlup
moreover, then the abbreviation to upgrade
Zup
Run WordShell from a script on the server.
To fully automate run WordShell and WP-CLI as a cron job.
WP-CLI is a free solution for managing a single WordPress on a single server using the command line.
WordShell overlaps WP-CLI and gives you, even more, alternatives, so you simultaneously can perform actions on many WordPress sites located on different servers. It is a good choice to use both WP-CLI and WordShell.
Command line gives you the flexibility to manage WordPress from any device regardless the quality of the Internet connection.
The answer to the questions: Use both.
Things tend to go wrong on holidays and when you are out traveling and away from office. Command line gives you the flexibility to manage sites fast from mobile, tablet and PC from remote low bandwidth areas. I huge timesaver is to bring with a small Bluetooth keyboard. You can find little collapsible ones that easily fits into your pocket. Running SSH from a proper keyboard is much faster.
With just a few websites it might be faster to use UpdraftPlus Migrator to move from the legacy server to the new server. This is an alternative solution.
On the new server create the root for each WordPress site under
sudo cd /var/www/
sudo mkdir /var/www/mydomain.com
To avoid updating the Apache config files, this should be the same folder structure as on the legacy server.
Make a backup of the default Apache config files on the target server.
cd /etc/apache2/sites-available
Create a zip file with the configuration
sudo zip new-apache-config-files.zip *.conf
Copy the zip file to somewhere where you can access it with a browser.
sudo cp /etc/apache2/sites-available/new-apache-config-files.zip /var/www/html/new-apache-config-files.zip
Copy the Apache config files from the legacy server and place them on the new server.
cd /etc/apache2/sites-available
Create the zip file with the configuration:
sudo zip old-apache-config-files.zip *.conf
Copy the Apache config file to somewhere the zip file can be accessed with a browser if needed.
sudo cp /etc/apache2/sites-available/old-apache-config-files.zip /var/www/html/old-apache-config-files.zip
On the target server download the config files.
sudo wget http://www.domainname.com/old-apache-config-files.zip
Unzip the Apache config files on the new server
sudo unzip old-apache-config-files.zip
sudo mv *.conf /etc/apache2/sites-available
It is time to activate the sites on the new server.
sudo cd /etc/apache2/sites-available
Enable the Apache config files
sudo a2ensite *.conf
Restart Apache and verify that it works
sudo service apache2 restart
After the migration, remove the zip files:
sudo /var/www/html/rm *.zip