⚙️ WordPress Installation and Configuration

Three Environments

Professional WordPress work flows through three environments, each with a different job. Changes travel left-to-right; they never jump straight to production.

💡 A useful analogy: Local is your private workshop, staging is the showroom before opening day, and production is the storefront full of customers. You test the risky stuff in the workshop — never on the sales floor.

Local Development

A local install runs WordPress on your own machine: fast, private, offline-capable, and impossible to break for anyone but you. Three options cover most needs.

LocalWP — the easiest start

LocalWP is a purpose-built desktop app: it bundles the web server, PHP, and MySQL, and creates a site in a few clicks with SSL and shareable live links. Best for beginners and WordPress-only work.

1. Download and install LocalWP.
2. Click + Create a new site and follow the wizard.
3. Pick a name, choose Preferred or custom (PHP 8.2, MySQL 8) settings, and set an admin user that is not "admin".
4. Start the site and open WP Admin.

Docker — reproducible and team-friendly

Docker containers give every teammate an identical, version-controlled environment. A minimal docker-compose.yml:

services:
  db:
    image: mysql:8.0
    volumes:
      - db_data:/var/lib/mysql
    restart: always
    environment:
      MYSQL_ROOT_PASSWORD: rootpass
      MYSQL_DATABASE: wordpress
      MYSQL_USER: wordpress
      MYSQL_PASSWORD: wordpress

  wordpress:
    depends_on:
      - db
    image: wordpress:php8.2-apache
    ports:
      - "8000:80"
    restart: always
    volumes:
      - ./wp-content:/var/www/html/wp-content
    environment:
      WORDPRESS_DB_HOST: db:3306
      WORDPRESS_DB_USER: wordpress
      WORDPRESS_DB_PASSWORD: wordpress
      WORDPRESS_DB_NAME: wordpress

volumes:
  db_data: {}

# Bring the stack up, then visit http://localhost:8000
docker compose up -d

# Follow logs, or tear it all down
docker compose logs -f
docker compose down

XAMPP / MAMP — the general-purpose stack

XAMPP (Windows/Linux) and MAMP (macOS) install Apache, MySQL, and PHP for any PHP project. You download WordPress yourself, drop it in the web root, create a database in phpMyAdmin, and run the installer. More manual, but flexible if you juggle multiple technologies.

The Classic Installation

Even with one-click installers everywhere, knowing the manual "famous 5-minute install" demystifies what those tools do for you.

Step 1 — Create the database

CREATE DATABASE wordpress CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'wp_user'@'localhost' IDENTIFIED BY 'a-strong-password';
GRANT ALL PRIVILEGES ON wordpress.* TO 'wp_user'@'localhost';
FLUSH PRIVILEGES;

Step 2 — Configure the database connection

Copy wp-config-sample.php to wp-config.php and fill in the credentials:

<?php
define( 'DB_NAME', 'wordpress' );
define( 'DB_USER', 'wp_user' );
define( 'DB_PASSWORD', 'a-strong-password' );
define( 'DB_HOST', 'localhost' );
define( 'DB_CHARSET', 'utf8mb4' );
define( 'DB_COLLATE', '' );

https://api.wordpress.org/secret-key/1.1/salt/

Step 3 — Run the installer

Visit the site URL. WordPress creates the tables and asks for a site title, admin username (not "admin"), a strong password, and an email. Click install, and you can log in at /wp-login.php.

Production Hosting

Where you host production is a trade-off between cost, control, and how much server management you want to own.

Configuring wp-config.php

wp-config.php is mission control. Beyond the database block, a handful of constants shape debugging, security, and performance — and they should differ by environment.

Debugging (development only)

<?php
define( 'WP_DEBUG', true );          // turn on error reporting
define( 'WP_DEBUG_LOG', true );      // write to wp-content/debug.log
define( 'WP_DEBUG_DISPLAY', false ); // don't show errors to visitors
define( 'SCRIPT_DEBUG', true );      // load unminified core CSS/JS

Performance & housekeeping

<?php
define( 'WP_MEMORY_LIMIT', '256M' );
define( 'WP_POST_REVISIONS', 5 );    // cap revisions instead of unlimited
define( 'AUTOSAVE_INTERVAL', 160 );  // seconds between autosaves
define( 'DISALLOW_FILE_EDIT', true );// disable the built-in code editor

Environment type

Modern WordPress exposes wp_get_environment_type(), driven by this constant. Use it to branch settings:

<?php
define( 'WP_ENVIRONMENT_TYPE', 'development' ); // or 'staging' / 'production'

switch ( wp_get_environment_type() ) {
    case 'development':
        define( 'WP_DEBUG', true );
        define( 'WP_DEBUG_DISPLAY', true );
        break;
    case 'staging':
        define( 'WP_DEBUG', true );
        define( 'WP_DEBUG_DISPLAY', false );
        break;
    case 'production':
        define( 'WP_DEBUG', false );
        define( 'DISALLOW_FILE_EDIT', true );
        break;
}

Security Hardening

Security is a process, not a checkbox. These measures raise the bar significantly for very little effort.

Example server-level protections (Apache):

# Block direct access to wp-config.php
<Files wp-config.php>
    Require all denied
</Files>

# Disable XML-RPC if you don't use it
<Files xmlrpc.php>
    Require all denied
</Files>

Note the modern Require all denied directive — the old order deny,allow syntax was removed in Apache 2.4.

You can also trim WordPress's public fingerprint in a theme or small plugin:

<?php
// Remove the WordPress version meta tag and feed generator.
add_filter( 'the_generator', '__return_empty_string' );

// Disable XML-RPC entirely.
add_filter( 'xmlrpc_enabled', '__return_false' );

Performance Tuning

Speed improves user experience and SEO. Optimize at three layers.

Object cache constants (Redis example)

<?php
define( 'WP_CACHE', true );
define( 'WP_REDIS_HOST', '127.0.0.1' );
define( 'WP_REDIS_PORT', 6379 );

Defer non-critical JavaScript

<?php
add_filter( 'script_loader_tag', function ( string $tag, string $handle ): string {
    $defer = [ 'my-theme-script', 'analytics' ];
    if ( ! is_admin() && in_array( $handle, $defer, true ) ) {
        return str_replace( ' src', ' defer src', $tag );
    }
    return $tag;
}, 10, 2 );

Migrating Sites

Moving a site between environments is routine but error-prone. The critical, easily-forgotten step is the URL search-and-replace — done correctly so serialized data survives.

The WP-CLI way (scriptable, reliable)

# On the source: export the database
wp db export backup.sql

# On the target: import it
wp db import backup.sql

# Replace URLs safely — WP-CLI handles serialized PHP data correctly
wp search-replace 'https://old-domain.com' 'https://new-domain.com' --all-tables --skip-columns=guid

# Refresh permalinks after moving
wp rewrite flush

Plugin and host tools

For non-CLI workflows, Duplicator, All-in-One WP Migration, and WP Migrate package files + database into a portable bundle. Managed hosts (WP Engine, Kinsta, SiteGround, Flywheel) offer one-click migrations tuned to their platform.

Hands-on: Docker WordPress

  wordpress:
    # ...as before...
    environment:
      WORDPRESS_DB_HOST: db:3306
      WORDPRESS_DB_USER: wordpress
      WORDPRESS_DB_PASSWORD: wordpress
      WORDPRESS_DB_NAME: wordpress
      WORDPRESS_CONFIG_EXTRA: |
        define( 'WP_ENVIRONMENT_TYPE', 'development' );
        define( 'WP_DEBUG', true );
        define( 'WP_DEBUG_LOG', true );
        define( 'WP_DEBUG_DISPLAY', false );

docker compose down
docker compose up -d
# Trigger a notice, then read the log:
docker compose exec wordpress tail -n 20 wp-content/debug.log

Summary & Quiz

📚 Further Reading

• WordPress.org — Installation Guide
• wp-config.php Reference
• Hardening WordPress
• WP-CLI search-replace

🚀 What's Next?

With WordPress installed and configured, you're ready to start building the front end. Next up: how themes work — the theme file structure and the template hierarchy that decides which file renders each page.