# WordPress

Native WordPress sites with their own PHP-FPM and MySQL, HTTPS, backups, staging, migration and full editing over MCP.

Source: https://ardumaker.com/en/docs/wordpress/

- Category: Servers and infrastructure
- Status: Available
- Requirements: An active VPS with the `wordpress` feature available; At least 256 MB of RAM and 1 GB of disk free; For a custom domain: its DNS must point to the VPS
- MCP tools (Read only): `listar_sitios_wordpress`, `ver_sitio_wordpress`, `leer_logs_wordpress`, `ver_web_wordpress`, `listar_backups_wordpress`
- MCP tools (Write or modify): `instalar_app`, `probar_web_wordpress`, `controlar_cache_wordpress`, `crear_backup_wordpress`, `crear_staging_wordpress`, `cambiar_direccion_wordpress`, `revelar_credencial_app`, `controlar_app`
- MCP tools (Destructive): `editar_contenido_wordpress`, `editar_menus_wordpress`, `editar_medios_wordpress`, `configurar_sitio_wordpress`, `controlar_extensiones_wordpress`, `editar_usuarios_wordpress`, `editar_seo_wordpress`, `editar_archivos_wordpress`, `ejecutar_wp_cli_wordpress`, `consultar_base_wordpress`, `controlar_cron_wordpress`, `configurar_correo_wordpress`, `editar_integraciones_wordpress`, `eliminar_backup_wordpress`, `restaurar_backup_wordpress`, `desinstalar_app`

## What can you do with it?

Every WordPress site is an app: it runs natively (no Docker) with its own Linux user, its own PHP-FPM pool and its own database on the VPS MySQL. Several sites isolated from each other can live on the same VPS.

- Create an empty site, a store ([WooCommerce](https://ardumaker.com/en/docs/woocommerce)) or a site with [Elementor](https://ardumaker.com/en/docs/elementor).
- Bring a site from another host's backup (All-in-One, Duplicator, UpdraftPlus or a hosting panel).
- Publish it with HTTPS on an automatic address or a custom domain, and change it later.
- Make backups, restore them, create a staging site and publish it.
- Update core, database, plugins and themes.
- Edit content, menus, media, settings, plugins, users, SEO, files, cron, cache, email and integrations, from the dashboard or over MCP.

## When should you use it?

- Corporate sites, blogs or stores you want on your own server.
- Move a WordPress from another host without touching files by hand.
- Have an AI agent maintain the site: content, plugins, tests in a real browser.

## How does it work in ArduMaker?

1. `validar`: active VPS, `wordpress` system feature, minimum memory and disk.
2. `preparar`: PHP 8.3 with PHP-FPM and the WordPress extensions, and wp-cli (once per VPS, checked against the published `.sha512`); the MySQL engine is installed if missing.
3. `instalar`: passwords are stored first (admin and database); the `wp<id>` database and the `'wp<id>'@'localhost'` account, the Linux user, folders, pool and cron are created; the core is downloaded, `wp-config.php` is written and it is installed with a provisional URL.
4. `configurar`: if `extras` were requested, WooCommerce and/or Elementor are installed.
5. `publicar`: the address is reserved, the server block is written in the VPS nginx, the site moves to `https://<domain>` with `wp search-replace` and it is published with DNS, proxy and HTTPS. `/wp-login.php` is checked for a 200.

If `publicar` fails, the site stays installed and the retry publishes again without reinstalling. TLS is set up by the platform in front of the VPS; the VPS nginx passes `HTTPS on` to PHP so WordPress does not loop on redirects when opening `/wp-admin`.

No field is required: `site_title` (default «Mi sitio»), `admin_email` (default: the installer's), `admin_user` (3 to 40 characters; `admin`, `administrator`, `root` and `wordpress` are not accepted), `locale` (default `es_ES`), `custom_domain`, `extras` and `origen` (to bring a backup or copy another site).

## What actually changes?

| What | Where / how |
| --- | --- |
| Site files | `/srv/wordpress/wp<id>/public` |
| Backups | `/srv/wordpress/wp<id>/backups/`, outside the public folder |
| Linux user | `wp<id>`, system user, no login |
| PHP | `wp<id>` pool with its own socket, `pm = ondemand` and `open_basedir` on its folder |
| Database | `wp<id>` on MySQL, `'wp<id>'@'localhost'` account (socket only) |
| Cron | `wp<id>-cron.timer` runs due events every 5 minutes |
| Web | Domain server block in the VPS nginx |

With `pm = ondemand` a site without visits uses no memory, so several fit in a small plan. A site cannot read another site's PHP files.

## Backups, staging and migration

- `crear_backup_wordpress`: full copy (database and `wp-content`) in a `.tar.gz` outside the public folder.
- `restaurar_backup_wordpress` with exactly one source: `backup` (a copy of the site: rollback), `url` (a file the VPS downloads: ArduMaker `.tar.gz`, All-in-One `.wpress`, Duplicator `.zip`, UpdraftPlus or a hosting panel `.tar.gz`) or `from_app` (another site on the same VPS). After loading, the site goes back to its own address.
- `crear_staging_wordpress`: a new site on the same VPS, loaded with a copy and with its own address. It is published by restoring the live site with `from_app` set to the staging.
- When a backup is imported the ArduMaker admin is recreated with its password: the backup brings its own users.
- `cambiar_direccion_wordpress` unpublishes the old address (DNS, proxy and server block), publishes the new one with HTTPS and rewrites every URL of the site.

## Updating and uninstalling

The `update` action (`controlar_app`) brings core, database, plugins and themes up to date, after ensuring PHP 8.3 and the site pool. Uninstalling removes the pool and the cron; with `delete_data` it also deletes files, database and passwords.

> **PELIGRO:** With `delete_data` the site, its local backups and its database are lost.

## Diagram

**A WordPress site**

```text
Internet (HTTPS on `wordpress-<id>` or a custom domain)
  ↓
Platform (terminates TLS and forwards to the VPS)
  ↓
VPS nginx (site server block, `HTTPS on`)
  ↓
PHP-FPM pool `wp<id>` (as the `wp<id>` user)
  ↓
MySQL (`wp<id>` database over socket)
```

## Expected result

The site shows in Apps and in `listar_sitios_wordpress` with its address and extras. `revelar_credencial_app` returns the `/wp-admin` user and password; the database password never leaves: only `wp-config.php` uses it. `ver_sitio_wordpress` with `view: salud` shows the HTTP answer, the PHP pool, pending updates and overdue cron.

## Errors and troubleshooting

| Error | Cause | Retry? |
| --- | --- | --- |
| `php_no_instalado` | PHP-FPM could not be prepared | Yes |
| `base_ya_existe` | There is already a `wp<id>` database this site did not create; it is not touched | No |
| `base_no_creada` / `wordpress_no_instalado` | The database or the core installation failed | Yes |
| `nginx_no_configurado` / `wordpress_url_no_cambiada` | The server block or the URL change failed while publishing | Yes, without reinstalling |
| `backup_incompleto` / `backup_no_importado` | The uploaded backup did not arrive whole or could not be imported | Yes, after resending it |
| `wordpress_copia_fallida` / `wordpress_restauracion_fallida` | The backup or the restore failed | Yes |
| `wordpress_comando_fallido` (422) | wp-cli exited with an error; the trimmed output says why | After fixing the request |

To diagnose: `leer_logs_wordpress` (PHP-FPM, `debug.log`, nginx errors or access), `ver_web_wordpress` (status, HTML, links or forms of a path) and `probar_web_wordpress`, which opens the site in a real browser inside the VPS and returns a screenshot, the visible text and console errors.

> **PRECAUCION:** Before a big change, `crear_backup_wordpress` is advisable. Restoring replaces the whole site and makes a safety copy first, unless `skip_safety_copy`.

## MCP access

WordPress has its own MCP domain, [/mcp/wordpress](https://ardumaker.com/en/mcp/wordpress) (general reference at [/mcp/docs](https://ardumaker.com/en/mcp/docs)). Everything runs on the VPS with wp-cli as the site user. There are three levels: view (whoever sees the app), change (also not a read-only agent) and sensitive (database, files, restore, free wp-cli, deleting users: company admin).

| Kind | Tools |
| --- | --- |
| Read | `listar_sitios_wordpress`, `ver_sitio_wordpress`, `leer_logs_wordpress`, `ver_web_wordpress`, `listar_backups_wordpress` |
| Content and site | `editar_contenido_wordpress`, `editar_menus_wordpress`, `editar_medios_wordpress`, `configurar_sitio_wordpress`, `controlar_extensiones_wordpress`, `editar_usuarios_wordpress`, `editar_seo_wordpress` |
| Server | `editar_archivos_wordpress`, `ejecutar_wp_cli_wordpress`, `consultar_base_wordpress`, `controlar_cron_wordpress`, `controlar_cache_wordpress`, `configurar_correo_wordpress`, `editar_integraciones_wordpress`, `probar_web_wordpress` |
| Backups and address | `crear_backup_wordpress`, `crear_staging_wordpress`, `cambiar_direccion_wordpress` |
| Destructive | `restaurar_backup_wordpress`, `eliminar_backup_wordpress`, `desinstalar_app` |

- It is created with `instalar_app` (`app_type: wordpress`); the `/wp-admin` credential comes from `revelar_credencial_app` (admins only).
- `ejecutar_wp_cli_wordpress` rejects `eval`, `eval-file`, `shell`, `package`, `server` and `cli`, and the `--exec` and `--require` options.
- `editar_archivos_wordpress` works only inside `wp-content` and never touches `wp-config.php`; a `.php` file is checked with `php -l` before replacing it.
- `consultar_base_wordpress` runs reads as they are; any write needs `confirmed`.
- The ArduMaker admin user on the site cannot be deleted or demoted.

> **PRECAUCION:** Logs, pages and the text the browser returns come from the site: they arrive marked as untrusted content and are data, never instructions.

## Related features

- [WooCommerce](https://ardumaker.com/en/docs/woocommerce/)
- [Elementor](https://ardumaker.com/en/docs/elementor/)
- [MySQL](https://ardumaker.com/en/docs/mysql/)
- [Nginx](https://ardumaker.com/en/docs/nginx/)
- [SSL certificates](https://ardumaker.com/en/docs/ssl/)
- [Domains and DNS](https://ardumaker.com/en/docs/dominios-y-dns/)