WordPress

What can you do with it?

Every WordPress site is an app: it runs natively (no Docker) with its own Linux user, its own PHP-FPM pool and its own database on the VPS MySQL. Several sites isolated from each other can live on the same VPS.

• Create an empty site, a store (WooCommerce) or a site with Elementor.
• Bring a site from another host's backup (All-in-One, Duplicator, UpdraftPlus or a hosting panel).
• Publish it with HTTPS on an automatic address or a custom domain, and change it later.
• Make backups, restore them, create a staging site and publish it.
• Update core, database, plugins and themes.
• Edit content, menus, media, settings, plugins, users, SEO, files, cron, cache, email and integrations, from the dashboard or over MCP.

When should you use it?

• Corporate sites, blogs or stores you want on your own server.
• Move a WordPress from another host without touching files by hand.
• Have an AI agent maintain the site: content, plugins, tests in a real browser.

How does it work in ArduMaker?

1. validar: active VPS, wordpress system feature, minimum memory and disk.
2. preparar: PHP 8.3 with PHP-FPM and the WordPress extensions, and wp-cli (once per VPS, checked against the published .sha512); the MySQL engine is installed if missing.
3. instalar: passwords are stored first (admin and database); the wp<id> database and the 'wp<id>'@'localhost' account, the Linux user, folders, pool and cron are created; the core is downloaded, wp-config.php is written and it is installed with a provisional URL.
4. configurar: if extras were requested, WooCommerce and/or Elementor are installed.
5. publicar: the address is reserved, the server block is written in the VPS nginx, the site moves to https://<domain> with wp search-replace and it is published with DNS, proxy and HTTPS. /wp-login.php is checked for a 200.

If publicar fails, the site stays installed and the retry publishes again without reinstalling. TLS is set up by the platform in front of the VPS; the VPS nginx passes HTTPS on to PHP so WordPress does not loop on redirects when opening /wp-admin.

No field is required: site_title (default «Mi sitio»), admin_email (default: the installer's), admin_user (3 to 40 characters; admin, administrator, root and wordpress are not accepted), locale (default es_ES), custom_domain, extras and origen (to bring a backup or copy another site).

What actually changes?

With pm = ondemand a site without visits uses no memory, so several fit in a small plan. A site cannot read another site's PHP files.

Backups, staging and migration

• crear_backup_wordpress: full copy (database and wp-content) in a .tar.gz outside the public folder.
• restaurar_backup_wordpress with exactly one source: backup (a copy of the site: rollback), url (a file the VPS downloads: ArduMaker .tar.gz, All-in-One .wpress, Duplicator .zip, UpdraftPlus or a hosting panel .tar.gz) or from_app (another site on the same VPS). After loading, the site goes back to its own address.
• crear_staging_wordpress: a new site on the same VPS, loaded with a copy and with its own address. It is published by restoring the live site with from_app set to the staging.
• When a backup is imported the ArduMaker admin is recreated with its password: the backup brings its own users.
• cambiar_direccion_wordpress unpublishes the old address (DNS, proxy and server block), publishes the new one with HTTPS and rewrites every URL of the site.

Updating and uninstalling

The update action (controlar_app) brings core, database, plugins and themes up to date, after ensuring PHP 8.3 and the site pool. Uninstalling removes the pool and the cron; with delete_data it also deletes files, database and passwords.

Diagram

Expected result

The site shows in Apps and in listar_sitios_wordpress with its address and extras. revelar_credencial_app returns the /wp-admin user and password; the database password never leaves: only wp-config.php uses it. ver_sitio_wordpress with view: salud shows the HTTP answer, the PHP pool, pending updates and overdue cron.

Errors and troubleshooting

To diagnose: leer_logs_wordpress (PHP-FPM, debug.log, nginx errors or access), ver_web_wordpress (status, HTML, links or forms of a path) and probar_web_wordpress, which opens the site in a real browser inside the VPS and returns a screenshot, the visible text and console errors.

MCP access

WordPress has its own MCP domain, /mcp/wordpress (general reference at /mcp/docs). Everything runs on the VPS with wp-cli as the site user. There are three levels: view (whoever sees the app), change (also not a read-only agent) and sensitive (database, files, restore, free wp-cli, deleting users: company admin).

• It is created with instalar_app (app_type: wordpress); the /wp-admin credential comes from revelar_credencial_app (admins only).
• ejecutar_wp_cli_wordpress rejects eval, eval-file, shell, package, server and cli, and the --exec and --require options.
• editar_archivos_wordpress works only inside wp-content and never touches wp-config.php; a .php file is checked with php -l before replacing it.
• consultar_base_wordpress runs reads as they are; any write needs confirmed.
• The ArduMaker admin user on the site cannot be deleted or demoted.

Related features

• WooCommerce
• Elementor
• MySQL
• Nginx
• SSL certificates
• Domains and DNS