How to Securely Publish WordPress from Your Home Server

by

Introduction

The appeal of running WordPress on a home server is that you can cut monthly costs without depending on rented servers or the cloud. On the other hand, home connections lack a fixed IP and are exposed to attacker scans, so security hardening before going public is essential. This article walks through the steps, covering what, how, and why, using my own setup: a retired PC running Ubuntu 22.04 LTS.

Why Use a Reverse Proxy

Exposing WordPress port 80 directly to the internet makes it an easy target for port scans and brute-force attacks. So we put Nginx in front as a reverse proxy and funnel external traffic through it. This lets you isolate WordPress itself on the internal network and manage TLS termination, header injection, and access control in one place.

Step 1: Server Layout and Initial Setup

The overall layout looks like this:

  • Router (only port 443 open)
  • Nginx (accepts connections as the reverse proxy)
  • WordPress (listening on 127.0.0.1:8080 internally)

First, allow only the minimum set of ports in the firewall. With Ubuntu’s ufw:

ufw allow 22/tcp
ufw allow 443/tcp
ufw enable

We keep port 80 closed to force TLS and reduce plaintext communication paths.

Step 2: Domain and Let’s Encrypt

Even without a fixed IP, combining DDNS with a domain works. Assign your domain (e.g. example.com) to a DDNS service and sync the name and IP using your router’s update feature. Get a TLS certificate from Let’s Encrypt with certbot:

certbot certonly --standalone -d example.com

After obtaining it, be sure to set up an automatic renewal timer. Certificates expire after only 90 days, so manual renewal makes expiration accidents easy.

Step 3: Nginx Configuration

Write the server block on the following principles:

  • Specify example.com in server_name
  • 301-redirect port 80 access to https
  • Restrict to TLS 1.2 and above, disabling old protocols
  • Add security headers such as X-Content-Type-Options

This reduces the room for man-in-the-middle attacks and makes the communication path safer. After configuring, run nginx -t for a syntax check, then reload to apply.

Step 4: WordPress-Side Hardening

Always keep plugins and themes up to date, because older versions often carry known vulnerabilities. Additionally, change the admin URL from its default and install a plugin that limits login attempts. Running WordPress as a dedicated low-privilege user keeps the damage contained even if it is ever compromised.

Final Thoughts

After going public, use a security scanner to check TLS status and response headers. A home server gives you total freedom, but it also puts all the responsibility on you. Make backups and updates a habit, and enjoy running it with peace of mind.