How to Install WordPress on Lightsail: Blueprint and Manual Setup

This article is a localized edition of the Japanese original. Read the Japanese original

There are two ways to run WordPress on Amazon Lightsail. You can create an instance from a "blueprint" that already contains WordPress, or you can create a plain OS instance such as Ubuntu and install Apache, MySQL and PHP yourself. The first suits you if you want to go live quickly; the second suits you if you want fine control over the stack. This article walks through both, based on the Lightsail console as of October 2026 and Ubuntu 24.04 LTS.

Which method to choose

Item	WordPress blueprint	OS only + manual setup
Effort to go live	Low (the site is up within minutes)	High (install packages, create the database, configure)
HTTPS	Let's Encrypt can be set up from the console's setup wizard	You configure certbot or similar yourself
Software layout	Follows the image provider's layout	You decide
Best for	People who just want it running	People comfortable with Linux who want to understand their own stack

If you are unsure, start with the blueprint and try the manual build once you are comfortable.

Method 1: Create the site from the WordPress blueprint

Create the instance

1. Sign in with your AWS account and open the Lightsail console.
2. Under Instances, choose Create instance.
3. Choose the Region and Availability Zone. For readers in Japan, Asia Pacific (Tokyo) is a natural choice; pick the Region closest to your audience.
4. For the platform, choose Linux/Unix, then select the WordPress blueprint. If there is a Blueprint provider field, the AWS documentation recommends Lightsail.
5. Choose a plan (a combination of memory, vCPU, SSD and data transfer), name the instance and create it.

Once it is created, open the public IPv4 address shown in the upper right of the instance management page in your browser, and you will see the WordPress sample page. Prices and Free Tier conditions can change, so check the Lightsail pricing page before you create the instance.

Get the admin password and sign in

The initial administrator password is stored on the instance.

1. On the instance management page, in the WordPress panel, choose Retrieve default password.
2. Choose Launch CloudShell, copy the command shown, paste it into CloudShell and run it.
3. Note the password that is displayed.

With a WordPress image provided by Bitnami, you can also connect over SSH and run this command:

cat $HOME/bitnami_application_password

The sign-in page is http://PUBLIC_IP/wp-admin. According to the AWS documentation, the username is user. After you sign in, go to "Users" (ユーザー in the Japanese UI) → "Profile" and change the password to one that is hard to guess.

Set up a static IP, domain and HTTPS

The public IP assigned to an instance at first changes when you stop and start the instance. Attach a static IP before you point a domain at it.

Lightsail WordPress instances include a wizard that sets all of this up at once.

1. On the instance management page, on the Connect tab, choose Set up your website.
2. Specify the domain to use (one registered or managed in Lightsail, or one registered with another registrar).
3. Choose how DNS is managed. If you use a third-party DNS provider, create the A records yourself using the values shown.
4. Create a static IP.
5. Add the domain assignments (for example the apex domain and www).
6. Create the Let's Encrypt certificate (enter an email address and check the box authorizing Lightsail to configure the certificate).

Setup can take up to about 15 minutes, and AWS advises you not to stop or change the instance during that time. While the wizard is running, the firewall must allow ports 22, 80 and 443 from all IP addresses. When it finishes, confirm that requests to http://YOUR_DOMAIN are redirected to https://YOUR_DOMAIN. The Let's Encrypt certificate renews automatically.

To create only a static IP first, go to Networking in the left menu → Create static IP, create it and attach it to the instance.

Method 2: Build it manually on an OS-only instance

The steps below use Ubuntu 24.04 LTS (with MySQL 8.0 and PHP 8.3 from the standard repositories). Create the instance by choosing Operating System (OS) only and then Ubuntu as the blueprint, then connect over SSH, either with Connect using SSH on the instance management page or with the key you downloaded. The login user on Ubuntu is ubuntu.

ssh -i ~/.ssh/LightsailDefaultKey-ap-northeast-1.pem ubuntu@PUBLIC_IP

All of the following commands are run as the regular user (ubuntu), with sudo added wherever administrator rights are needed.

Install Apache, MySQL and PHP

sudo apt update
sudo apt -y upgrade

sudo apt install -y apache2 mysql-server \
  php libapache2-mod-php php-mysql \
  php-curl php-gd php-intl php-mbstring php-xml php-zip

The packages from php-curl to php-zip are some of the extensions that WordPress Site Health recommends. If "Tools" (ツール) → "Site Health" reports something missing after installation, add it the same way.

Secure MySQL and create the database

First, run mysql_secure_installation to remove anonymous users and the test database.

sudo mysql_secure_installation

Typical answers to the prompts are:

• Password strength checking component (VALIDATE PASSWORD): if you use it, enable it and pick a strength level
• Remove anonymous users: Yes
• Disallow root login remotely: Yes
• Remove the test database: Yes
• Reload privilege tables: Yes

On Ubuntu's MySQL, the root user authenticates with auth_socket rather than a password (you log in by running sudo mysql as the OS root). Because of this, you may see a message saying the root password step is skipped; just continue.

Next, create the database and user for WordPress. In MySQL 8.0 the GRANT ... IDENTIFIED BY syntax causes an error, so create the user with CREATE USER first and then grant privileges with GRANT.

sudo mysql

CREATE DATABASE wordpress DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'wpuser'@'localhost' IDENTIFIED BY 'a-long-random-password';
GRANT ALL PRIVILEGES ON wordpress.* TO 'wpuser'@'localhost';
EXIT;

Privileges created with CREATE USER and GRANT take effect immediately, so FLUSH PRIVILEGES is not needed.

Put WordPress in place

cd /tmp
curl -O https://wordpress.org/latest.tar.gz
tar xzf latest.tar.gz
sudo mv /tmp/wordpress /var/www/wordpress

sudo chown -R www-data:www-data /var/www/wordpress
sudo find /var/www/wordpress -type d -exec chmod 755 {} +
sudo find /var/www/wordpress -type f -exec chmod 644 {} +

A blanket chmod -R 755 would also make every file executable, so set directories to 755 and files to 644 separately.

Create wp-config.php

cd /var/www/wordpress
sudo -u www-data cp wp-config-sample.php wp-config.php
sudo -u www-data nano wp-config.php

Replace the database connection details with the ones you created.

define( 'DB_NAME', 'wordpress' );
define( 'DB_USER', 'wpuser' );
define( 'DB_PASSWORD', 'a-long-random-password' );
define( 'DB_HOST', 'localhost' );

In the same file, replace the eight lines from AUTH_KEY to NONCE_SALT with the values output by https://api.wordpress.org/secret-key/1.1/salt/. Finally, make wp-config.php readable and writable by its owner only.

sudo chmod 600 /var/www/wordpress/wp-config.php

Configure an Apache virtual host

Rather than editing the default 000-default.conf, it is easier to manage a separate configuration file for WordPress.

sudo nano /etc/apache2/sites-available/wordpress.conf

<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com
    DocumentRoot /var/www/wordpress

    <Directory /var/www/wordpress>
        AllowOverride All
        Require all granted
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/wordpress_error.log
    CustomLog ${APACHE_LOG_DIR}/wordpress_access.log combined
</VirtualHost>

AllowOverride All enables the .htaccess file that WordPress writes when you save the permalink settings. Enable the site, check the syntax, then reload.

sudo a2ensite wordpress
sudo a2dissite 000-default
sudo a2enmod rewrite
sudo apache2ctl configtest
sudo systemctl reload apache2

If apache2ctl configtest does not return Syntax OK, review the line number it reports. If a2enmod rewrite enabled the module for the first time, loading it requires sudo systemctl restart apache2.

Finish the installation in your browser

Open http://PUBLIC_IP/ and the WordPress installation screen appears. The database details are already in wp-config.php, so here you only enter the site title and the administrator's username, password and email address. Avoid easily guessed usernames such as admin.

Set up HTTPS

After you attach a static IP and point your domain's A record at it, obtain a Let's Encrypt certificate with certbot. Port 443 (HTTPS) must be open in the Lightsail firewall.

sudo apt install -y certbot python3-certbot-apache
sudo certbot --apache -d example.com -d www.example.com

certbot adds an HTTPS virtual host to the Apache configuration and registers a timer for renewals. You can check that automatic renewal works with sudo certbot renew --dry-run. For more on renewals, see how to renew Let's Encrypt certificates automatically on Apache.

Check the firewall

Lightsail instances have a firewall that you configure in the console. On the instance management page, open the Networking tab and check the rules for IPv4 and IPv6 separately. According to the AWS documentation as of October 2026, the default rules for new instances are:

Instance type	Ports open by default
WordPress blueprint	SSH (22), HTTP (80), HTTPS (443)
OS only, such as Ubuntu	SSH (22), HTTP (80)

If you use HTTPS with a manual build, use Add rule to add HTTPS (443). For SSH (22), restricting the source to your own IP address where possible improves security. However, while the blueprint's setup wizard is running, ports 22, 80 and 443 must stay open to all IP addresses.

The Lightsail firewall is enough on its own, so ufw on the OS is optional. If you use both, enabling ufw before allowing SSH will lock you out, so configure it in this order:

sudo ufw allow OpenSSH
sudo ufw allow 'Apache Full'
sudo ufw enable
sudo ufw status

Things to watch in day-to-day operation

• Take snapshots: Create an instance snapshot before major changes so you can roll back. You can also enable automatic snapshots. For details, see how to back up with VPS snapshots.
• Keep updating: With a manual build, update OS packages with sudo apt update && sudo apt upgrade, and update WordPress core, plugins and themes from the admin screen.
• Do not reuse the database password: Use a database user dedicated to this WordPress site.
• Use key-based SSH: Do not use password authentication for SSH; connect with a key. See how to set up SSH public key authentication.

Summary

• For a quick start, use the WordPress blueprint. Get the initial password with Retrieve default password and CloudShell in the console; the username is user
• With the blueprint, the Set up your website wizard configures the domain, DNS, static IP and Let's Encrypt certificate in one go
• For a manual build, run every administrative command with sudo, run mysql_secure_installation, and in MySQL 8.0 create the user with CREATE USER before granting privileges with GRANT
• Set directories to 755 and files to 644, and wp-config.php to 600. Give Apache a dedicated virtual host with AllowOverride All
• Manage the firewall in the Lightsail console and open port 443 if you use HTTPS. If you also use ufw, allow SSH first

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)