VPS & Server Guide

Install LEMP Stack on VPS [2026]
Complete Guide — Linux + Nginx + MariaDB + PHP

By CloudPicked Review Team  ·  Last updated October 2026

The LEMP Stack is a foundational set of open-source software used to deploy websites and web applications on Linux VPS servers. It comprises Linux (operating system), Enginx (web server), MariaDB/MySQL (database), and PHP (server-side language). Together they form a complete, production-ready web environment.

In 2026, LEMP remains the go-to server stack for developers who need speed, reliability, and efficient resource usage. Nginx's event-driven architecture makes it particularly well-suited for VPS instances with limited RAM, handling thousands of concurrent connections with minimal overhead.

What is LEMP Stack?

The acronym LEMP stands for the four core components:

• L — Linux: The open-source operating system (Ubuntu, Debian, CentOS, etc.)
• E — Nginx (pronounced "Engine-X"): A high-performance web server known for its low memory footprint and excellent handling of static files and concurrent connections
• M — MariaDB or MySQL: A relational database management system for storing application data
• P — PHP: The most widely-used server-side scripting language for web development

Each component runs as an independent service, making updates and replacements easy. In practice, Nginx receives HTTP requests from browsers, serves static files directly, and passes PHP requests to PHP-FPM (a separate process manager). PHP-FPM executes the PHP code (which may query MariaDB), and the resulting HTML is returned to Nginx and sent back to the browser.

LEMP vs LAMP — Which Should You Choose?

The only architectural difference between LEMP and LAMP is the web server component. Here's how they compare:

Data as of October 2026 — benchmark results may vary by version and workload

For most VPS deployments, LEMP delivers better performance because Nginx uses an event-driven architecture to handle thousands of requests simultaneously with minimal thread overhead. This is especially valuable on VPS instances with 1-2GB RAM.

VPS Requirements and Prerequisites

Before starting the installation, ensure you have the following:

• VPS with Ubuntu: Ubuntu 22.04 LTS or 24.04 LTS (recommended)
• RAM: Minimum 512MB, recommended 1GB+ for production
• CPU: 1 core minimum
• Storage: 20GB SSD minimum
• Root access or sudo privileges
• SSH client (Terminal on Mac/Linux, PuTTY or Windows Terminal on Windows)
• Domain name (optional but recommended for SSL)

Connect to your VPS via SSH and update all packages first. This ensures you install the latest versions and reduces security exposure:

sudo apt update && sudo apt upgrade -y

This command refreshes the package index and upgrades all installed packages. It may take a few minutes depending on how many updates are pending.

Nginx is available in Ubuntu's default repository and installs cleanly with a single command:

sudo apt install nginx -y

Enable Nginx to start on boot and verify it's running:

sudo systemctl enable nginx
sudo systemctl start nginx
sudo systemctl status nginx

If you see Active: active (running), Nginx is working. Test by opening a browser to http://YOUR_SERVER_IP — you should see the "Welcome to nginx!" page.

Configure UFW Firewall

If UFW firewall is active, allow HTTP and HTTPS traffic:

sudo ufw allow 'Nginx Full'
sudo ufw status

MariaDB is a fully compatible MySQL replacement with excellent performance. We recommend MariaDB 10.11 LTS (Long Term Support until 2028):

sudo apt install mariadb-server mariadb-client -y
sudo systemctl enable mariadb
sudo systemctl start mariadb

Run Security Hardening

Always run the built-in security script immediately after installation:

sudo mysql_secure_installation

Answer the prompts as follows:

• Enter current password for root: Press Enter (no password yet)
• Switch to unix_socket authentication: Y
• Change the root password: Y, then set a strong password
• Remove anonymous users: Y
• Disallow root login remotely: Y
• Remove test database: Y
• Reload privilege tables: Y

Create a Database and User

Create a dedicated database and user for each website (never use root for applications):

sudo mysql -u root -p

CREATE DATABASE mywebsite_db CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'mywebsite_user'@'localhost' IDENTIFIED BY 'StrongPassword123!';
GRANT ALL PRIVILEGES ON mywebsite_db.* TO 'mywebsite_user'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Unlike Apache, Nginx doesn't have a built-in PHP module. Instead, it communicates with PHP-FPM (FastCGI Process Manager), which runs PHP as a separate service and listens on a Unix socket.

PHP Version Recommendations (October 2026)

• PHP 8.3 — Security support until December 31, 2027. Best choice for stable production environments.
• PHP 8.4 — Active support until December 31, 2026, security until 2028. Good for new projects.
• PHP 8.5 — Released November 2025, newest branch. Active support until December 2027.
• PHP 8.2 — Security-only support ends December 2026. Migrate soon.

Verify the latest support timeline at php.net/supported-versions.php

Install PHP 8.3

On Ubuntu 22.04, add the Ondřej Surý PPA first (provides newer PHP versions than Ubuntu's default repo):

sudo apt install software-properties-common -y
sudo add-apt-repository ppa:ondrej/php -y
sudo apt update

Install PHP-FPM and common extensions:

sudo apt install php8.3-fpm php8.3-mysql php8.3-xml php8.3-curl php8.3-mbstring php8.3-zip php8.3-intl php8.3-gd php8.3-bcmath php8.3-imagick -y

Enable and start PHP-FPM:

sudo systemctl enable php8.3-fpm
sudo systemctl start php8.3-fpm
sudo systemctl status php8.3-fpm

Additional Extensions for WordPress

sudo apt install php8.3-opcache php8.3-redis php8.3-soap -y

Create a server block configuration file for your website:

sudo nano /etc/nginx/sites-available/yourdomain.com

Paste the following configuration (replace yourdomain.com with your actual domain):

server {
    listen 80;
    listen [::]:80;
    server_name yourdomain.com www.yourdomain.com;
    root /var/www/yourdomain.com;
    index index.php index.html;

    # Static file caching
    location ~* \.(jpg|jpeg|png|gif|ico|css|js|woff|woff2)$ {
        expires 30d;
        add_header Cache-Control "public, no-transform";
    }

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/var/run/php/php8.3-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }

    location ~ /\.ht {
        deny all;
    }

    # Security headers
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-Content-Type-Options "nosniff";
    add_header X-XSS-Protection "1; mode=block";
}

Enable the Virtual Host

sudo ln -s /etc/nginx/sites-available/yourdomain.com /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

Always run nginx -t to test your configuration syntax before reloading. A typo in the config can take down your entire server.

Create the Document Root

sudo mkdir -p /var/www/yourdomain.com
sudo chown -R www-data:www-data /var/www/yourdomain.com
sudo chmod -R 755 /var/www/yourdomain.com

Create a PHP info file to verify PHP-FPM is working correctly with Nginx:

sudo nano /var/www/yourdomain.com/info.php

<?php phpinfo(); ?>

Navigate to http://yourdomain.com/info.php in a browser. If you see the PHP information page with server details, your LEMP stack is working.

sudo rm /var/www/yourdomain.com/info.php

Test Database Connectivity

<?php
$conn = new mysqli('localhost', 'mywebsite_user', 'StrongPassword123!', 'mywebsite_db');
if ($conn->connect_error) {
    die('Connection failed: ' . $conn->connect_error);
}
echo 'Connected successfully to MariaDB!';
$conn->close();
?>

WordPress runs excellently on LEMP. Here's a streamlined installation process:

Download and Extract WordPress

cd /tmp
curl -O https://wordpress.org/latest.tar.gz
tar xzf latest.tar.gz
sudo cp -r wordpress/* /var/www/yourdomain.com/
sudo chown -R www-data:www-data /var/www/yourdomain.com/
sudo chmod -R 755 /var/www/yourdomain.com/

Configure wp-config.php

cd /var/www/yourdomain.com
sudo cp wp-config-sample.php wp-config.php
sudo nano wp-config.php

Update the database connection settings:

define('DB_NAME', 'mywebsite_db');
define('DB_USER', 'mywebsite_user');
define('DB_PASSWORD', 'StrongPassword123!');
define('DB_HOST', 'localhost');
define('DB_CHARSET', 'utf8mb4');

WordPress-Specific Nginx Configuration

WordPress requires the try_files directive and uploads protection:

location / {
    try_files $uri $uri/ /index.php?$args;
}

# Block PHP execution in uploads directory
location ~* /(?:uploads|files)/.*\.php$ {
    deny all;
}

Install SSL Certificate (Let's Encrypt)

sudo apt install certbot python3-certbot-nginx -y
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

Certbot automatically configures HTTPS and sets up HTTP-to-HTTPS redirects. Certificates renew automatically every 90 days.

Security Hardening

A basic LEMP installation is functional but needs additional hardening for production use:

1. Disable Root SSH and Use Key-Based Auth

sudo nano /etc/ssh/sshd_config
# Modify these lines:
Port 2222
PasswordAuthentication no
PermitRootLogin no

2. Install Fail2Ban

sudo apt install fail2ban -y
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

3. Hide Nginx Version

In /etc/nginx/nginx.conf, within the http block:

server_tokens off;

4. Tune PHP-FPM Process Manager

Edit /etc/php/8.3/fpm/pool.d/www.conf:

pm = dynamic
pm.max_children = 20
pm.start_servers = 5
pm.min_spare_servers = 3
pm.max_spare_servers = 7

5. Harden PHP Settings

sudo nano /etc/php/8.3/fpm/php.ini

expose_php = Off
display_errors = Off
log_errors = On
error_log = /var/log/php_errors.log
upload_max_filesize = 32M
post_max_size = 32M
max_execution_time = 60

Performance Tuning

1. Enable PHP OPcache

OPcache caches compiled PHP scripts in memory, eliminating the need to re-parse scripts on every request:

sudo nano /etc/php/8.3/fpm/conf.d/10-opcache.ini

opcache.enable=1
opcache.memory_consumption=128
opcache.interned_strings_buffer=8
opcache.max_accelerated_files=10000
opcache.revalidate_freq=2
opcache.fast_shutdown=1

2. Enable Nginx Gzip Compression

Add to the http block in /etc/nginx/nginx.conf:

gzip on;
gzip_types text/plain text/css application/json application/javascript text/xml application/xml;
gzip_vary on;
gzip_min_length 1024;

3. Redis Object Cache (Optional)

For high-traffic WordPress sites, Redis dramatically reduces database queries:

sudo apt install redis-server php8.3-redis -y
sudo systemctl enable redis
sudo systemctl start redis