Blog
WordPress Security

How to Set Up WordPress on Amazon EC2 with Best Security Practices: A Complete Guide

June 20, 2025

Launching a WordPress site on Amazon EC2 gives you the flexibility and power of cloud infrastructure—with complete control over performance, scalability, and cost. But with that control comes the responsibility to harden your server against vulnerabilities. This guide walks you through setting up WordPress with NGINX and SSL on AWS EC2 using Bitnami, followed by a series of security best practices to protect your site from the start.

Why Use Amazon EC2 to Host WordPress?

If you're wondering why someone would go through the effort of launching a custom WordPress server on Amazon EC2 instead of using shared hosting or a managed WordPress provider, the answer comes down to control, scalability, and performance.

Here’s why Amazon EC2 stands out — especially for users who want a hardened, self-managed WordPress environment:

1. Reliability (99.9% Uptime SLA)

Amazon EC2 offers 99.9% availability per region, backed by one of the most redundant and globally distributed infrastructures in the world. This means your website is more resilient to outages than traditional shared hosting environments. When uptime matters (e.g., eCommerce, lead-gen sites, client portals), EC2 offers peace of mind.

2. Built-In Security with Amazon VPC

EC2 integrates with Amazon VPC (Virtual Private Cloud), giving you full control over your network environment. You can configure firewalls, restrict traffic by IP, and even isolate your instance entirely. Combined with Bitnami’s hardened WordPress stack and best practices like SSH key authentication and SSL encryption, your setup becomes far more secure than a basic WordPress host.

3. Flexibility to Customize Everything

With EC2, you control the entire stack — from the operating system and web server (NGINX) to PHP versions and file permissions. Need a custom cron job? Special caching config? A non-standard WordPress architecture? EC2 makes it possible, unlike locked-down shared or managed platforms.

4. Cost Control and Savings

You only pay for the compute power and storage you use. For low-to-moderate traffic sites, a t2.micro or t3a.micro instance under the AWS Free Tier is often sufficient — especially when optimized. And when traffic grows, EC2 lets you scale up or out without migrating your site.

Want to shut down your dev instance at night? EC2 lets you stop billing when you're not using it. You’re in control.

5. Complete Computing Solution

Amazon EC2 isn't just web hosting — it's a full computing platform. You can:

  • Host APIs
  • Run background workers
  • Deploy scripts and automation
  • Combine with RDS for external databases
  • Integrate with S3 for media storage
  • Use CloudWatch for performance monitoring and alerts

This makes EC2 ideal for custom workflows, plugins, and integrations that go beyond traditional WordPress.

6. Elastic Web-Scale Infrastructure

One of the most powerful aspects of EC2 is the ability to scale on demand. Whether it's auto-scaling behind a load balancer or upgrading instance types for performance spikes, EC2 makes it possible to meet growing traffic needs without moving to a new platform.

7. Completely Controlled Environment

You’re not just configuring WordPress — you’re configuring your entire environment, down to the OS. This means:

  • You decide what services run
  • You choose when updates are applied
  • You implement your own security policies
  • You control logging, performance, and access

That level of control is what makes EC2 the preferred choice for developers, agencies, and technical teams that want to build with intention — not limitations.

If your business requires more than "just hosting" — if you value performance, security, and scalability — Amazon EC2 is a serious contender. Yes, it takes more setup, but with the right configuration (like the one covered in this guide), the long-term benefits are significant.

‍

Step 1: Launch a Bitnami WordPress Instance on EC2

  1. Log in to your AWS Console, navigate to EC2, and click Launch Instance.
  2. Under Application and OS Images (AMI), choose AWS Marketplace and search for:

WordPress with NGINX and SSL Certified by Bitnami and Automattic

  1. Select a t2.micro instance (Free Tier eligible) and configure your key pair and security group:
    • Allow SSH (port 22) from your IP
    • Allow HTTP (80) and HTTPS (443) from anywhere
  2. Launch the instance and wait for it to initialize.

Step 2: SSH into the Server

chmod 400 your-key.pem
ssh -i "your-key.pem" bitnami@your-ec2-public-ip
‍

This logs you in as the Bitnami user.

Step 3: Retrieve WordPress Login Credentials

Once connected, run:

cat /home/bitnami/bitnami_credentials

Log in to http://your-ec2-public-ip/wp-admin using the provided username and password.

Step 4: Point Your Domain to the EC2 Instance

At your domain registrar (e.g., Namecheap, GoDaddy), create the following DNS records:

Type Name Value
A @ Your EC2 IP
A www Your EC2 IP

Allow time for DNS propagation.

Step 5: Enable SSL with Bitnami's bncert-tool

Once your domain resolves to the instance, run:

sudo /opt/bitnami/bncert-tool

Follow the prompts to:

  • Enter your domain name(s)
  • Redirect HTTP to HTTPS
  • Automatically renew your SSL certificate

Step 6: Update WordPress URL Settings

In the WordPress dashboard, go to Settings > General and update:

  • WordPress Address: https://yourdomain.com
  • Site Address: https://yourdomain.com

Alternatively, edit wp-config.php:

sudo nano /opt/bitnami/wordpress/wp-config.php

‍

Add:

define('WP_HOME', 'https://yourdomain.com');
define('WP_SITEURL', 'https://yourdomain.com');

‍

Step 7: Redirect HTTP to HTTPS in NGINX

If bncert-tool didn’t automatically create the redirect:

1. Open your NGINX server block:

sudo nano /opt/bitnami/nginx/conf/server_blocks/wordpress-server-block.conf

2. Add this before the main server block:

server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;
    return 301 https://$host$request_uri;
}

‍

3. Restart NGINX:

sudo /opt/bitnami/ctlscript.sh restart nginx

Step 8: Replace Default Admin Username and Email (Using WP-CLI)

1. Connect via SSH and navigate to WordPress:

cd /opt/bitnami/wordpress

‍

2. List users and find the one with ID 1:

sudo wp user list --allow-root

‍

3. Create a new admin user:

sudo wp user create myadmin your@email.com --role=administrator --user_pass=StrongPassword123 --allow-root

‍

4. Delete the default user:

sudo wp user delete 1 --allow-root

‍

5. Change the admin email:

sudo wp option update admin_email your@email.com --allow-root

Step 9: Harden WordPress with Security Best Practices

Disable File Editing

In wp-config.php, add:

define('DISALLOW_FILE_EDIT', true);
define('DISALLOW_FILE_MODS', true); // Also disables plugin/theme install via dashboard

Security Headers (Add to NGINX Config)

Inside your NGINX server block:

add_header X-Frame-Options "SAMEORIGIN";
add_header X-Content-Type-Options "nosniff";
add_header Referrer-Policy "no-referrer-when-downgrade";
add_header Permissions-Policy "geolocation=(), microphone=()";
add_header Content-Security-Policy "default-src 'self' https: data: 'unsafe-inline' 'unsafe-eval';";

Block XML-RPC (Unless Needed)

location = /xmlrpc.php {
    deny all;
}

Warning: This configuration may already be part of your file, so you don't want to include this line more than once, or you will get an error when trying to restart.

Prevent User Enumeration‍

if ($query_string ~ "author=\\d") {
    return 403;
}

Restrict Access to Sensitive Files

location ~* wp-config.php {
    deny all;
}

location ~ /\. {
    deny all;
}

Disable Directory Indexing

Make sure your location / block includes:

autoindex off;
try_files $uri $uri/ /index.php?$args;

Warning: the second line, 'try_files' may already be part of your file, so you don't want to include this line more than once, or you will get an error when trying to restart.

After editing your server block:

sudo /opt/bitnami/nginx/sbin/nginx -t
sudo /opt/bitnami/ctlscript.sh restart nginx

‍‍

Step 10: Additional Hardening Recommendations

You’re Done: A Production-Ready, Secure WordPress Site

At this point, your WordPress site is:

  • Running on a hardened Bitnami NGINX stack
  • Protected with SSL, security headers, and blocked attack vectors
  • Stripped of default credentials and insecure features
  • Tuned for uptime, performance, and long-term stability

With EC2, you get control. With Bitnami, you get simplicity. And with these security practices, you get peace of mind.

Preventing SSL Expiration Issues on EC2: Don't Let Your Site Go Dark

One of the most common causes of unexpected downtime we’ve seen with EC2-hosted WordPress sites is expired SSL certificates.

Let’s Encrypt SSL certificates — commonly installed with tools like Bitnami’s bncert-tool — expire every 90 days. If the auto-renewal fails silently (which happens more often than you’d think), your site can suddenly become inaccessible to visitors and show a browser security warning. That’s not just a bad look — it can also kill your conversion rates.

Why SSL Renewal Fails on EC2

Some typical reasons we’ve seen:

  • bncert-tool was never set to auto-renew, or the cron job failed
  • DNS issues or firewall settings prevented domain validation
  • The domain name was changed but the certificate wasn’t updated
  • The EC2 instance clock drifted (breaking time-based authentication)
  • Permissions or ownership issues blocked renewal scripts

How to Prevent SSL Certificate Expiration on EC2

Here’s how to ensure your certificates stay valid and your site stays online:

1. Verify Auto-Renewal is Configured

When using the Bitnami bncert-tool, it should configure a cron job for renewal. Check it:

sudo crontab -l

Look for a line like:

0 0 * * * /opt/bitnami/letsencrypt/scripts/renew-certificate.sh 2> /dev/null

‍

If it's missing, you can manually add it, or re-run bncert-tool:

sudo /opt/bitnami/bncert-tool

2. Monitor Your Certificate Expiration

Use this command to check the certificate’s expiry date:

sudo openssl x509 -in /opt/bitnami/letsencrypt/certificates/YOURDOMAIN.crt -text -noout | grep "Not After"

Or use an online tool like SSL Labs to monitor from outside.

3. Set Up Email Alerts or Use Cloud Monitoring

If you use AWS CloudWatch or a third-party service, set an alert for SSL expiration. Tools like:

These can help ensure you get notified before the certificate becomes a problem.

4. Consider Using AWS Certificate Manager + Load Balancer

For more advanced or multi-site setups, you can use AWS Certificate Manager (ACM) with an Application Load Balancer (ALB) to offload SSL termination and let Amazon handle renewals. This takes more setup but completely removes the risk of expiry-related downtime.

5. Renew Manually If Needed (Quick Fix)

If your SSL has already expired or you’re unsure, you can reissue a certificate manually:\

sudo /opt/bitnami/bncert-tool

‍

Or, if using Certbot:

sudo certbot renew

Pro Tip: Schedule Monthly Maintenance Checks

Even with automation in place, we recommend adding a monthly calendar reminder to SSH in and check:

  • SSL certificate expiry
  • Disk space
  • System updates
  • Plugin/theme security

This lightweight routine can save hours of downtime and lost trust.

Don’t wait until Chrome starts warning your customers that your site is “Not Secure.” A little SSL maintenance now prevents bigger headaches later.

Want Help Setting Up a WordPress Alternative?

Setting up WordPress on EC2 with hardened security is powerful — but it’s also a lot of work. Between configuring servers, managing SSL certificates, restricting access, and monitoring for vulnerabilities, you’re essentially maintaining a full DevOps pipeline for a single site.

For many businesses, that level of control is overkill. And it often comes at the cost of speed, flexibility, and simplicity.

So what’s the alternative?

Try a Headless CMS with Modern Hosting

Instead of hosting your own WordPress server, consider switching to a headless CMS like Storyblok, Contentful, or even a no-code-friendly solution like Webflow. These platforms separate your content management from the front-end delivery — allowing you to:

  • Eliminate plugin security issues
  • Reduce website maintenance Costs
  • Avoid managing PHP, MySQL, or server-level configuration
  • Use modern, high-performance frontends like Astro, Next.js, or Vue
  • Deploy to platforms like Vercel or Netlify, with automatic SSL and zero maintenance
  • Easily scale to handle traffic spikes without tuning your infrastructure

With a headless or no-code platform, your marketing team can update content without waiting on developers, and your developers can build blazing-fast, secure websites without being held back by legacy architecture.

Why Clients Are Moving Away from WordPress

We’ve helped clients make the move from traditional WordPress installs to headless CMS platforms because they’re:

Done-for-You Modern Architecture

Our team specializes in designing and building modern web solutions using:

  • Astro + Storyblok + Vercel (ultra-fast and fully customizable)
  • Webflow CMS (for marketers who need speed and ease of use)
  • Astro + Contentful + Vercel (for enterprise-grade scale)

We handle the full setup, from planning your content model to configuring your CDN and performance monitoring — so you get the benefits of modern architecture without the technical complexity.

If you’re ready to move beyond server maintenance, plugin management, and manual security patches, let’s talk. We’ll help you choose the right stack for your needs and migrate with minimal downtime.

Contact us to learn how a modern, headless CMS can simplify your life while improving performance, security, and scalability.

Hosting WordPress with EC2 FAQs

Is hosting WordPress on Amazon EC2 better than using shared or managed hosting?

Arrow icon

Absolutely — but only if you need the control and scalability that EC2 offers. Hosting WordPress on Amazon EC2 gives you complete control over your server environment. You decide how it’s configured, what security rules are in place, and how resources are allocated. This contrasts with shared hosting, which limits performance and flexibility, and managed hosting, which often bundles tools you may not need. For businesses with compliance requirements, high traffic, or development needs beyond a basic setup, EC2 is a clear winner. However, it does come with more responsibility — including server maintenance, SSL renewals, and backups — which makes it ideal for teams with technical knowledge or agency support.

How does Amazon EC2 keep my WordPress site secure?

Arrow icon

Amazon EC2 works in tandem with services like Amazon VPC, IAM, and security groups to give you complete control over your network and access policies. You can restrict SSH access, lock down ports, and use multi-factor authentication for your AWS console. Unlike traditional hosting, you’re not sharing resources with other unknown users. You also have the option to harden your WordPress installation at the server level — disabling XML-RPC, blocking file edits, and controlling updates directly from the terminal. Combined with EC2’s reliability and Amazon’s data center security, this results in a hosting setup that is extremely difficult to compromise — as long as it’s configured properly.

What are the common pitfalls of hosting WordPress on EC2?

Arrow icon

The most common issues we see are:

  • SSL certificate expiration, which can bring your site down if unattended.
  • Improper file permissions, causing plugins or uploads to fail.
  • No backups in place, which is risky if you're not using tools like Snapshots or third-party services.
  • Forgetting to lock down defaults, such as not replacing the default “user” account or not disabling XML-RPC.
  • Firewall misconfigurations, like leaving ports open that shouldn’t be.

This is why we recommend following a hardened setup guide like ours or partnering with a development team familiar with AWS infrastructure.

‍

What happens if my SSL certificate expires on EC2?

Arrow icon

If your SSL certificate expires, your site will display a security warning to visitors, and most modern browsers will block access altogether. This is a common issue on EC2 instances where Let's Encrypt certificates were installed manually and automatic renewal wasn’t configured properly. The fix is to use Bitnami’s bncert-tool to set up HTTPS with automatic renewal. We’ve seen this oversight cause days of downtime for clients who didn’t realize their certs weren’t renewing — so make sure your server runs a cron job or systemd timer to handle renewal well before the 90-day expiration.

Why do some WordPress URLs still show as HTTP after enabling SSL?

Arrow icon

This typically happens when WordPress was originally installed using an http:// address and the change to https:// was only made in the domain or SSL layer — not in the WordPress config or database. Even if you install a valid SSL certificate, WordPress still loads mixed content unless the Site URL and Home URL are updated. We recommend editing the wp-config.php file to define both with https://yourdomain.com and running a search-replace on the database to update old links. This ensures all assets, redirects, and internal links properly use HTTPS.

Can I scale my WordPress site on EC2 as I grow?

Arrow icon

Yes — scalability is one of EC2’s biggest strengths. You can start small with a t2.micro instance and later upgrade to a more powerful instance type. If traffic spikes seasonally or due to campaigns, you can temporarily resize your server. With Elastic Load Balancers, you can even distribute traffic across multiple instances. This kind of flexibility is nearly impossible with shared or managed hosting. And when you’re ready to decouple the front end (e.g., move to a headless CMS), your EC2 setup can support that transition as well.

What security hardening should I apply after initial setup?

Arrow icon

After initial setup, we recommend:

  • Changing the default admin username and using a strong password.
  • Disabling file editing and plugin/theme modification from the WordPress dashboard.
  • Blocking XML-RPC unless explicitly needed.
  • Preventing user enumeration via NGINX.
  • Installing a firewall plugin (Wordfence, Limit Login Attempts).
  • Setting proper file and directory permissions.
  • Restricting SSH access to known IPs only via AWS security groups.
  • Enabling regular backups with Amazon Snapshots or a tool like UpdraftPlus.

These steps are included in our step-by-step EC2 guide and form the foundation of a secure WordPress deployment.

What if I want less server management — is there an alternative?

Arrow icon

Absolutely. Hosting WordPress on EC2 gives you power, but it also requires manual setup and ongoing maintenance — including OS updates, SSL renewals, and hardening. If you want a lower-maintenance, faster alternative, consider a headless CMS like Storyblok or Contentful. With a headless setup, your content lives in a secure API-based platform, and your front end can be built using modern frameworks like Astro or Next.js — which can be deployed to fast global networks like Vercel or Netlify. It reduces the attack surface, simplifies updates, and improves performance. If you’re rebuilding your site anyway, it might be the smarter long-term play.

Related Articles

WordPress Security

Hire the WordPress Maintenance Experts at Afteractive

All-in-One WordPress Maintenance Secuirity, Hosting, Trianing, and Support

With a decade-long track record, we have consistently delivered the maintenance and support necessary for our clients to achieve unparalleled online success. Our commitment to providing top-notch support, unwavering dedication, and unmatched expertise in WordPress sets us apart in the Orlando area. We genuinely care about your goals, considering ourselves an extension of your team. Your success is our success, and we strive to go above and beyond to ensure you reach your desired outcomes.

Contact Us

Book a consultation

Our web design services modernize your tech and help establish a solid foundation for your business, enhancing brand awareness, driving traffic to your site, generating new leads, and improving conversion rates.

Schedule a call