WordPress runs on a web server, not on your laptop. That server needs specific software and resources to handle WordPress's code, store your posts and images, and serve pages to visitors. If you've only ever installed apps on Windows or macOS, the idea of "hosting requirements" can feel abstract. This guide unpacks every piece in plain language and walks you through a working first setup.
What WordPress actually is (and why it needs a server)
WordPress is a PHP application. It's not a standalone program you double-click. When someone visits your site, the web server runs PHP scripts that query a database, assemble HTML, and send it to the browser. Without PHP and a database, WordPress cannot run. Period.
You can't host WordPress on Google Drive or Dropbox. Those services serve static files. WordPress generates pages on the fly, which requires server-side processing.
The four absolute requirements
Every WordPress installation needs these four things. No exceptions.
1. A web server (Apache or Nginx)
The web server receives HTTP requests from browsers and hands off PHP files to the PHP interpreter. Apache and Nginx are the two dominant choices. Most shared hosting uses Apache with mod_php or PHP-FPM. You won't configure this yourself on shared hosting—it's already running—but understanding that it exists helps you troubleshoot errors later.
If you see "500 Internal Server Error" or "403 Forbidden," the web server is involved. Those are not WordPress errors; they happen before WordPress even loads.
2. PHP (the scripting language)
WordPress is written in PHP. The server must have a PHP interpreter installed. Not every PHP version works with every WordPress version, so compatibility matters.
At the time of writing, WordPress runs on PHP 7.4 and up, but PHP 8.1 or 8.2 is the sweet spot for performance and security. Older versions like PHP 5.6 or 7.0 are end-of-life and will break modern plugins. If your host offers PHP version selection in cPanel or a control panel, pick the newest stable release that WordPress supports.
You'll also hear about PHP extensions. WordPress needs a handful of them:
mysqliormysqlnd(to talk to the database)json(almost always bundled)mbstring(for multi-byte character handling)gdorimagick(for image resizing and thumbnails)curl(for remote HTTP requests)zip(for plugin and theme installs)xmlandxmlreader(for feeds and imports)
Reputable hosts enable these by default. You don't compile them yourself on shared hosting. If a plugin complains about a missing extension, open a support ticket—your host can enable it server-wide or in your account.
3. MySQL or MariaDB (the database)
WordPress stores everything—posts, pages, settings, user accounts—in a relational database. MySQL and MariaDB (a MySQL fork) are both supported. PostgreSQL is not.
WordPress officially requires MySQL 5.7 or higher, or MariaDB 10.3 or higher. Older versions lack features like utf8mb4 collation, which breaks emoji and some international characters.
You'll create a database through cPanel or your host's control panel before installing WordPress. Write down three things:
- Database name
- Database username
- Database password
WordPress will ask for these during installation. If you lose them, you can find them in wp-config.php later (more on that file in a moment).
4. HTTPS support (an SSL certificate)
Technically WordPress runs without HTTPS, but browsers now warn users on unencrypted sites, and Google penalizes them in search rankings. Most hosts provide free Let's Encrypt certificates through cPanel or AutoSSL. Install one before you launch the site.
If you install WordPress over HTTP and then add SSL later, you'll need to update the site URL in the database or via wp-config.php. It's easier to start with HTTPS.
Minimum server resources (and when they matter)
Shared hosting usually hides resource limits from you, but understanding them prevents surprise crashes.
Disk space
WordPress core files take up around 50 MB. A clean install with a default theme and no plugins is well under 100 MB. Growth comes from:
- Media uploads: high-resolution images, PDFs, videos.
- Database backups: can accumulate if not pruned.
- Plugin caches: some caching plugins store pages on disk.
For a simple blog with mostly text and a few images per post, 1 GB of disk space will last months. A photography portfolio with full-size images in a gallery plugin can burn through 10 GB quickly. Check your cPanel disk usage widget monthly.
Memory (RAM allocated to PHP)
PHP scripts consume memory while they run. The memory_limit directive in php.ini caps how much RAM a single request can use. WordPress recommends at least 64 MB, but 128 MB is safer if you run multiple plugins. WooCommerce and page builders often need 256 MB.
If you see "Allowed memory size exhausted" errors, either your plugins are inefficient or the limit is too low. On shared hosting, you can try adding this to wp-config.php:
define('WP_MEMORY_LIMIT', '256M');
That only works if your host allows per-directory overrides. If not, open a ticket.
Bandwidth
Bandwidth is how much data flows out to visitors each month. A typical WordPress page with images is 1-3 MB. If 10,000 people visit your site and each loads 5 pages, that's roughly 50,000 page loads × 2 MB = 100 GB. Many hosts label plans "unlimited bandwidth," which really means "enough for normal use; we'll throttle you if you go viral."
Content delivery networks (CDNs) like Cloudflare reduce bandwidth usage by caching images and CSS on edge servers. I've seen hosting bills drop after enabling a CDN.
Control panels: why cPanel matters (and what it does)
cPanel is a graphical interface that sits on top of Linux hosting. It's not technically required—WordPress can run on a bare Linux server—but on shared hosting you'll use cPanel to:
- Create MySQL databases and users.
- Upload files via File Manager.
- Install SSL certificates.
- Set up email accounts.
- Change PHP versions.
- Run Softaculous or another auto-installer.
Softaculous is a one-click WordPress installer built into cPanel. It creates the database, downloads WordPress, writes wp-config.php, and sets file permissions. For a first site, Softaculous is the fastest path. Manual installation teaches you more but takes longer.
Some hosts use Plesk, DirectAdmin, or custom panels. The principles are identical: you need database creation, file uploads, and SSL management.
Installing WordPress manually (the five-minute version)
Let's assume you're on cPanel shared hosting and you want to understand the process instead of trusting an auto-installer.
Step 1: Create the database
- Log into cPanel.
- Open MySQL Databases.
- Under "Create New Database," type a name (e.g.,
wpdb) and click Create Database. - Scroll to "MySQL Users," create a new user (e.g.,
wpuser) with a strong password. - Under "Add User to Database," grant that user All Privileges on your new database.
Write down the database name, username, and password. You'll need them in step 4.
Step 2: Download and upload WordPress
Go to wordpress.org, download the latest .zip file, extract it on your computer, and upload the wordpress folder to your server via FTP or cPanel File Manager. Most people put it in public_html so the site appears at yourdomain.com. If you put it in public_html/blog, the site will be at yourdomain.com/blog.
Step 3: Install an SSL certificate
In cPanel, find SSL/TLS Status or Let's Encrypt," select your domain, and click Install**. Wait a minute for propagation. Test by visiting https://yourdomain.com—you should see a padlock in the browser.
Step 4: Run the WordPress installer
Visit https://yourdomain.com in a browser. WordPress detects the fresh files and shows a language picker, then asks for database credentials. Enter the database name, username, password, and leave host as localhost (almost always correct on shared hosting).
Table prefix can stay wp_ unless you're installing multiple WordPress instances in the same database. Click Submit, then Run the installation. Fill in your site title, admin username, password, and email. Hit Install WordPress.
You're done. Log in at https://yourdomain.com/wp-admin.
Step 5: Force HTTPS in wp-config.php
Open wp-config.php (it's in the root of your WordPress folder) and add these lines just above the line that says /* That's all, stop editing! */:
define('FORCE_SSL_ADMIN', true);
if (strpos($_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') !== false)
$_SERVER['HTTPS'] = 'on';
The second block fixes issues when your site sits behind a proxy or load balancer (common on shared hosting). Save the file.
What about managed WordPress hosting?
Managed WordPress hosts like WP Engine, Kinsta, or Flywheel handle server configuration for you. PHP, MySQL, caching, SSL, and backups are preconfigured and updated automatically. You get a custom dashboard instead of cPanel. These services cost more than shared hosting but remove the need to understand Apache tuning or database optimization.
For your first site, managed hosting is overkill. Shared hosting teaches you how the pieces fit together and costs a fraction as much. Once you're running multiple client sites or a high-traffic store, managed hosting saves hours of maintenance.
Do you need root access or a VPS?
No. Shared hosting is fine for most WordPress sites. A virtual private server (VPS) gives you root SSH access, meaning you install and configure Apache, PHP, and MySQL yourself. That flexibility is powerful but requires Linux command-line skills.
Stick with shared hosting until you hit resource limits (slow page loads, memory errors, CPU throttling) or need custom server software. A VPS won't magically make WordPress faster if your theme and plugins are bloated.
Common misconceptions I see in support tickets
"I installed WordPress on my computer and can't access it from my phone." Localhost (XAMPP, MAMP, Local by Flywheel) is not web hosting. Those tools run a server on your machine for testing. To make your site public, you need a domain and hosting plan.
"My host says they support WordPress but I can't find it in the control panel." WordPress is software you install, not a feature the host toggles on. Look for Softaculous, Fantastico, or Installatron in cPanel. If the host truly supports WordPress, they support the server requirements (PHP and MySQL), and you can always install manually.
"Can I run WordPress on Windows Server?" Yes, but almost nobody does. WordPress is built for Linux (Apache or Nginx, PHP, MySQL). Windows hosting exists but often has quirks with file permissions and path separators. Avoid it unless you have a compelling reason.
"Do I need a dedicated IP for WordPress?" No. Shared hosting puts dozens of sites on one IP using name-based virtual hosts. SSL works fine on a shared IP with SNI (Server Name Indication), which every modern browser supports. Dedicated IPs are useful for email reputation and old legacy systems, not WordPress.
What about email hosting?
WordPress sends email (password resets, comment notifications, contact forms) using PHP's mail() function, which relies on the server's mail transfer agent (usually Postfix or Exim). On shared hosting this works but often lands in spam because shared IPs have poor reputations.
For transactional email, use an SMTP plugin and a service like SendGrid, Mailgun, or Amazon SES. For mailboxes (your team's email addresses), you can use cPanel email accounts or move to Google Workspace or Microsoft 365. Hosting and email don't have to live on the same server.
A pre-launch checklist (print this)
Before you point your domain and go live:
- [ ] PHP version is 8.1 or newer.
- [ ] SSL certificate installed and HTTPS works.
- [ ] Database created with a user that has all privileges.
- [ ] WordPress installed and accessible at your domain.
- [ ] Admin username is not "admin" (bots brute-force that first).
- [ ] Strong admin password stored in a password manager.
- [ ]
wp-config.phpcontainsFORCE_SSL_ADMINandWP_DEBUGis set tofalse. - [ ] Permalink structure changed from default (Settings → Permalinks → Post name).
- [ ] Akismet or another anti-spam plugin active if you allow comments.
- [ ] Contact form tested (and it actually sends email).
- [ ] A backup plugin installed (UpdraftPlus, BackWPup) with the first backup completed.
Most of these take 30 seconds each. Skipping them leads to support tickets later.
What to check first when something breaks
If your WordPress site stops loading:
- Check if the domain resolves (ping it or use a DNS lookup tool).
- Verify the SSL certificate is valid and not expired (browser will show a big warning).
- Check cPanel error logs (Metrics → Errors).
- Confirm PHP version hasn't been downgraded or changed.
- Test database connectivity by opening phpMyAdmin in cPanel and running
SELECT 1;. - Disable all plugins by renaming the
wp-content/pluginsfolder via FTP toplugins_old, then try loading the site.
In support tickets I handled, the usual culprit was a plugin update that broke compatibility with the PHP version or a full disk quota (media library uploads failed silently until the user tried to log in and saw "Cannot write to wp-content").
Start with the simplest explanation. Don't assume a hack or a MySQL corruption until you've ruled out a full disk and a bad plugin.