Control panels

Install and manage WordPress with the Plesk WordPress Toolkit

Use the Plesk WordPress Toolkit on a Linux VPS to install WordPress, run updates and security checks, and clone or stage sites before changes go live.

IntermediateLinux server7 min read

This guide shows you how to install WordPress with the Plesk WordPress Toolkit on a Linux VPS, then use the same panel to manage updates, security checks, cloning and staging. The Toolkit gives you one screen per WordPress installation, so you no longer need to log into every wp-admin to see what needs attention.

Note: Buy your Plesk licence from Plesk or an authorised reseller. Some Toolkit features, such as cloning and staging, depend on the edition you buy — check Plesk's own documentation for what your licence includes, because the editions change over time.

Before you start

You need:

  • A Linux VPS with a clean Ubuntu 22.04/24.04, Debian 12, AlmaLinux 8–9 or Rocky Linux 8–9 install. Plesk supports specific OS versions, so confirm yours on Plesk's system requirements page before you begin.
  • Root SSH access. Your server IP and root password are in your VPS provider's control panel.
  • A Plesk licence key, or a trial key from Plesk.
  • DNS for example.com that you can point at 203.0.113.10 once the panel is up.

A fresh server is best. Installing Plesk on a host that already runs Apache, Nginx, MySQL or a mail server will conflict with the packages Plesk wants to install.

Install Plesk on the VPS

  1. Connect over SSH as root:
Bash
ssh root@203.0.113.10
  1. Download and run the official installer:
Bash
wget https://autoinstall.plesk.com/plesk-installer
chmod +x plesk-installer
./plesk-installer
  1. Choose the recommended installation when prompted. The installer downloads packages and takes several minutes; it can look idle while it resolves dependencies.
  1. Confirm the panel answers on its HTTPS port:
Bash
plesk version
curl -Ik https://203.0.113.10:8443
  1. Open https://203.0.113.10:8443 in a browser. If the page does not load, allow TCP 8443 in the VPS firewall (and in any firewall at your provider) before going further. Complete the initial setup, set a strong admin password, and apply your licence key.

Warning: The Plesk login page is reachable from the internet. Set a long password, enable two-factor authentication for the admin account, and restrict 8443 to your own IP addresses if you can.

Create a subscription for your site

In Plesk, go to Websites & Domains > Add Domain and create a subscription for example.com. Pick the PHP version you want (8.1–8.3 are common choices for current WordPress releases) and let Plesk create the system user, document root and database server access.

Point the domain's DNS A record at 203.0.113.10, then wait for it to resolve. You can check from the server:

Bash
dig +short example.com

The document root will be /var/www/vhosts/example.com/httpdocs. If the WordPress tab is missing afterwards, install the extension from Extensions > Extensions Catalog and search for WordPress Toolkit.

Install WordPress with the Plesk WordPress Toolkit

  1. Go to Websites & Domains > WordPress and click Install.
  2. Choose example.com as the target, keep the default path unless you want WordPress in a subdirectory, and set the site title.
  3. Let the Toolkit create a new database and database user, or select an existing one. A dedicated database is cleaner.
  4. Set the WordPress admin username (not admin), a strong password and your email address.
  5. Choose whether to enable automatic updates for the core, plugins and themes. You can change this later per site.
  6. Click Install and watch the task log. When it finishes, the installation appears in the WordPress list with its version and update state.

Do not run a manual WordPress download into the same document root afterwards. The Toolkit tracks the files and database it created, and a second copy will cause confusing version and checksum results.

Manage updates and security checks

Open the installation in the WordPress tab. The Updates panel shows available core, plugin and theme updates. You can update one item or everything at once, and set a schedule for automatic updates per installation.

Settings worth changing on most sites:

  • Enable automatic updates for the WordPress core security releases.
  • Keep plugin auto-updates on only for plugins you trust; a broken plugin update takes the site down.
  • Turn on Smart Updates if your licence includes it — it tests the update on a copy first, then applies it live.
  • Run a Security scan and work through the findings: outdated core files, vulnerable plugin versions, weak WordPress passwords, and world-writable permissions.

Warning: Take a database and file backup before bulk-updating plugins on a live shop or membership site. If an update breaks checkout or logins, you want a known-good copy to restore, not a scramble. The mysqldump and cron guide covers scheduled database dumps.

The Toolkit also installs WP-CLI for each site. To check a version quickly:

Bash
cd /var/www/vhosts/example.com/httpdocs
wp core version --allow-root
wp plugin list --update=available --allow-root

Clone and stage with WordPress Toolkit

Cloning and staging let you test a plugin, theme or PHP upgrade before it reaches visitors.

  1. In the WordPress tab, select the installation and choose Clone.
  2. Create the copy on staging.example.com, or in a subdirectory if you prefer. The Toolkit copies files and database and adjusts the site URL.
  3. Point DNS for the staging name at 203.0.113.10, or add a hosts-file entry on your own machine if the name should stay private.
  4. Make your changes on the staging copy and test them.
  5. Use Copy Data to push the tested files and database back to the live site when you are satisfied.

Warning: Copying data from staging to production overwrites the live database. Anything customers added — orders, comments, form entries — since the clone was made is lost. Put the site in maintenance mode, take a backup, then sync.

Staging sites consume disk and database space on the same VPS, and search engines can index them. Add HTTP authentication to the staging site or block it in Plesk's Apache/Nginx settings.

Check it works

  • curl -I https://example.com returns 200 and a WordPress Set-Cookie or Link header.
  • https://example.com/wp-login.php loads with a valid certificate.
  • The Toolkit shows the correct core version and no critical security findings.
  • wp core verify-checksums --allow-root reports no modified core files.
  • Scheduled tasks run: check Tools > Site Health in WordPress for missed wp-cron events.

Troubleshooting

  • 502 Bad Gateway or "WordPress installation is not available" — PHP-FPM for that subscription has stopped or the PHP handler was changed. Check PHP Settings for the domain, then run plesk repair web -y and reload the page.
  • Toolkit reports a database connection error — the database user password was changed outside Plesk, or MySQL is down. Run plesk repair db -y, then update the credentials in wp-config.php or reset them under Databases.
  • Automatic updates fail or the site is briefly unreachable — the server cannot reach its own site (firewall or DNS loop), or a PHP fatal error blocks the update. Check the Plesk log at Logs, disable auto-updates for the failing item, and update it manually.
  • Staging copy redirects to the live domain — the siteurl and home values were not rewritten. Fix them with wp option update siteurl https://staging.example.com --allow-root (and the same for home), then clear caches.
  • WP-CLI says "Error establishing a database connection" — you are running it from the wrong directory or as a user that cannot read wp-config.php. cd into the document root and run it with the subscription's system user or as root with --allow-root.

Next steps

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AIOpen a ticket

Related guides