Guide VPS & Servers

How to install a LAMP stack

Installing Linux, Apache, MySQL/MariaDB and PHP together on a fresh VPS, and confirming each piece actually talks to the others.

iFastHosting Support Team Updated 26 August 2026 10 min read Intermediate

LAMP is Linux, Apache, MySQL (or its drop-in replacement, MariaDB) and PHP — the stack behind a large share of the web, including WordPress and most other PHP applications. Installing it is four separate packages that need to be told to talk to each other, rather than one single install command, and this guide covers all four.

1. Install Apache

sudo apt update
sudo apt install apache2 -y      # Ubuntu / Debian

sudo dnf install httpd -y        # RHEL / Rocky / AlmaLinux

sudo systemctl enable --now apache2   # Ubuntu / Debian
sudo systemctl enable --now httpd     # RHEL / Rocky / AlmaLinux

If a firewall is running, allow HTTP and HTTPS before continuing — see setting up a firewall on your VPS.

2. Install MariaDB

sudo apt install mariadb-server -y      # Ubuntu / Debian
sudo dnf install mariadb-server -y      # RHEL / Rocky / AlmaLinux

sudo systemctl enable --now mariadb

Run the secure-installation script — it sets a root password, removes an anonymous test account, and disables remote root login, none of which the default install does for you:

sudo mysql_secure_installation

Answer yes to each prompt unless you have a specific reason not to. Then create a database and a dedicated user for your application, rather than using the MariaDB root account from within it:

sudo mysql -u root -p

CREATE DATABASE appdb;
CREATE USER 'appuser'@'localhost' IDENTIFIED BY 'a-strong-password-here';
GRANT ALL PRIVILEGES ON appdb.* TO 'appuser'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Use a real password, not the example above

Generate a long, random password for the database user and store it in your application's configuration file with restrictive permissions (chmod 640 or tighter). This credential is the single most valuable thing on the server if the application itself ever has a vulnerability.

3. Install PHP

sudo apt install php libapache2-mod-php php-mysql -y      # Ubuntu / Debian
sudo dnf install php php-mysqlnd -y                        # RHEL / Rocky / AlmaLinux

libapache2-mod-php embeds PHP directly into Apache on Debian-family systems, so no further connection step is needed there — Apache picks it up automatically. On RHEL-family systems, PHP is commonly run via PHP-FPM instead; if you installed php-fpm alongside the packages above, enable it and point Apache at it:

sudo systemctl enable --now php-fpm

Restart Apache after installing PHP either way, so it picks up the new module:

sudo systemctl restart apache2   # Debian / Ubuntu
sudo systemctl restart httpd     # RHEL / Rocky / AlmaLinux

Most applications also need a handful of common extensions — install what the application documents as required, for example:

sudo apt install php-curl php-gd php-xml php-mbstring php-zip -y

4. Test the whole stack

Create a test file in the web root:

echo "<?php phpinfo(); ?>" | sudo tee /var/www/html/info.php

Visit http://your-server-ip/info.php in a browser. You should see PHP's full configuration page, confirming Apache is handing PHP files to the PHP interpreter correctly. Check the mysqli or pdo_mysql section is present, confirming PHP can talk to MariaDB.

Delete the test file when you are done

phpinfo() exposes detailed information about the server's configuration and installed software — genuinely useful during setup, and genuinely useful to an attacker afterwards. Remove it as soon as you have confirmed the stack works:

sudo rm /var/www/html/info.php

Nginx instead of Apache

If you would rather use Nginx, the database and PHP steps are identical, but PHP must run as a separate PHP-FPM process rather than an embedded Apache module, since Nginx does not execute PHP itself:

sudo apt install nginx php-fpm php-mysql -y
sudo systemctl enable --now php-fpm

Then point Nginx's server block at the PHP-FPM socket for .php requests — the specifics of that configuration are covered in setting up a domain on your VPS, which walks through a complete server block.

Checking what you actually installed

apache2 -v          # or: httpd -v
mysql --version
php -v

Worth doing straight after installation, since the version PHP or MariaDB actually installs depends on what your distribution's default repositories currently carry — which changes over time and differs between Ubuntu, Debian, and the RHEL family. If your application needs a specific version that the default repository does not provide, you will need a third-party repository maintained for that purpose, added deliberately rather than assumed.

Common PHP settings worth checking early

PHP's default limits are conservative and frequently too small for a real application — an upload that silently fails, or a script that stops partway through a long-running task, is often this rather than a bug in the application itself. Find the active configuration file:

php --ini

Edit the values most commonly worth raising:

upload_max_filesize = 32M
post_max_size = 32M
memory_limit = 256M
max_execution_time = 60

Restart the web server, or PHP-FPM if you are using it, after editing php.ini — PHP does not pick up the change until the process handling requests is restarted.

Where to go from here

With the stack confirmed working, the usual next steps are pointing a real domain at the server, adding a free SSL certificate, and putting a backup schedule in place before you deploy anything real to it: