websitebox/guide.md

title, summary, tags, difficulty, time, prerequisites

title	summary	tags	difficulty	time	prerequisites
Deploy Your Own Website with WebsiteBox	Go from zero to a live, SSL-secured WordPress website on your own server. No coding or technical experience required.	WordPress, Docker, Self-Hosting, VPS	beginner	45 minutes	A credit card for VPS hosting ($3.50-6/month), A domain name ($1-12/year)

[step: What You're Building]

By the end of this guide, you'll have a fully working website that:

• Lives on a server you control (not Squarespace, Wix, or WordPress.com — more on the difference below)
• Has a free SSL certificate (the padlock icon that means your site is secure)
• Runs WordPress — the same software that powers over 40% of all websites on the internet
• Includes automatic backups, a security firewall, and optional age verification
• Costs only $3.50-6/month for hosting (plus ~$10/year for a domain name)

WordPress is a free, open-source website builder. You manage your site through a visual dashboard in your browser — adding pages, uploading images, writing posts, and changing the design. No coding required.

WebsiteBox packages WordPress with all the security, backups, and server configuration already done for you. You just answer a few questions and your site is live.

[callout:info] WordPress.org vs WordPress.com — what's the difference? WordPress.com is a paid hosting service run by a company. WordPress.org is the free, open-source software itself — anyone can download and run it on their own server. WebsiteBox uses WordPress.org, giving you full control with no monthly platform fees (you only pay for the server itself). [/callout]

What you'll need before starting:

• A credit or debit card to rent a server ($3.50-6/month)
• A domain name — the address for your website (e.g., myportfolio.com). If you don't have one yet, you'll buy one in the "Get a Domain Name" step (~$1-12/year).
• About 45 minutes of time
• A computer with internet access (Mac, Windows, or Linux — any will work)

Estimated total cost:

• Server hosting: $3.50-6/month (billed monthly or annually)
• Domain name: $1-12/year (billed annually)
• SSL certificate: Free (provided automatically by Let's Encrypt)
• WordPress: Free (open-source software)
• WebsiteBox: Free (open-source)

That's it. No technical background needed. This guide walks you through every single step.

Here's the roadmap — 7 steps, about 45 minutes total:

Step	What You'll Do	Time
1. Get a Server	Rent a small server from a hosting company	5 min
2. Get a Domain Name	Buy a web address for your site	5 min
3. Connect to Your Server	Open a remote connection to your server	2 min
4. Run the Installer	One command that sets everything up	5-10 min (mostly waiting)
5. Complete the Setup Wizard	Answer questions about your site	3 min
6. Point Your Domain	Tell the internet where your site lives	5 min + wait time
7. Launch Your Website	Start your site with one command	2-3 min

After that, you'll visit your live website and learn how to customize it. Let's go.

[step: Get a Server (~5 minutes)]

Before you can have a website, you need somewhere for it to live. That "somewhere" is a server — a computer in a data center that stays on 24/7 so your website is always available to visitors.

You'll rent one from a hosting company. In the industry, these are called a VPS (Virtual Private Server). Think of it like renting a small apartment in a big building — you get your own private space on a shared machine. It typically costs between $3.50 and $6 per month.

Recommended providers (click to sign up):

• BuyVM — $3.50/mo, most affordable, great for all content types, includes free DDoS protection
• Vultr — $6/mo, very beginner-friendly dashboard, widely used
• OVHcloud — $5.50/mo, European-based, good for EU audiences

[callout:info] All three providers are reliable and will work well. If you're unsure, BuyVM is the best value and Vultr has the most beginner-friendly interface. [/callout]

When signing up, you'll be asked to configure your server. Choose these options:

• Operating system: Ubuntu 22.04, Ubuntu 24.04, or Debian 12 (these are versions of Linux, the operating system your server will run — any of them work fine, but Ubuntu 22.04 is the most widely documented if you ever need to search for help)
• Plan size: At least 1 GB RAM, 2 GB recommended (RAM is the server's working memory — more means better performance when multiple visitors are on your site at once)
• Server location: Pick whichever city is geographically closest to where most of your visitors will be (this makes your site load faster for them)

After your server is created (usually takes 30-60 seconds), the provider will show you two critical pieces of information:

1. An IP address — a set of numbers like 203.0.113.45 that identifies your server on the internet
2. A root password — the master password for your server. "Root" is the Linux equivalent of an administrator account — it has full control over the server.

Save both of these somewhere safe — in a password manager (recommended), a note on your phone, or written down. You'll need them in the next steps.

[callout:tip] Most providers also email you the IP address and password. Check your inbox (and spam folder) if you lose track of them. Some providers like Vultr show them on a "Server Details" page you can return to anytime. [/callout]

[callout:tip] Can't connect later? Most VPS providers have a web console (sometimes called "VNC console" or "Recovery console") in their dashboard that lets you access your server through your browser — no SSH needed. Look for a "Console" or "View Console" button on your server's management page. This is useful as a fallback if SSH isn't working. [/callout]

[step: Get a Domain Name (~5 minutes)]

A domain name is your website's address — like myportfolio.com or janedoe.art. This is what people type into their browser to find your site.

If you don't already have one, you can buy a domain from a registrar (a company that sells domain names). Domains typically cost $1-12 per year depending on the extension (.com, .art, .io, etc.).

Recommended registrars (click to browse):

• Porkbun — Low prices, very simple interface, great for beginners
• Namecheap — Large selection, frequent sales
• Cloudflare Registrar — No markup on prices (charges exactly what the registry charges)

To buy a domain:

1. Go to any registrar's website
2. Search for the name you want (e.g., "myportfolio")
3. Pick an available option and extension (.com, .art, .net, etc.)
4. Complete the purchase

[callout:info] You don't need to configure anything on the domain yet — just have it purchased and accessible in your registrar's dashboard. We'll connect it to your server in a later step. [/callout]

[callout:tip] If you're building a portfolio or creative site, consider fun extensions like .art, .studio, .design, or .gallery — they're often cheaper than .com and more memorable. [/callout]

[step: Connect to Your Server (~2 minutes)]

Now you need to connect to your server so you can set things up. You'll do this using SSH (Secure Shell) — think of it as a secure remote control for your server. Instead of a graphical desktop, you type commands into a text window.

Don't worry if you've never done this before — you'll only need to type a few simple commands, and this guide tells you exactly what they are.

On Mac:

1. Open the Terminal app (find it in Applications > Utilities, or press Cmd + Space and type "Terminal")
2. Type the following command, replacing YOUR_SERVER_IP with the actual IP address from the "Get a Server" step:

[code:bash] ssh root@YOUR_SERVER_IP [/code]

This tells your computer to connect (ssh) as the administrator account (root) to the server at your IP address. For example, if your IP address is 203.0.113.45, you would type: ssh root@203.0.113.45

On Windows:

You have two options:

• Windows Terminal (built into Windows 10/11): Press Win + X, click "Terminal", and type the same ssh command above
• PuTTY (free download): Download PuTTY, open it, paste your server IP in the "Host Name" field, and click "Open"

On Linux:

Open any terminal application and type the same ssh command above.

What you'll see:

The first time you connect, you'll get a security message. This is normal — it's your computer asking if you trust this new server. Type yes and press Enter.

Then you'll be asked for a password. Type the root password from the "Get a Server" step and press Enter.

[terminal] $ ssh root@203.0.113.45 The authenticity of host '203.0.113.45' can't be established. ED25519 key fingerprint is SHA256:abc123... Are you sure you want to continue connecting (yes/no/[fingerprint])? yes root@203.0.113.45's password: Welcome to Ubuntu 22.04.3 LTS

root@my-server:~# [/terminal]

When you see the root@...:~# prompt, you're connected. Everything you type from now on runs on your server, not on your own computer.

[callout:tip] When typing a password in the terminal, nothing appears on screen — no dots, no asterisks, nothing at all. This is a security feature, not a bug. Just type your password and press Enter, even though it looks like nothing is happening. [/callout]

[callout:tip] If you get "Connection refused" or "Connection timed out," wait a minute — your server might still be starting up. Try again after 60 seconds. If it still doesn't work, double-check the IP address. [/callout]

[step: Run the Installer (~5-10 minutes)]

Now for the easy part. Copy and paste this single command into your terminal and press Enter:

[code:bash] curl -fsSL https://git.constantprojects.xyz/tankadmin/websitebox/raw/branch/main/install.sh | bash [/code]

[callout:tip] How to paste into a terminal: On Mac, press Cmd + V. On Windows Terminal, right-click. On PuTTY, right-click. On Linux, press Ctrl + Shift + V. [/callout]

[callout:info] What does this command do? curl is a tool that downloads files from the internet. The URL points to the WebsiteBox install script on our Git server (where the project's code is publicly hosted). The | bash part tells your server to run the downloaded script. The entire install script is open source — you can read every line of it before running it if you want to verify what it does. [/callout]

This one command does everything needed to prepare your server:

1. Verifies your license key — confirms your purchase with the WebsiteBox server
2. Updates your system — installs the latest security patches
3. Secures your server — sets up a firewall (UFW), brute-force protection (Fail2ban), and automatic security updates (Unattended Upgrades)
4. Installs Docker — the software that packages and runs your website (think of it as a container system that keeps everything organized and isolated)
5. Configures log rotation — prevents Docker logs from filling up your disk over time
6. Downloads WebsiteBox — the project files that define your website setup
7. Starts the setup wizard — an interactive questionnaire to configure your site (covered in the next step)

You'll see output scrolling by as each step completes. Here's roughly what to expect:

[terminal] ═══════════════════════════════════════════════════════════ WebsiteBox Installer ═══════════════════════════════════════════════════════════

─────────────────────────────────────────────────────────── License Key ─────────────────────────────────────────────────────────── ▸ Enter your WebsiteBox license key You received this key in your purchase confirmation email. Format: WBOX-XXXX-XXXX-XXXX-XXXX

License key: WBOX-A3F7-KN9P-QR4X-8WTB ▸ Verifying license key... ✓ License key verified and activated.

Detected: ubuntu 22.04

─────────────────────────────────────────────────────────── Securing your server... ─────────────────────────────────────────────────────────── Updating system packages... Downloading the latest security patches for your operating system. On a fresh server this can take 2-10 minutes. Sit tight. System packages updated. Installing security tools (firewall, fail2ban, auto-updates)... These protect your server from common attacks. Usually under a minute. Configuring firewall... Firewall enabled: SSH, HTTP, and HTTPS allowed. All other ports blocked. Fail2ban enabled: brute-force SSH protection active. Automatic security updates enabled. Docker log rotation configured (10MB max per log, 3 files per container).

Server secured: Firewall: active (SSH, HTTP, HTTPS only) Fail2ban: active (SSH brute-force protection) Auto-updates: enabled (daily security patches) Docker log limits: configured (30MB max per container)

Installing Docker... Docker packages and runs your website in isolated containers. This is the largest download — usually takes 1-3 minutes. Docker installation complete. Cloning WebsiteBox... Downloading the project files. Just a few seconds. Added 'websitebox' command

═══════════════════════════════════════════════════════════ WebsiteBox Setup Wizard ═══════════════════════════════════════════════════════════ [/terminal]

The entire process takes 2-3 minutes. You might see a pink or purple full-screen prompt asking about restarting services or keeping configuration files — this is normal and comes from the system's package manager. Just press Enter to accept the default option each time. If it asks "Which services should be restarted?" just press Enter. If it asks about configuration files, press Enter to keep the current version.

When the "WebsiteBox Setup Wizard" header appears, the installer is done and the setup wizard has started — that's covered in the next step.

[callout:tip] What if your SSH connection drops during installation? If your terminal freezes or disconnects mid-install (bad WiFi, closed laptop, etc.), don't worry. Just reconnect with ssh root@YOUR_SERVER_IP and run the install command again. The installer is designed to pick up where it left off — it won't reinstall things that are already set up. [/callout]

[callout:info] What just got secured? The installer automatically set up four layers of protection:

• UFW firewall — blocks all network traffic except SSH (so you can connect), HTTP (port 80), and HTTPS (port 443). Everything else is locked down.
• Fail2ban — if someone (or a bot) fails to log in via SSH 5 times in 10 minutes, their IP address is automatically banned. This stops brute-force password guessing.
• Unattended Upgrades — your server will automatically install security patches daily. It only patches the operating system — it won't touch Docker, WordPress, or your website.
• Docker log rotation — container logs are capped at 30 MB each so they can't fill up your disk over months of running. [/callout]

[callout:warning] If you get a "permission denied" error, your server may need administrator privileges. Try this version instead:

sudo bash -c "$(curl -fsSL https://git.constantprojects.xyz/tankadmin/websitebox/raw/branch/main/install.sh)"

sudo is a command that gives you administrator access. You may be asked to enter your password again. [/callout]

[step: Complete the Setup Wizard (~3 minutes)]

The installer automatically launches an interactive setup wizard. It will ask you a series of questions to configure your website. Here's exactly what to expect, question by question:

1. Domain name Type your domain without https:// or www. Just the bare domain.

• Correct: mysite.com
• Wrong: https://mysite.com or www.mysite.com

2. Site title The name that appears at the top of your website and in browser tabs. You can change this later through WordPress, so don't stress about it.

• Press Enter to accept the default ("My Portfolio"), or type a custom name like Jane's Art Gallery

3. WordPress admin username This is the username you'll use to log into your website's control panel. Pick something personal — the wizard won't allow "admin" for security reasons.

• Good examples: jackie, jane_doe, myname2024
• Not allowed: admin

4. Admin email Your email address. WebsiteBox uses this for two things:

• Registering your free SSL certificate (the padlock icon that shows your site is secure)
• WordPress notifications (like update reminders)

5. Admin password You have two options:

• Type a password — must be at least 12 characters. You'll be asked to type it twice to confirm.
• Press Enter to auto-generate — the wizard creates a strong random 20-character password for you. It will be displayed on screen and saved to a file.

6. Age verification WebsiteBox can require visitors to confirm their age before viewing your site. This is useful for adult content portfolios.

• Press Enter (or type Y) to enable — you'll then choose a minimum age (18-21)
• Type n to disable — visitors go straight to your site

7. SMTP server (optional) SMTP is the technology that sends emails. This lets WordPress send emails like password resets, contact form notifications, and security alerts. If you don't have an email service set up, just press Enter to skip — your site will work perfectly fine without it, and you can always set it up later. Popular email relay services include Mailgun (free tier: 1,000 emails/month), SendGrid (free tier: 100 emails/day), and Amazon SES (very cheap at ~$0.10 per 1,000 emails).

8. Backup retention How many days to keep automatic backups of your site. The default is 30 days, which is a good balance between safety and disk space.

• Press Enter to accept 30 days, or type a different number (1-365)

Here's an example of what the wizard looks like:

[terminal] ═══════════════════════════════════════════════════════════ WebsiteBox Setup Wizard ═══════════════════════════════════════════════════════════

Please provide the following configuration:

Domain name (e.g., example.com): myportfolio.art Site title [My Portfolio]: Jane's Art Gallery WordPress admin username: janedoe Admin email (used for SSL & WordPress): jane@email.com

Set your WordPress admin password. Press Enter to auto-generate a secure 20-character password. Note: your password won't appear on screen as you type — that's normal. Admin password: Confirm password: ✓ Password set.

Enable age verification gate? (Y/n): Y Minimum age (18-21) [18]: 18

SMTP server (if you don't know what this is, press Enter to skip): Days to keep local backups (1-365) [30]:

═══════════════════════════════════════════════════════════ WebsiteBox Setup Complete! ═══════════════════════════════════════════════════════════

✓ Configuration saved to .env

Next steps:

1. Point your domain's A record to this server Type: A Name: @ (this means the root domain, e.g., myportfolio.art) Value: 203.0.113.45 (your server's IP address) TTL: Auto (or the lowest option available)

2. Wait for DNS propagation, then verify it's working dig myportfolio.art +short

   ✓ Success looks like: 203.0.113.45 ✗ Not ready yet: (blank output — wait and try again)

3. Launch your website source ~/.bashrc && websitebox up

4. Visit your site Your website: https://myportfolio.art Admin login: https://myportfolio.art/wp-admin Username: janedoe Password: (the password you set during setup)

═══════════════════════════════════════════════════════════ [/terminal]

[callout:danger] If your password was auto-generated, save it immediately. It's also saved in a file called .credentials inside the websitebox folder, but you should store it somewhere more permanent. The best option is a password manager like Bitwarden (free) or 1Password — these securely store all your passwords in one place. At minimum, write it down or save it in a note on your phone. Once you've stored the password somewhere safe, delete the file from your server by running: rm ~/websitebox/.credentials [/callout]

[callout:tip] The setup wizard summary shows your server's IP address and the next steps. It's a good idea to take a screenshot of this screen or copy the text for reference. [/callout]

[step: Point Your Domain to Your Server (~5 minutes + wait time)]

Right now, your domain name and your server don't know about each other. You need to create a connection between them so that when someone types your domain into a browser, the internet knows to send them to your server.

This is done by adding a DNS record — specifically an "A record" — in your domain registrar's settings. Think of it like updating a phone book: you're telling the internet "this domain name lives at this IP address."

How to do it:

1. Log in to the website where you bought your domain (Porkbun, Namecheap, Cloudflare, etc.)
2. Find your domain and look for DNS settings, DNS records, or Manage DNS — it's usually in the domain's settings page. On Porkbun, click the domain then look for "DNS" in the left menu. On Namecheap, go to your domain list and click "Manage" then "Advanced DNS." On Cloudflare, select your domain and click "DNS" in the sidebar.
3. Look for an existing A record, or click Add record / Add new record
4. Fill in these values:
   • Type: A
   • Host or Name: @ (the @ symbol means "the root domain itself" — i.e., yourdomain.com without anything in front)
   • Value, Answer, or Points to: Your server's IP address (the number from the "Get a Server" step, e.g., 203.0.113.45)
   • TTL: Leave as "Auto" or pick the lowest number available (like 300 or 600)
5. Click Save or Add record

[callout:tip] What about www? If you want www.yourdomain.com to also work (in addition to yourdomain.com), add a second DNS record: Type CNAME, Host/Name www, Value/Points to yourdomain.com. This tells browsers that www.yourdomain.com is an alias for your main domain. [/callout]

[callout:info] What is DNS propagation? After you save the record, the change needs to spread across the internet. This is called "propagation" and usually takes 5-30 minutes, though it can occasionally take up to 48 hours. During this time, your domain is being updated across servers worldwide. [/callout]

How to check if DNS is ready:

Go back to your server terminal (reconnect with ssh root@YOUR_SERVER_IP if you disconnected) and type:

[code:bash] dig yourdomain.com +short [/code]

Replace yourdomain.com with your actual domain. The dig command looks up where a domain points, and +short gives you just the IP address without extra technical details.

• If it shows your server's IP address (e.g., 203.0.113.45) — DNS is ready. Proceed to the next step.
• If it shows nothing, or a different IP address — DNS hasn't propagated yet. Wait 5-10 more minutes and try again.
• If you see dig: command not found — install it with apt install -y dnsutils, then try again. Or use nslookup yourdomain.com instead, or use the online tool below.

[terminal] $ dig myportfolio.art +short 203.0.113.45 [/terminal]

[callout:tip] You can also check DNS propagation from your own computer using a free online tool like whatsmydns.net — type in your domain and see if servers around the world are returning your IP address. [/callout]

[step: Launch Your Website (~2-3 minutes)]

This is the moment everything comes together. Make sure DNS is pointing to your server (you verified this in the previous step), then SSH into your server (if you disconnected, reconnect with ssh root@YOUR_SERVER_IP).

First, activate the websitebox shortcut command that the installer added for you:

[code:bash] source ~/.bashrc [/code]

(source reloads your shell configuration so the new websitebox command becomes available. You only need to do this once — it'll work automatically in future SSH sessions.)

Now launch your website with a single command:

[code:bash] websitebox up [/code]

That's it. This one command navigates to the project folder, builds any updated container images, and starts all the services in the background.

Here's what happens automatically behind the scenes:

1. Container images build — Docker builds the nginx and WordPress containers from the project files. You'll see lines like Building nginx... and Building wordpress... scrolling by. On the first run, this downloads base images and can take 1-2 minutes.
2. Database starts — MariaDB (a database server) starts up to store your website's content
3. WordPress installs — WordPress is set up with your chosen title, username, and plugins
4. SSL certificate acquired — A free security certificate from Let's Encrypt is obtained so your site gets the padlock icon in browsers
5. Web server configured — Nginx (the web server) starts serving your site to visitors

The first launch takes 2-3 minutes as everything downloads and configures. You can watch the real-time progress by running:

[code:bash] websitebox logs [/code]

You'll see messages scrolling by about each service starting up. When you see lines like WebsiteBox: First-run setup complete! and SSL certificate acquired successfully!, everything is ready.

Press Ctrl+C to stop watching the logs (hold the Ctrl key and press the C key). This only stops the log viewer — your website keeps running.

[callout:info] If you see a "Setting up SSL..." page when you visit your site, it means the SSL certificate hasn't been issued yet — usually because DNS hasn't fully propagated. This is not an error. Wait a few more minutes for DNS to finish updating, then tell the web server to retry:

websitebox restart nginx

The SSL certificate will be obtained automatically once DNS is working. [/callout]

[callout:tip] Quick reference — websitebox commands you can use from anywhere:

Command	What it does
websitebox up	Start your site (builds and runs everything)
websitebox down	Stop your site
websitebox logs	Watch live logs from all services
websitebox logs nginx	Watch logs from one specific service
websitebox restart nginx	Restart one service
websitebox ps	Show status of all containers

These are shortcuts for docker compose commands that automatically navigate to the project folder first. You can run them from any directory on your server. [/callout]

[callout:tip] After the first launch, you can always check that everything is running properly with:

[code:bash] cd ~/websitebox && ./scripts/healthcheck.sh [/code]

You should see [OK] next to each service. [/callout]

[step: Visit Your Site]

Open your web browser (Chrome, Firefox, Safari — any browser works) and go to your domain:

• Your website: https://yourdomain.com
• Admin dashboard: https://yourdomain.com/wp-admin

Replace yourdomain.com with your actual domain name (e.g., https://myportfolio.art).

What you should see:

When you visit your domain, you'll see a clean, minimal website with your site title. It won't have much content yet — that's expected. You'll add content in the next step.

If you enabled the age verification gate, you'll see an age confirmation screen first. This is working as intended. Confirm your age to proceed to the site. You can customize the gate's appearance and wording later inside WordPress under Settings > Age Gate.

When you visit /wp-admin, you'll see the WordPress login page — a simple form asking for a username and password. Enter the admin username and password you chose during the setup wizard, and you'll land on the WordPress Dashboard — your site's control center. The dashboard has a sidebar menu on the left with sections like Posts, Pages, Appearance, Plugins, and Settings. This is where you'll manage everything about your site.

[callout:tip] Bookmark these two URLs:

• https://yourdomain.com — your public website
• https://yourdomain.com/wp-admin — your admin dashboard (where you manage everything)

You'll visit /wp-admin frequently to add content, change settings, and manage your site. [/callout]

[callout:info] You should see a padlock icon in your browser's address bar. This means your site has a valid SSL certificate and all traffic is encrypted. If you see a security warning instead, wait a few minutes and refresh — the SSL certificate might still be processing. [/callout]

[step: Customize Your Site]

Now that your site is live, you can customize everything through the WordPress admin dashboard — no code or terminal commands needed. Here's a tour of the most important areas:

Changing your site's appearance:

Go to Appearance > Customize in the left sidebar. This opens a live preview where you can:

• Upload your logo and site icon (favicon)
• Change colors and fonts
• Adjust the header and footer layout
• Modify page layouts (sidebar, full-width, etc.)

Every change shows a real-time preview on the right side of the screen. Click Publish when you're happy with the changes.

Adding content:

• Blog posts: Go to Posts > Add New. Great for updates, articles, or portfolio pieces with dates.
• Pages: Go to Pages > Add New. Better for permanent content like "About Me," "Contact," or "Gallery."
• Media uploads: Go to Media > Add New to upload images, videos, or files. You can also upload directly while editing a post or page by clicking the + button and choosing "Image" or "Gallery."

Managing your pre-installed plugins:

WebsiteBox comes with three plugins already set up:

• Wordfence Security — Protects your site from hackers and brute-force login attempts. Configure under Wordfence in the sidebar. The default settings are good — you don't need to change anything unless you want to.
• UpdraftPlus — Creates automatic backups of your site. Configure under Settings > UpdraftPlus Backups. Backups are already set to save locally on your server. You can optionally add remote backup to services like Backblaze B2 or Amazon S3 for extra safety.
• Age Gate — The age verification screen. Configure under Settings > Age Gate. You can change the messaging, styling, minimum age, and which pages require verification.

Installing additional plugins:

Go to Plugins > Add New to browse thousands of free WordPress plugins. Some popular ones:

• Contact Form 7 or WPForms — for adding a contact form
• Yoast SEO — for search engine optimization
• WooCommerce — if you want to sell products
• Elementor — a drag-and-drop page builder for more advanced layouts

[callout:tip] The GeneratePress theme that WebsiteBox uses is lightweight, fast, and has tons of customization options built in. Explore Appearance > Customize thoroughly before installing additional theme plugins — you might find everything you need is already there. [/callout]

[callout:info] All the customization above happens through your browser in the WordPress admin. You never need to go back to the terminal for day-to-day site management. [/callout]

[step: Keep Your Site Running]

One of the best things about WebsiteBox is that it takes care of itself. Once your site is up, it automatically:

• Renews your SSL certificate before it expires (checked twice daily)
• Restarts after server reboots — if your VPS provider reboots the server for maintenance, your site comes back online automatically
• Backs up your data on a regular schedule via UpdraftPlus

That said, there are a few simple maintenance tasks worth doing occasionally. All of them require connecting to your server via SSH (same process as "Connect to Your Server" — open your terminal and run ssh root@YOUR_SERVER_IP) and running a short command.

Check that everything is running smoothly:

[code:bash] cd ~/websitebox && ./scripts/healthcheck.sh [/code]

This checks all four parts of your website and reports their status. You want to see [OK] next to each service:

[terminal] ═══════════════════════════════════════════════════════════ WebsiteBox Health Check ═══════════════════════════════════════════════════════════ [OK] nginx: healthy [OK] wordpress: healthy [OK] db: healthy [OK] certbot: running

All services are healthy. [/terminal]

If any service shows a problem, see the Troubleshooting step below.

Update WebsiteBox (when new versions are released):

[code:bash] cd ~/websitebox && ./scripts/update.sh [/code]

This shows you what changed, asks for confirmation, then updates everything safely. It pulls the latest improvements, rebuilds the containers, and verifies that your site is still healthy afterward.

Create a manual backup before making big changes:

[code:bash] cd ~/websitebox && ./scripts/backup.sh [/code]

This creates a snapshot of your database and all your website files, saved in the websitebox-data/backups/ folder on your server. Good practice before updating WordPress or installing new plugins.

Update WordPress itself, plugins, and themes:

This happens inside your browser, not the terminal. Log in to https://yourdomain.com/wp-admin, and when updates are available, you'll see a red notification badge on the left sidebar. Go to Dashboard > Updates and click the update buttons. WordPress will download and apply the updates automatically.

[callout:warning] Before running WordPress updates through the admin dashboard, it's smart to create a backup first: SSH into your server and run cd ~/websitebox && ./scripts/backup.sh. That way, if an update causes problems, you have a recent copy to fall back on. [/callout]

[callout:tip] How often should you check in? For most sites, checking in once a month is plenty. SSH in, run ./scripts/healthcheck.sh to verify things are healthy, run ./scripts/update.sh to get the latest WebsiteBox updates, and log into WordPress to apply any plugin/theme updates. The whole process takes about 5 minutes. [/callout]

[step: Troubleshooting]

If something isn't working, don't panic. Here are the most common issues and exactly how to fix them. For all of these, you'll need to connect to your server via SSH first (same as the "Connect to Your Server" step — open your terminal and run ssh root@YOUR_SERVER_IP).

Your site shows a "Setting up SSL..." page:

This means the SSL certificate hasn't been issued yet, usually because DNS isn't pointing to your server. To fix:

1. Go back to your domain registrar and double-check the A record points to the correct IP address (see "Point Your Domain to Your Server")
2. Wait for DNS propagation — try dig yourdomain.com +short to check
3. Once DNS is correct, tell the web server to retry:

[code:bash] websitebox restart nginx [/code]

You see "Error establishing a database connection":

The database may still be starting up (especially right after a first launch or reboot). Wait one minute and refresh the page. If it persists, check the status of your containers:

[code:bash] websitebox ps [/code]

This shows the status of each container. All services should show "Up" and "healthy." If the db service is missing or unhealthy, try restarting everything:

[code:bash] websitebox restart [/code]

You forgot your WordPress admin password:

No problem — you can reset it directly from the server terminal. The command is long but straightforward — just copy it and swap in your details. Replace two things:

• YOUR_USERNAME — your WordPress admin username (the one you chose during setup)
• NEW_PASSWORD — whatever you want your new password to be

[code:bash] websitebox exec wordpress su -s /bin/sh -c "wp user update YOUR_USERNAME --user_pass='NEW_PASSWORD' --path=/var/www/html" www-data [/code]

Worked example: If your username is janedoe and you want to change your password to MyNewSecurePass123:

[code:bash] websitebox exec wordpress su -s /bin/sh -c "wp user update janedoe --user_pass='MyNewSecurePass123' --path=/var/www/html" www-data [/code]

After running the command, you can immediately log in at https://yourdomain.com/wp-admin with the new password.

[callout:tip] This command looks complicated, but you don't need to understand how it works — just copy it, swap in your username and new password, and paste it into the terminal. The command reaches inside the WordPress container and uses WP-CLI (a WordPress command-line tool) to update your password. [/callout]

websitebox: command not found:

This happens when the websitebox shell command hasn't been loaded yet in your current terminal session. Run this to activate it:

[code:bash] source ~/.bashrc [/code]

Then try your command again (e.g., websitebox up). In future SSH sessions, the command will work automatically — you only need to run source once after the initial install.

"Permission denied" when running Docker commands:

This means your user account doesn't have permission to use Docker. Fix it by running:

[code:bash] sudo usermod -aG docker $USER [/code]

Then log out and log back in (close your SSH connection and reconnect with ssh root@YOUR_SERVER_IP). The command adds your user to the "docker" group, but it only takes effect after a fresh login.

Your site is down after a server reboot:

Docker should restart automatically, but if it doesn't:

[code:bash] sudo systemctl start docker websitebox up [/code]

The first command starts Docker itself, and the second starts your website containers.

You can't connect to your server at all (SSH times out):

If ssh root@YOUR_SERVER_IP just hangs and eventually says "Connection timed out," your server might be down. Check your VPS provider's dashboard — there's usually a status indicator showing if the server is running. Try rebooting it from the dashboard. If you can't SSH in but the server shows as running, use your provider's web console (see the tip in the "Get a Server" step) to access it through your browser.

Something else is wrong and you need more details:

View the live logs for each part of your website to see what's happening:

[code:bash] websitebox logs nginx [/code]

Replace nginx with wordpress or db to see logs for those services instead. Press Ctrl+C to stop watching. To see logs from all services at once, just run websitebox logs.

Nuclear option — start completely fresh:

If nothing else works and you want to reset your entire website (this deletes all your content, pages, and uploads):

[code:bash] websitebox down cd ~/websitebox rm -rf websitebox-data/ ./setup.sh websitebox up [/code]

Here's what each line does:

• websitebox down — stops and removes all the website containers
• cd ~/websitebox — navigate to the project folder (needed for the next commands)
• rm -rf websitebox-data/ — deletes all website data (database, uploads, certificates). This is irreversible.
• ./setup.sh — re-runs the setup wizard so you can configure everything fresh
• websitebox up — starts the website again from scratch

[callout:danger] The "nuclear option" above permanently deletes all your website content. Only use it as a last resort. Always try the other fixes first, and if possible, run ./scripts/backup.sh before wiping anything. [/callout]

[callout:tip] If you're stuck and the solutions above don't help, check the full Troubleshooting guide in the WebsiteBox repository for more detailed solutions covering upload limits, database connections, SSL renewal, and more. [/callout]

[step: Going Further]

Congratulations — you have a live, secure, self-hosted website. Here are some ideas for what to do next:

Set up offsite backups: Your site is already backing up to your server, but if your server's disk fails, those backups go with it. For extra safety, configure UpdraftPlus to also send backups to a cloud storage service. Go to Settings > UpdraftPlus Backups in your WordPress admin, click the Settings tab, and choose a remote storage option like Backblaze B2 (free up to 10 GB) or Google Drive.

Add a contact form: Most websites need a way for visitors to reach you. Install the Contact Form 7 or WPForms Lite plugin from Plugins > Add New, create a form, and add it to a "Contact" page.

Improve search engine visibility: When you're ready for search engines to find your site, go to Settings > Reading and uncheck "Discourage search engines from indexing this site." Install Yoast SEO for more control over how your site appears in Google results.

Put a CDN in front of your site: A CDN (Content Delivery Network) caches your images and pages on servers around the world, making your site load faster for visitors far from your server. Cloudflare offers a free plan — you just change your domain's nameservers to Cloudflare's.

Harden your server further: The installer already set up a firewall and fail2ban, which handles the vast majority of threats. For the next level of security, consider setting up SSH key authentication — this lets you log in without a password, using a cryptographic key stored on your computer instead. Once SSH keys are working, you can disable password login entirely, making brute-force attacks completely impossible.

Learn more about WordPress: WordPress.org's documentation and WPBeginner are excellent free resources for learning how to get the most out of your site. The WordPress block editor guide is particularly helpful for learning how to create beautiful page layouts.

Get help: If you run into problems or have questions, you can open an issue on our Git repository — that's where the project's developers and community track bugs and feature requests. You can also browse existing issues to see if someone has already had the same question.

[callout:tip] You now own your website infrastructure. Unlike hosted platforms, nobody can take your site down for content policy reasons, raise your prices unexpectedly, or lock you into their ecosystem. Your data lives on your server, and you can move it anywhere. [/callout]