Keep the pieces separate
Create a database and a user that can access only that database. Never reuse the root account in wp-config.php. Generate the security salts from the official generator rather than leaving the placeholders in place.
Ownership matters more than permissions
Most ‘cannot install plugin’ errors come from files owned by root while PHP runs as www-data. Set the web user as owner and use 755 for directories and 644 for files. Keep wp-config.php at 600 where the hosting setup allows it.
sudo chown -R www-data:www-data /var/www/wordpressmentor.com
find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;Replace the pseudo-cron
WordPress fires scheduled tasks on page views by default. On a low-traffic site that means missed schedules; on a busy site it means needless overhead. Disable the built-in trigger and add a real system cron entry.
define( 'DISABLE_WP_CRON', true );
*/5 * * * * php /var/www/wordpressmentor.com/wp-cron.php >/dev/null 2>&1Finish by taking a snapshot of the instance. A known-good baseline is the cheapest insurance you will ever buy.