Before the install
Pick a supported OS release, create a non-root user with sudo, disable password authentication for SSH, and enable a host firewall that allows only ports 22, 80 and 443. These four steps remove most of the noise you would otherwise be debugging later.
The checklist
- System packages updated and unattended security upgrades enabled.
- PHP version supported by your theme and plugins, with all required extensions.
- Database bound to localhost, with a dedicated low-privilege user.
- TLS certificate issued and a renewal timer verified.
- Automated database and file backups stored off the instance, with one restore actually tested.
- Basic monitoring for disk space, memory and HTTP status.
After go-live
Log in once a week for the first month and read the update screen. An unattended WordPress installation is not a stable installation; it is an installation whose problems you have not met yet.