Install WordPress on your own server

Install an application lists the Applications you can install — WordPress and Joomla. Choose the website, choose a folder if you want it somewhere other than the root, and Install. What you get back is a working site with its own database and an administrator account, not an archive to unpack.

It needs a PHP website that has finished being set up, and the database module. A static site has nothing to run the application with.

An application nobody updates is the most common way a hosted website is lost. WordPress keeps itself up to date, including major versions, through a plugin that cannot be switched off from its own dashboard, and the panel asks it what it is waiting on. Installed software is where you see that.

Joomla updates from its own dashboard and offers the panel nothing to ask, so it is shown as such rather than reported as up to date. That is a deliberate difference: saying "up to date" about something you cannot check is worse than saying you cannot check it.

A WordPress site is code somebody else wrote, updated on somebody else's schedule, with plugins nobody reviewed. So the protections on a website assume a compromise rather than hoping against one:

• A script uploaded into wp-content/uploads is served as a file, not run — which is how almost every compromise finishes
• xmlrpc.php is refused, unless you use the mobile app or Jetpack, in which case turn it back on
• Sign-in pages are rate limited, which makes the cheap automated attempt uneconomic
• PHP cannot run a command, so writing a file does not become having a shell

Each is a switch on the website's protection page, so one that gets in the way of something you genuinely need can be turned off.