WordPress with Bedrock

WordPress is an open source blogging platform written in PHP and distributed under the GPLv2 licence.

WordPress was released in 2003 by Matt Mullenweg and Mike Little as a fork of b2/cafelog. It is maintained by the WordPress foundation.

Bedrock is a Wordpress-Boilerplate with an improved folder structure, easier configuration options and development. Dependencies like themes or plugins are managed with Composer. Since Bedrock separates the non-web files from the document root, it is also more secure.

It is maintained by roots.io and released and distributed under MIT Licence.


For this guide you should be familiar with the basic concepts of


Wordpress recommends PHP in version 8.0:

[isabell@stardust ~]$ uberspace tools version use php 8.0
Selected PHP version 8.0
[isabell@stardust ~]$

You’ll need your MySQL credentials. Get them with my_print_defaults:

[isabell@stardust ~]$ my_print_defaults client
[isabell@stardust ~]$

We suggest using an additional database. Create one with:

[isabell@stardust ~]$ mysql -e "CREATE DATABASE ${USER}_wp"

Your blog domain needs to be setup:

[isabell@stardust ~]$ uberspace web domain list
[isabell@stardust ~]$


cd to the path above your document root and download bedrock with composer:

[isabell@stardust ~]$ cd /var/www/virtual/$USER/
[isabell@stardust isabell]$ composer create-project roots/bedrock
Installing roots/bedrock (1.17.1)
  - Downloading roots/bedrock (1.17.1)
  - Installing roots/bedrock (1.17.1): Extracting archive
Created project in /var/www/virtual/sbtest1/bedrock
> php -r "copy('.env.example', '.env');"
Installing dependencies from lock file (including require-dev)
Verifying lock file contents can be installed on current platform.
Package operations: 16 installs, 0 updates, 0 removals
  - Installing composer/installers (v1.12.0): Extracting archive
  - Installing roots/wordpress-core-installer (1.100.0): Extracting archive
  - Installing oscarotero/env (v2.1.0): Extracting archive
  - Installing roave/security-advisories (dev-latest bac54e1)
  - Installing roots/bedrock-autoloader (1.0.4): Extracting archive
  - Installing roots/bedrock-disallow-indexing (2.0.0): Extracting archive
  - Installing roots/wordpress (5.8.2): Extracting archive
  - Installing roots/wp-config (1.0.0): Extracting archive
  - Installing roots/wp-password-bcrypt (1.1.0): Extracting archive
  - Installing squizlabs/php_codesniffer (3.6.1): Extracting archive
  - Installing symfony/polyfill-php80 (v1.23.1): Extracting archive
  - Installing symfony/polyfill-mbstring (v1.23.1): Extracting archive
  - Installing symfony/polyfill-ctype (v1.23.0): Extracting archive
  - Installing phpoption/phpoption (1.8.0): Extracting archive
  - Installing graham-campbell/result-type (v1.0.3): Extracting archive
  - Installing vlucas/phpdotenv (v5.3.1): Extracting archive
Generating optimized autoload files
[isabell@stardust isabell]$


Wordpress-Configuration is done using .env-Files. Edit /var/www/virtual/$USER/bedrock/.env

In here you need to enter your MySQL credentials database connection parameters and the name of your database (e.g. isabell_wp).


# Optionally, you can use a data source name (DSN)
# When using a DSN, you can remove the DB_NAME, DB_USER, DB_PASSWORD, and DB_HO$
# DATABASE_URL='mysql://database_user:database_password@database_host:database_$

# Optional variables
# DB_HOST='localhost'
# DB_PREFIX='wp_'


# Generate your keys here: https://roots.io/salts.html

You can use Roots’ Salt-Creator to generate the Salts.


You can leave the WP_ENV Setting on development for now, but don’t forget to set it on production when launching your site. See the Bedrock-Documentation for more Info on Environment-Settings

You now need to set your document root to the bedrock/web/ directory. To do this, we delete the standard document root folder and create a symlink instead.

[isabell@stardust ~]$ rm -f /var/www/virtual/$USER/html/nocontent.html
[isabell@stardust ~]$ rmdir /var/www/virtual/$USER/html

[isabell@stardust ~]$ ln -s /var/www/virtual/$USER/bedrock/web /var/www/virtual/$USER/html
[isabell@stardust ~]$

Point your browser to your domain, https://isabell.uber.space/wp/wp-admin in this example, to start the wordpress installation process. Here you will

  • Set a language

  • Choose a Site title

  • Set a administrative account and password

Your site is now ready to use.


Your Website will be available in your root-directory (e.g. https://isabell.uber.space/). Unlike a standard WordPress-Installation, the Backend will be available in the /wp subdirectory. To get there point your browser to https://isabell.uber.space/wp/wp-admin.

Installing Plugins

Unlike a “normal” Wordpress-Installation, with bedrock, you cannot install Plugins or edit Code via the Wordpress-Backend. This is intended behaviour and part of the reason to use bedrock in the first place.

Instead you can use composer to manage Plugins. Every Plugin (or Theme) listed in on Wordpress.org is present as a Composer-Package in the WPackagist-Repository.

To install a plugin, find the exact plugin name (e.g. simple-page-ordering) from the Wordpress Plugin Directory and get it via composer:

[isabell@stardust ~]$ cd /var/www/virtual/$USER/bedrock/
[isabell@stardust bedrock]$ composer require wpackagist-plugin/simple-page-ordering
Using version ^2.3 for wpackagist-plugin/simple-page-ordering
./composer.json has been updated
Running composer update wpackagist-plugin/simple-page-ordering
Loading composer repositories with package information
Updating dependencies
Lock file operations: 1 install, 0 updates, 0 removals
  - Locking wpackagist-plugin/simple-page-ordering (2.3.4)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 1 install, 0 updates, 0 removals
  - Downloading wpackagist-plugin/simple-page-ordering (2.3.4)
  - Installing wpackagist-plugin/simple-page-ordering (2.3.4): Extracting archive
Generating optimized autoload files
[isabell@stardust bedrock]$

You can do the same thing with themes, using wpackagist-theme:

[isabell@stardust ~]$ cd /var/www/virtual/$USER/bedrock/
[isabell@stardust bedrock]$ composer require wpackagist-theme/twentytwenty
Using version ^1.8 for wpackagist-theme/twentytwenty
./composer.json has been updated
Running composer update wpackagist-theme/twentytwenty
Loading composer repositories with package information
Updating dependencies
Lock file operations: 1 install, 0 updates, 0 removals
  - Locking wpackagist-theme/twentytwenty (1.8)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 1 install, 0 updates, 0 removals
  - Downloading wpackagist-theme/twentytwenty (1.8)
  - Installing wpackagist-theme/twentytwenty (1.8): Extracting archive
Generating optimized autoload files
[isabell@stardust bedrock]$



Whilst using Wordpress with bedrock it does not update itself automatically by default. Also updating via the wordpress Admin-Backend is not possible as soon as your environment is set to production. Checkout the Wordpress-Blog for Updates.

Updating Plugins

For Plugins and themes installed with composer, you can simply use composer update in the bedrock directory:

[isabell@stardust ~]$ cd /var/www/virtual/$USER/bedrock/
[isabell@stardust bedrock]$ composer update
Loading composer repositories with package information
Updating dependencies (including require-dev)
Package operations: 0 installs, 3 updates, 0 removals
 - Updating phpoption/phpoption (1.7.2 => 1.7.3): Downloading (100%)
 - Updating vlucas/phpdotenv (v4.1.0 => v4.1.2): Downloading (100%)
 - Updating roave/security-advisories (dev-master 0365bf2 => dev-master b81a572)
Writing lock file
Generating optimized autoload files
[isabell@stardust bedrock]$

Updating Wordpress core

To update Wordpress itself you have several options:

  • Requiring the new version with composer require. In this example we want to update to version 5.3.2:

[isabell@stardust ~]$ cd /var/www/virtual/$USER/bedrock/
[isabell@stardust bedrock]$ composer require roots/wordpress 5.3.2
  • Editing /var/www/virtual/$USER/bedrock/composer.json to always update wordpress when running composer update.

Change the line "roots/wordpress": "5.3.2" to "roots/wordpress": "^5.3.2" (your version number might vary) and safe. Then run composer update as for plugins.

Tested with Bedrock 1.21.1, Wordpress 6.1.1, Uberspace 7.13.0, and PHP 8.0

Written by: Lukas Herzog <hallo@lukasherzog.de>