Setting up WordPress on a DigitalOcean Droplet: the first-day checklist

What the Marketplace image installs

DigitalOcean's catalog page for the WordPress 1-Click lists the components below and their versions on 30 October 2026. Versions change as the image is rebuilt, so check the page on the day you create the Droplet. Caddy is the web server; there is no Apache or Nginx, and Caddy obtains and renews certificates itself, so guides that start with installing Certbot do not apply.

DigitalOcean lists a minimum of 1 CPU, 1 GB RAM and 25 GB storage, and recommends 2 or more CPUs, 2 GB or more RAM and 50 GB or more storage for production. A course site with logged-in students fits the recommended tier, not the minimum.

Sizing and the real monthly cost

Backups are priced as a percentage of the Droplet: 20% a month for weekly and 30% for daily on Basic plans. The table works that out for the Basic Droplets that meet or exceed DigitalOcean's production recommendation. Add the cost of a transactional email service, which you will need anyway (see below).

First login: what the script does and what it leaves

The setup script starts automatically the first time you SSH in as root. It asks for an email address, admin username, admin password and site title; detects the Droplet's public IP; creates the WordPress admin; has Caddy request a short-lived Let's Encrypt certificate for the IP address; configures HTTPS with an HTTP-to-HTTPS redirect; and installs WP fail2ban.

It does not ask for your domain. Create the DNS A record for your domain pointing at the Droplet's IP first, wait until it resolves, then run /root/wp_setup_domain.sh. Running it before DNS resolves means the certificate request for the domain has nothing to validate against. Generated credentials are stored in /root/.digitalocean_password; copy them into a password manager and remember that anyone with root on the Droplet can read that file.

The image's UFW firewall allows ports 22, 80 and 443. That is a host-level firewall you maintain from inside the server.

Firewall, backups and monitoring

DigitalOcean Cloud Firewalls cost nothing for Droplets and block all traffic not expressly allowed by a rule; since August 2026 they also support deny rules, which take precedence over matching allow rules. Create one that allows 80 and 443 from anywhere and 22 only from the addresses you administer from. Because a Cloud Firewall is network-based, it still applies if a UFW rule inside the server is changed by mistake.

Droplet backups are crash-consistent images of the whole disk taken during a 4-hour window you can choose, at frequencies from weekly up to every 4 hours depending on the plan. They do not include attached volumes. DigitalOcean stores backups in the same datacenter as the Droplet and notes that disk write performance degrades while a backup is created, so also schedule a nightly database dump that is copied off the Droplet.

DigitalOcean Monitoring is free, but alert policies only list Droplets that have the metrics agent installed. Install it, then create resource alerts. DigitalOcean suggests starting at 70% for CPU, memory and disk, and setting load-average alerts near or slightly above the vCPU count; durations of 5, 10, 30 or 60 minutes are offered, with notifications by email or Slack. Resource alerts tell you the server is struggling, not that the site is down, so pair them with an external uptime check.

Mail and scheduled jobs

SMTP ports 25, 465 and 587 are blocked on all Droplets by default, including traffic through a Reserved IP. DigitalOcean recommends a third-party email service rather than running your own mail server. Until you install an SMTP or API mail plugin connected to such a service, WordPress password resets, receipts and enrolment emails will silently fail.

WordPress runs WP-Cron on page loads rather than continuously, so on a quiet site renewals and drip releases can run late. The WordPress handbook shows how to add define( 'DISABLE_WP_CRON', true ); to wp-config.php and call wp-cron.php from the system crontab instead, for example every 15 minutes. On a Droplet you own the crontab, so this is a five-minute change worth making on day one.

The jobs you now own

DigitalOcean's shared responsibility model for Droplets says it secures the underlying infrastructure while you secure the data you store. It notes that Droplet disks on the hypervisor's local storage are not encrypted at rest and that there is no logging service for Droplets. The page does not assign operating system patching or application security to DigitalOcean, so plan for them yourself.

First-day checklist

• Create the Droplet from the WordPress 1-Click with at least 2 GiB RAM, and enable backups at creation.
• SSH in, complete the setup script, and store the admin and database credentials outside the server.
• Point the A record, wait for it to resolve, then run /root/wp_setup_domain.sh and confirm HTTPS on the domain.
• Attach a Cloud Firewall: 80 and 443 open, 22 limited to your addresses.
• Install the metrics agent; create CPU, memory and disk alerts at 70% and a load alert near the vCPU count.
• Install a mail plugin connected to a transactional provider and send a password reset to yourself.
• Move WP-Cron to the system crontab and confirm a scheduled task runs.
• Schedule an off-Droplet database dump and write down the restore steps.

Sources & verification

Product details and prices can change. Check the linked provider before buying.

1. DigitalOcean Docs: WordPress 1-Click (Marketplace catalog) Accessed 30 Oct 2026
2. DigitalOcean Marketplace: WordPress Accessed 30 Oct 2026
3. DigitalOcean: Droplet pricing Accessed 30 Oct 2026
4. DigitalOcean Docs: Backups pricing Accessed 30 Oct 2026
5. DigitalOcean Docs: Backups features Accessed 30 Oct 2026
6. DigitalOcean Docs: Cloud Firewalls Accessed 30 Oct 2026
7. DigitalOcean Docs: Monitoring Accessed 30 Oct 2026
8. DigitalOcean Docs: Set up resource alerts Accessed 30 Oct 2026
9. DigitalOcean Docs: Why is SMTP blocked? Accessed 30 Oct 2026
10. DigitalOcean: Shared responsibility model for Droplets Accessed 30 Oct 2026
11. WordPress Developer Handbook: Hooking WP-Cron into the system task scheduler Accessed 30 Oct 2026