Moving WordPress from shared hosting to a DigitalOcean Droplet

What you take on when you leave a managed panel

DigitalOcean's shared responsibility page says it maintains the security of the infrastructure your Droplet runs on, while you are responsible for securing the data you store. It recommends two-factor authentication, SSH keys and TLS, mentions host firewalls such as UFW or firewalld, offers Cloud Firewalls at no additional cost, notes it offers no logging service for Droplets, and says Droplet disks on local hypervisor storage are not encrypted at rest. Everything a shared host did quietly is now a job on your list.

Step 1: Size and build the Droplet

DigitalOcean's Basic Droplet pricing starts at $4 per month for 512 MiB of memory, then $6 for 1 GiB, $12 for 2 GiB with 1 vCPU, $18 for 2 GiB with 2 vCPUs and $24 for 4 GiB with 2 vCPUs. Backups cost 20% (weekly) or 30% (daily) of the Droplet price, so a $12 Droplet with daily backups costs $15.60 per month.

The WordPress 1-Click in DigitalOcean's Marketplace currently lists Ubuntu 24.04, the Caddy web server, MySQL 8.0, PHP 8.3, fail2ban and wp-fail2ban. Its example API command uses a 4 GB Droplet, but the listing does not state a minimum size. Note that the 1-Click uses Caddy, not Apache, so any .htaccess rules from your shared host will not apply and need to be translated.

Step 2: Move files and database

WordPress's migration guide says that if the domain and URLs stay the same you can move by copying files and the database, editing wp-config.php if the database name or user changes. Export the database from phpMyAdmin or the panel, copy wp-content and the root files over SFTP, import the database on the Droplet, and set file ownership for the web server user.

WordPress warns that a blanket find-and-replace on the database can break serialized data, and that the GUID column must never be changed. If you only change hosts, you should not need a search and replace at all.

• Note the PHP version on the shared host; the 1-Click ships PHP 8.3, so test old plugins first.
• Copy wp-config.php salts and table prefix rather than generating new ones, so existing sessions behave predictably.
• Record any panel cron jobs before you lose access to the panel.
• Translate .htaccess redirects into the web server you run on the Droplet.

Step 3: Split email off before cutover

DigitalOcean says SMTP ports 25, 465 and 587 are blocked on Droplets, including through a Reserved IP, and that self-hosted mail servers are frequently flagged as spam; it recommends a third-party email service. That has two consequences. Mailboxes must live with a mail provider, and WordPress must send through an API or SMTP service that does not depend on those ports from the Droplet.

Create mailboxes at the new provider and copy mail before changing MX records. Configure and test your site's sending service on the Droplet before DNS changes, using a password reset and a test order.

Step 4: Cron, backups and monitoring

WordPress's developer handbook explains how to set DISABLE_WP_CRON in wp-config.php and call wp-cron.php from the system crontab; its example runs every 15 minutes. For a membership site, this keeps renewals and drip schedules running even when traffic is low.

DigitalOcean's backups run inside a 4-hour window while the Droplet is running, are crash-consistent images of the whole disk, are stored in the same datacenter, and do not include attached Volumes. DigitalOcean warns disk write performance drops during backups. Add a separate database dump you store off-Droplet so you can restore content without rolling back the whole server.

Step 5: Test, then change the A record

Test the site against the Droplet IP using a hosts-file entry or a temporary subdomain, then lower the TTL on your A record a day before cutover. Change only the A record if your DNS host is separate; if DNS is at the shared host, copy every record to a new DNS host first.

• Log in as a test student and as an administrator on the new copy; confirm the session survives a page change and a logout.
• Pick three real members at different stages and compare course progress, quiz attempts and certificates on both copies.
• Compare the number of active memberships or subscriptions and the newest five orders on both copies.
• Send a password reset and a purchase receipt from the new copy and confirm both arrive.
• Open a protected lesson while logged out and confirm it is still blocked.

Sources & verification

Product details and prices can change. Check the linked provider before buying.

1. DigitalOcean: Shared responsibility model for Droplets Accessed 30 Oct 2026
2. DigitalOcean: Droplet pricing Accessed 30 Oct 2026
3. DigitalOcean Marketplace: WordPress 1-Click Accessed 30 Oct 2026
4. DigitalOcean Docs: Why is SMTP blocked? Accessed 30 Oct 2026
5. DigitalOcean Docs: Backups features Accessed 30 Oct 2026
6. WordPress Advanced Administration: Moving WordPress Accessed 30 Oct 2026
7. WordPress Developer Resources: Hooking WP-Cron into the system task scheduler Accessed 30 Oct 2026