WordPress on Candor: install, log in, update, cache

WordPress is a PHP application with a MySQL database, and every Candor plan runs it — there’s no special “WordPress tier” to buy. Each site lives in its own isolated container with guaranteed CPU and memory, PHP 8.3 by default (switchable per site), and a free Let’s Encrypt certificate that renews itself. This page covers the WordPress-specific parts: installing, the portal’s WordPress tab, updates, caching, and staging.

Installing WordPress

WordPress installs are created in your hosting control panel; the customer portal then detects them automatically.

1. Log in at my.candorhost.com and open your hosting service.
2. Click Open control panel.
3. Install WordPress on your site from the panel. It needs one MySQL database — every plan includes at least two (Databases has the details).
4. Back in the portal, open the WordPress tab, under “Apps & developer tools.” Your install appears there, ready for one-click access.

Already running WordPress somewhere else? Migration is free and done by hand — we move your sites, databases, and email for you. We reply within one business day to schedule it, and once a migration is underway it gets priority attention until it’s done. See Migrations.

The WordPress tab

The WordPress tab shows a card for each install it detects on your site: the site URL, the WordPress version, and how many plugins and users it has. Two buttons do the work:

• Log in to WordPress — a one-click secure login straight into wp-admin, opened in a new tab. No password to remember or paste; a fresh login link is generated each time you click.
• Update — updates WordPress core to the latest version. The portal asks you to confirm first, with the same advice we’d give anyway: back up first if you have custom code.

One honest boundary: the portal button updates WordPress core. Plugins and themes still update from wp-admin — which is one click away via the login button, so the routine is: log in, update plugins, done.

If the tab says “No WordPress sites detected,” there’s no WordPress install on the site yet. Anything you install from the control panel shows up here on its own.

Server-side caching

Server-side caching is included on every plan — Solo, Studio, and Org alike. It isn’t an upsell: it’s a line item in the same plan configuration files that provision your account, the ones published in numbers on the platform page. It’s part of the plan, not something you unlock by paying more.

If you add a WordPress caching plugin on top, keep it to one. Stacked cache layers rarely make anything faster, and they make “why is my change not showing up” much harder to debug.

Staging and cloning

	Solo	Studio	Org
Production websites	1	5	15
Staging websites	—	5	15
Site cloning	—	✓	✓

Studio and Org include staging websites and one-click site cloning: build and test a copy — a major plugin update, a redesign, a PHP version bump — then push it live. Solo is deliberately a single-production-site plan; if that’s you, take a fresh backup before big changes and restore if the change goes sideways.

These numbers come from the same configuration files that provision accounts. The full resource table is on the platform page.

Keeping WordPress healthy

The division of labor, honestly stated. What we already run for every site, no configuration needed:

• A web-application firewall (OWASP Core Rule Set) inspecting traffic at the edge.
• Daily malware scanning with automatic quarantine.
• Brute-force protection on every login surface.
• Free SSL, issued and renewed automatically.
• Automatic backups to separate backup infrastructure — a different physical server than your site.

What’s yours to keep on top of:

• Updates. Core from the portal button, plugins and themes from wp-admin. Out-of-date plugins are the most common way WordPress sites get compromised — the malware scanner catches infections after the fact; updates prevent them.
• Backups before big changes. Backups run automatically on every plan, but take a fresh one right before a major update or redesign. Restoring is self-service from the panel, one click, no ticket — see Backups.
• PHP version. The default is 8.3, and you can switch any site between PHP 7.4 and 8.4 from the portal’s PHP version tab — useful when an old plugin isn’t ready for a newer PHP. See PHP versions and limits.
• Admin accounts. Keep them to the people who need them. We protect the login surface against brute force; a shared or weak admin password defeats that from the inside.

When something breaks

• Site misbehaving after an update: restore the backup you took, or the most recent automatic one — Backups walks through it.
• Site down and you can’t tell why: open a ticket. During business hours (Monday–Friday, 9am–6pm ET) a site-down ticket gets a first response within 1 hour; everything else gets a first response within one business day. Automated monitoring runs 24/7 either way. The full commitment is in Candid Support.