Upgrade PHP from 7.2 to 7.4 on Amazon Linux 2

In response to WordPress warning about the version of PHP, I decided I should upgrade:

My WordPress operates on an EC2 instance as described in a previous blog post and steps to update are described below:

STEP 1: ssh to the EC2 instance with PuTTY or similar (I’m using WSL – Windows Subsystem for Linux to connect from a Ubuntu shell).

STEP 2: Update the system, note this does not update php:

$ sudo yum update

STEP 3: Check the version of PHP and make sure the amazon-linux-extras package is installed:

$ php -v
$ which amazon-linux-extras

STEP 4: Verify the PHP7.x topic is available:

$ sudo amazon-linux-extras | grep php

STEP 5: Disable both the php7.2 and lamp-mariadb10.2-php7.2 topics

$ sudo amazon-linux-extras disable php7.2
$ sudo amazon-linux-extras disable lamp-mariadb10.2-php7.2

If you see the warning “Beware that disabling topics is not supported after they are installed.” it can be safely ignored.

STEP 6: Check the status of available topics

$ sudo amazon-linux-extras | grep php

STEP 7: Enable the php7.4 topic.

$ sudo amazon-linux-extras enable php7.4

STEP 8: Check with

$ sudo amazon-linux-extras | grep php

STEP 9: Update to PHP 7.4. First clean up the metadata and then install php along with any dependencies:

$ sudo yum clean metadata
$ sudo yum install php 

STEP 10: Check the version of PHP

$ php -v

STEP 11: Reboot the instance or just restart apache with:

$ sudo systemctl restart httpd

STEP 12: Test the WordPress site and verify

The steps above were sufficient for my setup but may be different in other environments.


WordPress on Amazon EC2

Hosting this simple WordPress site on AWS:

The Aim:

Deploy a personal website and blog in AWS using a previously registered domain name: using the free tier, setting up a WordPress site on a single EC2 instance with Amazon RDS for MySQL to run the MySQL database.

For the exercise I mostly followed with additional tasks, including creating a new VPC, deploying a Load Balancer and updating Route 53.

I also used , as reference and reviewed Lab exercises performed as part of Adrian Cantrill’s course.

The Architecture
The Architecture

1. VPC:

My first step was to create a new VPC in eu-central-1 Frankfurt with a CIDR and four subnets, 2 public and 2 private across 2 Availability Zones.

2. Creating a MySQL Database with RDS:

After deleting my first DB as it was associated with all four of my subnets, I created a Subnet Group containing my two private subnets before creating my new DB instance.

Next I created the RDS database, with MySQL as the engine, choosing the latest available version of MySQL and selecting the free tier.

Stepping through the options I set:

  • My DB instance identifier.
  • The master username and password for my database.
  • Instance class and storage details, as I’m using the free tier options are limited.
  • The configure connectivity and network configuration, choosing my new VPC and Subnet Group
  • Created a new Security Group, for now without any Inbound rules set, this will come later
  • Set the initial database name

3. Creating an EC2 Instance:

Next to create an Amazon EC2 instance to run the WordPress site, selecting Launch instance to open the instance creation wizard and selecting

  • The AMI of Amazon Linux 2
  • An instance type of t2.micro, free tier-eligible
  • Selecting my VPC and a public subnet
  • Minimal storage
  • Added a Name Tag
  • Configured a new Security, limiting ssh access from only my home and office IP and allowing HTTP from outside for initial testing
  • Created and downloaded a new key pair

4. Configuring Your RDS Database

At this point I’ve created my RDS database and my EC2 instance, the next action is to configure the RDS database.

  • ssh to the EC2 instance with the .pem file downloaded earlier and install a MySQL client to interact with the database
sudo yum install -y mysql
  • Find the hostname for the RDS database in the AWS console. In the details of the RDS database, the hostname will be shown as the Endpoint in the Connectivity & security section.
  • Use the dig command from the EC2 instance to check DNS
  • In the terminal, enter the following command to set an environment variable for the MySQL host. Be sure to replace “<your-endpoint>” with the hostname of the RDS instance.
export MYSQL_HOST=<your-endpoint>
  • Next, run the following command in the terminal to connect to the MySQL database. Replace “<user>” and “<password>” with the master username and password configured when creating the RDS database.
mysql --user=<user> --password=<password> wordpress
  • If connected successfully, the terminal should indicate connection to the MySQL database as shown in the following image.
  • Finally, create a database user for the WordPress application and give it permission to access the “wordpress” database. Run the following commands, substituting “wordpress-pass” for a strong password :
CREATE USER 'wordpress' IDENTIFIED BY 'wordpress-pass';
GRANT ALL PRIVILEGES ON wordpress.* TO wordpress;
An alternative method to the above is to Configure Authentication Variables. 


STEP: Create WordPress DB

echo "CREATE DATABASE $DBName;" >> /tmp/db.setup
echo "CREATE USER '$DBUser'@'localhost' IDENTIFIED BY '$DBPassword';" >> /tmp/db.setup
echo "GRANT ALL ON $DBName.* TO '$DBUser'@'localhost';" >> /tmp/db.setup
echo "FLUSH PRIVILEGES;" >> /tmp/db.setup
mysql -u root --password=$DBRootPassword < /tmp/db.setup
sudo rm /tmp/db.setup

5. Install Apache on EC2

To run WordPress, you need to run a web server on your EC2 instance. Apache and Nginx are popular web servers used with WordPress, choosing the best one is a matter of some debate.

  • I’ve installed Apache on the EC2 instance with the following command:
sudo yum install -y httpd
  • To start the Apache web server, run the following commands in the terminal:
sudo service httpd enable
sudo service httpd start
  • Confirm Apache is working by browsing to the Public IP of the EC2 instance

6. Download and Configure WordPress on EC2

In this step, we will download the WordPress software and set up the configuration.

First, download and uncompress the software by running the following commands in the terminal:

tar -xzf latest.tar.gz

If you run “ls” to view the contents of your directory, you will see a tar file and a directory called wordpress with the uncompressed contents.

$ ls
latest.tar.gz  wordpress

Change into the wordpress directory and create a copy of the default config file using the following commands:

cd wordpress
cp wp-config-sample.php wp-config.php

Then, open the wp-config.php file using vi:

vi wp-config.php

You need to edit two areas of configuration.

First, edit the database configuration by changing the following lines:

// ** MySQL settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define( 'DB_NAME', 'database_name_here' );

/** MySQL database username */
define( 'DB_USER', 'username_here' );

/** MySQL database password */
define( 'DB_PASSWORD', 'password_here' );

/** MySQL hostname */
define( 'DB_HOST', 'localhost' );

The values should be:

  • DB_NAME: “wordpress”
  • DB_USER: The name of the user you created in the database in the previous module
  • DB_PASSWORD: The password for the user you created in the previous module.
  • DB_HOST: The hostname of the database that you found in the previous module.

The second configuration section you need to configure is the Authentication Unique Keys and Salts. It looks as follows in the configuration file:

 * Authentication Unique Keys and Salts.
 * Change these to different unique phrases!
 * You can generate these using the {@link secret-key service}
 * You can change these at any point in time to invalidate all existing cookies. This will force all users to have to log in again.
 * @since 2.6.0
define( 'AUTH_KEY',         'put your unique phrase here' );
define( 'SECURE_AUTH_KEY',  'put your unique phrase here' );
define( 'LOGGED_IN_KEY',    'put your unique phrase here' );
define( 'NONCE_KEY',        'put your unique phrase here' );
define( 'AUTH_SALT',        'put your unique phrase here' );
define( 'SECURE_AUTH_SALT', 'put your unique phrase here' );
define( 'LOGGED_IN_SALT',   'put your unique phrase here' );
define( 'NONCE_SALT',       'put your unique phrase here' );

Go to this link to generate values for this configuration section. Replace the entire content in that section with the content from the link. Save and exit from vi.

With the configuration updated, we are almost ready to deploy the WordPress site. In the next step, we will make your WordPress site live.

7. Deploying WordPress

In this step, we will download the WordPress software and set up the configuration, making the Apache web server handle requests for WordPress.

First, install the application dependencies we need for WordPress. In the terminal, run the following command.

sudo amazon-linux-extras install -y lamp-mariadb10.2-php7.2 php7.2

Second, change to the proper directory by running the following command:

cd /home/ec2-user

Then, copy your WordPress application files into the /var/www/html directory used by Apache.

sudo cp -r wordpress/* /var/www/html/

Finally, restart the Apache web server to pick up the changes.

sudo service httpd restart

You should see the WordPress welcome page and the five-minute installation process.

8. Enable HTTPS / Load balancers and Update Route 53

Next I wanted to switch to HTTPS to access the site through

  • Created a new Elastic Load Balancer with HTTP and HTTPS support
  • Configured my Security Settings, requesting a new certificate from AWS Certificate Manager (ACM), using DNS validation.
  • Configure the Security Group
  • Configured the Routing
  • Created my Target Groups for the ELB, registered the target EC2 instance and configured the Health Checks
  • Updated Route 53 to point and to the new ELB.
ACM Cert Request


After configuring the above I hit a couple of issues. Firstly the website was only displaying simple text. Once I fixed that I found links were trying to leave and follow the Public IP of the instance.

To help isolate and resolve the second issue, I created a very simple static website with a couple of links:

[ec2-user@ip-10-84-1-125 html-static]$ cat index.html
 <!DOCTYPE html>
<title>HTML Tutorial is</title>

<h1>This is a heading yes</h1>
<p>This is a paragraph oh boy.</p>

 <a href="">Visit!</a>
 <a href=link1.html>Visit Link1</a>
 <a href=link2.html>Visit Link2</a>

[ec2-user@ip-10-84-1-125 html-static]$ cat link1.html
 <!DOCTYPE html>
<title>HTML Tutorial LINK1 </title>

<h1>This is a heading LINK1 </h1>
<p>This is a paragraph LINK1</p>

[ec2-user@ip-10-84-1-125 html-static]$ cat link2.html
 <!DOCTYPE html>
<title>HTML Tutorial LINK2 </title>

<h1>This is a heading LINK2 </h1>
<p>This is a paragraph LINK2</p>

[ec2-user@ip-10-84-1-125 html-static]$

Then resolved the WordPress settings, switching my apache root back to WordPress.

9. Next Steps

  • Explore WordPress and its available themes and populate this site.
  • Secure the site, I have the WP Cerber plugin enabled to help against brute-force attacks on the wp-admin page, limiting login attempts to 5 before blocking an IP address. Attempts to hide the wp-admin with did not work for me, so I plan to revisit this.
  • Deploy a second EC2 instance in a different AZ and update my ELB Target Groups.
  • Tear everything down and redeploy with CloudFormation.
  • Monitor costs with Cost Explorer to ensure I keep within the free tier with Billing Alerts configured.
Limiting login attempts.
Blocking an IP.

July 2021 Update: