Web Development

Installing a CMS in 2026: self-hosted or managed hosting?

8 min readBy Sandeep Mahajan

A hand sliding a server into a rack in a data centre aisle

Installing a self-hosted CMS such as WordPress or Drupal takes a domain, a server with a supported PHP version, a MySQL-compatible database and HTTPS, and then an install script that asks for your database details and an admin account. The install itself is the short part. The real decision is who runs the site afterwards: on self-hosted servers you own updates, backups, security and PHP upgrades; on managed hosting the provider takes most of that on; on a hosted or headless platform there is nothing to install at all.

Key takeaways

  • WordPress recommends PHP 8.3 or newer, MySQL 8.0 or MariaDB 10.11 or newer, and HTTPS support. It can still run on PHP 7.4, but WordPress warns that such versions are past end of life and may expose the site to vulnerabilities.
  • Drupal 11 supports PHP 8.3 and 8.4 (and 8.5 from Drupal 11.3), is installed with Composer, and is meant for Linux servers in production.
  • Many hosts offer a one-click installer, so on shared or managed hosting installation takes minutes.
  • Choosing managed hosting is choosing who handles updates, backups and security. WordPress core installs minor (maintenance and security) releases automatically by default; plugins and themes do not update automatically unless you turn it on.
  • Plan the PHP version as well as the CMS version: each PHP branch gets about two years of active support and two of security fixes, so a server set up today will need an upgrade within its working life.

What does installing a CMS involve today?

Four things before the CMS itself, and two after:

  1. A domain name and DNS you control. A .com is widely recognised; a country domain such as .ca or .in can signal a local business. Register it in the business's name, not a supplier's.
  2. Hosting that meets the CMS's requirements (see below).
  3. A database and a database user for the CMS.
  4. HTTPS, which most hosts now provide with a free certificate.
  5. The install: upload or fetch the files and run the installer.
  6. Running it: updates, backups, monitoring and security, for as long as the site exists.

The earlier version of this article covered steps 1, 2 and 5 for a traditional shared host with FTP. The steps are the same in principle, but the tooling has moved on: one-click installers, SSH and Composer have mostly replaced uploading files by FTP, and the choice between self-hosted and managed hosting matters more than the install itself.

What server does WordPress need?

According to WordPress.org's requirements page, as of October 2026:

Requirement Recommended
PHP 8.3 or greater
Database MySQL 8.0 or greater, or MariaDB 10.11 or greater
HTTPS Supported by the host
Web server Apache or Nginx recommended; any server with PHP and MySQL support works

WordPress also recommends running PHP under your account's own user rather than a shared default user. It can run on PHP 7.4 and MySQL 5.5.5 in legacy environments, but the requirements page warns that these are past official end of life. If a host offers only old versions, choose another host.

What does Drupal need?

Drupal's documentation lists MariaDB, MySQL, PostgreSQL and SQLite as supported databases, Apache, Nginx and other web servers, and Linux or a similar operating system for production (Windows for development only). PHP support depends on the Drupal version:

Drupal version Supported PHP
Drupal 10 (10.4 to 10.6) 8.1, 8.2, 8.3 and 8.4
Drupal 11 (11.1 to 11.4) 8.3 and 8.4; 11.3 and 11.4 also support 8.5

Drupal is installed and updated with Composer, and the community recommends DDEV for local development. Drupal also offers Drupal CMS, a packaged version aimed at marketers and content teams, with a trial on drupal.org. In practice Drupal suits teams with a developer or agency on hand, because Composer-based updates are a developer task.

What are the install steps for WordPress?

WordPress's own installation guide describes five steps:

  1. Download WordPress from wordpress.org (always from the official source, so you get the current version with its security fixes) and extract it.
  2. Create a database and a MySQL or MariaDB user with full privileges on it, using the host's control panel, phpMyAdmin or the MySQL client.
  3. Optionally set up wp-config.php with the database name, user, password and host, plus the secret keys; the installer can create it for you.
  4. Upload the files to the web root or a subdirectory, using SFTP or shell access.
  5. Visit /wp-admin/install.php and enter the site title, admin username, password and email address.

Many hosts automate all five with a one-click installer. Either way, pick an admin username that is not "admin", use a long unique password and turn on two-factor authentication from the start. Our guide to WordPress security in 2026 lists the habits that prevent most problems.

Self-hosted, managed or hosted: who does what?

Task Self-hosted on your own server or VPS Managed CMS hosting Hosted platform (for example WordPress.com) or SaaS headless CMS
Install You Provider or one click Nothing to install
Server, PHP and database upgrades You Provider Provider
CMS core updates You (minor WordPress releases are automatic by default) Usually the provider Provider
Plugin or module updates You Varies by provider Provider, or limited plugin choice
Backups and restore You Usually included; check how restores work Provider
Security and firewall You Usually included Provider
Freedom to change code and plugins Full Most Least

WordPress.com's own comparison, as of October 2026, says that on its platform "Updates, backups, and free domain SSL are all handled automatically", plugins can be installed on any paid plan, and it blocks plugins it considers risky. A self-hosted install can run any plugin, which is both the advantage and the risk.

Managed hosting varies widely between providers, so ask each one the same questions: which updates they apply and how fast, how often backups run, how long they keep them, how you restore one, and what happens when an update breaks the site.

What happens after the install?

The site needs looking after for its whole life. On WordPress, existing installations receive minor core updates automatically by default and translations update automatically; plugins and themes do not, except in special cases decided by WordPress.org. Major core updates are on by default for fresh installs since WordPress 5.6, unless the site is under version control.

PHP needs upgrading too. As of October 2026, php.net lists PHP 8.2 in security-only support until 31 December 2026, 8.3 until 31 December 2027, 8.4 in active support until 31 December 2026 with security fixes until the end of 2028, and 8.5 in active support until the end of 2027. Older branches no longer receive security fixes. Schedule the PHP upgrade before your branch's end date, and test plugins on a staging copy first.

Speed is the other ongoing job. Caching, image handling and plugin choice decide most of it; our guide to speeding up WordPress covers the fixes that matter.

When should you skip installing a CMS at all?

When nobody on your side will maintain it, or when content rarely changes. A headless CMS run as a service, or a static site built from Markdown, removes the server, database and plugin updates from the picture. Our comparison of headless, static and WordPress options explains the trade-offs.

We made that choice for our own site. impingesolutions.com ran on WordPress on a small VPS (about $20 a month, our approximate figure), and in October 2026 we moved it to a static Astro build served from Amazon S3 and CloudFront. The write-up of that migration covers what changed and what it took. A static site is not right for everyone: if many people edit content every day, or you depend on WordPress plugins for shop, membership or booking features, a well-run CMS on good hosting is usually the better choice.

If you want help choosing or setting up a platform, our CMS development team works with WordPress, Drupal and headless set-ups.

FAQ

How long does it take to install WordPress?

With a host's one-click installer, a few minutes. A manual install, with a database to create and files to upload, is still well under an hour for someone who has done it before. Configuration, design and content take far longer.

Do I need to know how to code to install a CMS?

Not for WordPress on a host with a one-click installer. Drupal is installed and updated with Composer, so it needs a developer or a comfortable command-line user.

Is managed WordPress hosting worth it?

It is worth it if nobody on your team will apply updates, check backups and handle a hacked or broken site. Compare what each provider actually includes; the label means different things at different hosts.

Can I move from WordPress.com to self-hosted WordPress later?

Yes. WordPress.com and self-hosted WordPress run the same core software, and WordPress includes export and import tools for content. Plan for redirects and re-checking plugins and theme.

Which PHP version should my CMS run?

The newest version your CMS and plugins support. As of October 2026, WordPress recommends 8.3 or newer, and Drupal 11 supports 8.3 and 8.4, with 8.5 on Drupal 11.3 and later.

Is FTP still the way to upload a CMS?

Plain FTP sends passwords unencrypted, so use SFTP or SSH instead, or the host's installer. Most current hosts support SFTP.

Sources (9 links)
Share this article