SlickStack is a free LEMP stack automation script written in Bash designed to enhance and simplify WordPress provisioning, performance, and security.
Capterra • G2 Crowd • Product Hunt • SourceForge
Become a sponsor and receive access to our #perma-lounge channel on Discord. Your donations and public displays of support for SlickStack are what keep this project going. Thank you very much!
Our sponsors: alexbohariuc, backamblock, gingibash, hamzah, liwernyap, OSO Electric Equipment, romfeo, strxno, trevplaig, vivdev, vladbejenaru, volneanschi
Because it’s written purely in Bash (Unix shell), SlickStack has no third-party provisioning dependencies and works on Ubuntu LTS machines. Unlike heavier provisioning tools like EasyEngine or Ansible, it does not require external runtimes such as Python or Docker, meaning a lighter and simpler approach to WordPress servers.
The following installation steps assume that you've already spun up a KVM cloud server on Ubuntu LTS, with at least 1GB+ RAM, and that you are logged in via SSH as root:
cd /tmp/ && wget -O ss slick.fyi/ss && bash ss
After installation, you can manage your SlickStack server by running the bundled scripts located within the /var/www/ directory using sudo bash, as needed. In most cases, however, there shouldn't be much hands-on management because SlickStack runs scheduled cron jobs that connect to this GitHub repo.
Reinstallation through sudo bash /var/www/ss-install is designed to reconcile the managed stack without deleting normal WordPress content, but it is a broad maintenance operation that upgrades packages, rewrites managed configuration, may synchronize staging, truncates SlickStack logs, resets permissions, purges caches, and restarts services. Review the Installation guide before rerunning it on production.
Note: SlickStack uses a self-signed OpenSSL certificate by default, so Cloudflare should be active on your domain before SSL (HTTPS) will appear fully secure in browsers. If you wish to use Let's Encrypt instead, be sure to change your settings in ss-config before running the installation.
NOTE: SlickStack is designed for one primary domain per server. It will never support installing multiple TLDs (multi-tenancy) on a single server, and it will not include a built-in UI. This keeps the stack focused on speed, stability, security, and predictable integration with third-party management tools.
SlickStack works best on KVM cloud servers such as DigitalOcean, Vultr, and Linode. Basic WordPress sites can run on 1GB+ RAM, while 2GB+ RAM is recommended for WooCommerce, Multisite, bbPress, BuddyPress, membership sites, forums, or other dynamic/high-traffic workloads. As your site grows, you can upgrade the server and run sudo bash /var/www/ss-install again so SlickStack can re-apply optimized settings for the available resources.
By default, MySQL connects locally over TCP to 127.0.0.1:3306 using databases named production, staging, and development, depending on whether staging/dev sites are enabled. Remote databases can also be used, but server clustering and load balancing are not a SlickStack goal; the stack is focused on simple, high-performance WordPress servers for the majority of sites that do not need complex enterprise architecture.
SlickStack is HTTPS-only and enables HSTS by default, so plain HTTP sites are not supported. Because SlickStack uses self-signed OpenSSL certificates by default, Cloudflare should be active in front of your server before HTTPS will appear fully secure in browsers. After the first ss-install has completed, you can switch to Certbot / Let's Encrypt if preferred.
Use these guides for detailed setup, configuration, maintenance, troubleshooting, and architecture information.
| Document | Description |
|---|---|
| Architecture | Maps SlickStack's request flow, control plane, service boundaries, filesystem layout, environments, cache layers, generated configuration, external responsibilities, and deliberate non-goals. |
| Scope | Defines SlickStack's intended users, suitable workloads, managed boundaries, external responsibilities, design principles, and deliberate non-goals. |
| Roadmap | Describes SlickStack's current priorities, likely next directions, later possibilities, version-support goals, and explicitly rejected directions. |
| Installation | Covers server requirements, first-run setup, preflight checks, the full installer sequence, production reinstallation effects, backups, verification, recovery, and managed-file boundaries. |
| SS-Config | Documents SlickStack's central configuration file, secure editing, build compatibility, schema migration, automatic tuning, pilot files, supported boundaries, rollback, and troubleshooting. |
| Commands | Provides a curated reference for the ss Bash aliases, direct script equivalents, narrow versus compound operations, destructive commands, and known legacy or broken shortcuts. |
| Troubleshooting | Provides a first-response runbook for isolating edge, service, application, resource, access, cron, update, and recovery failures while preserving evidence and using narrow repairs. |
| Updates | Explains script refreshes, ss-config migration, Ubuntu package and kernel upgrades, compound update aliases, scheduling, reboots, recovery, and managed-file boundaries. |
| Cron Jobs | Documents the 14 fixed wrapper intervals, task selection through ss-config, WP-Cron, overlap protection, custom cron files, self-healing, logging, and troubleshooting. |
| Monitoring | Covers interactive resource checks, stack overview limits, service status, timestamps, and the automatic PHP-FPM, Nginx, and local MySQL recovery listeners in 02-cron-often. |
| Logging | Covers SlickStack and systemd log locations, service-specific behavior, WordPress debug logs, permissions, destructive clearing, retention limits, redaction, and troubleshooting. |
| Backups | Covers local database and file dumps, backup schedules, production restores, Rclone and Rsync transfers, retention limits, credentials, and recovery verification. |
| Migrations | Covers SlickStack and third-party WordPress migrations, dump and import scripts, secure transfer, domain changes, DNS cutover, verification, rollback, and current limitations. |
| Permissions | Documents ownership and file modes across SlickStack, WordPress permission zones, SFTP and www-data responsibilities, scheduled resets, protected credentials, and troubleshooting. |
| Ubuntu | Documents supported Ubuntu LTS releases, managed users, SSH and SFTP access, sudoers, utilities, sysctl tuning, swap, cron, package updates, reinstallation, and reboots. |
| Nginx | Describes SlickStack-managed Nginx configuration, approved optional include files, supported customization boundaries, and safe reload behavior. |
| PHP-FPM | Documents PHP version selection, package and configuration installation, Nginx routing, RAM-based process tuning, extensions, OPcache, restarts, and service recovery. |
| MySQL | Covers local and remote database modes, managed MySQL configuration, InnoDB tuning, users and databases, dumps, imports, optimization, and service recovery. |
| Memcached | Explains the loopback-only Memcached service, WordPress object-cache integration, cache layers, purging schedules, restarts, and troubleshooting. |
| Caching | Explains Nginx FastCGI cache, PHP OPcache, Memcached, WordPress transients, browser and Cloudflare cache boundaries, purge commands, schedules, bypass rules, and troubleshooting. |
| Cloudflare | Covers DNS and proxy setup, SSL modes, real visitor IPs, Authenticated Origin Pulls, Certbot DNS credentials, IP range refreshes, origin restrictions, current limitations, and troubleshooting. |
| SSL (Certs) | Covers self-signed OpenSSL certificates, Certbot issuance and renewal, Cloudflare wildcard validation, third-party certificates, permissions, and Nginx activation. |
| Iptables | Documents the default firewall policies, allowed inbound traffic, installed rule files, persistence behavior, and the limits of custom firewall changes. |
| Fail2ban | Documents the current SSH and Nginx jails, thresholds, bans, troubleshooting, and planned removal in favor of a simpler Iptables-only approach. |
| Security | Connects SlickStack's SSH, firewall, Cloudflare, TLS, permissions, WordPress, credentials, monitoring, backup, and incident-recovery security boundaries. |
| WordPress | Covers managed WordPress Core installation, generated configuration, WP-Cron, WP-CLI, permissions, updates, Multisite, and staging and development synchronization. |
| Covers WordPress delivery, SMTP and API providers, SPF, DKIM, DMARC, staging safeguards, WooCommerce queues, mailboxes, testing, troubleshooting, and external responsibilities. | |
| MU Plugins | Explains which WordPress MU plugins SlickStack installs, how vendored ZIP mirrors are managed, and how the installer updates plugin files. |
| Adminer | Covers Adminer installation, randomized and environment-specific URLs, database credentials, Nginx and PHP-FPM routing, rate limits, disabling access, and security limitations. |
| Staging & Dev | Covers environment setup, guest protection, production-to-staging and development syncs, shared uploads, overwrite risks, production push commands, and recovery boundaries. |
| Headless | Covers using SlickStack as a WordPress backend for a remote frontend, including APIs, authentication, SEO, media, caching, redirects, and previews. |
| Workflows | Explains the GitHub Actions used for repository maintenance, SourceForge mirroring, and manual updates of approved WordPress MU plugin ZIP files. |
The table below shows the main software used by SlickStack, which versions it currently supports, and what SlickStack configures or maintains for each component.
Last updated: Jul 20, 2026
| Module | Version | What SlickStack manages |
|---|---|---|
| SlickStack | JUL2026C |
Bash control plane under /var/www, ss-config, installers, aliases, 14 fixed cron wrappers, timestamps, backups, synchronization, permissions, cache purges, service recovery, and full-stack reconciliation. |
| Ubuntu LTS | 18.04-24.04 | Package and kernel upgrades, required utilities, managed users and groups, SSH and jailed SFTP, sudoers, sysctl tuning, swap, shell configuration, root cron, and system permissions. |
| Nginx | 1.24.x | nginx.conf, HTTPS redirects, production, staging, and development server blocks, WordPress routing, static-file handling, FastCGI cache, security headers, rate and connection limits, Cloudflare includes, and maintenance or error responses. |
| OpenSSL | 3.0.x | Default self-signed origin certificate, private key, Diffie-Hellman parameters, stable certificate paths, permissions, and Nginx activation. |
| Certbot | 2.9.x | Optional Let's Encrypt issuance and renewal, HTTP validation for normal sites, Cloudflare DNS validation for wildcard certificates, certificate links, permissions, and Nginx activation. |
| Cloudflare | External | Origin-side DNS and proxy guidance, visitor-IP restoration, IP range refreshes, Authenticated Origin Pulls, optional origin restrictions, cache boundaries, and wildcard-certificate credentials; SlickStack does not manage the Cloudflare account itself. |
| PHP-FPM | 7.2-8.3 | PHP packages and extensions, version selection, php.ini, php-fpm.conf, the shared www pool, OPcache, RAM-based worker tuning, logging, restarts, and service recovery. |
| MySQL | 5.7-8.0 | Local or remote mode, package and service setup, my.cnf, InnoDB and RAM-based tuning, WordPress users and databases, dumps, imports, optimization, restarts, and local service recovery. |
| Memcached | 1.6.x | Loopback-only service configuration, memory allocation, the production WordPress object-cache.php drop-in, cache purges, restarts, and permissions. |
| WordPress | 7.0 | Core installation and refreshes, generated wp-config.php, selected constants, MU plugins, WP-Cron execution, permissions, maintenance mode, Multisite handling, and staging or development synchronization. |
| WP-CLI | 2.12.x | Installation and updates, SlickStack aliases, WordPress cron execution, database operations, search and replace, Core and extension maintenance, cache operations, and selected command restrictions. |
| Adminer | 5.4.2 | Installation, randomized production and test URLs, Nginx and PHP-FPM routing, database credential integration, request limits, permissions, and optional removal. |
| Rclone | Varies | Installation, protected configuration, scheduled off-server backups, provider transfers, logs, timestamps, and credential permissions. |
| Rsync | Varies | Server-to-server backup transfers, staging and development file synchronization, production push workflows, migration support, exclusions, ownership, and permissions. |
| Iptables | 1.8.x | IPv4 and IPv6 policies, public HTTP and HTTPS access, rate-limited SSH, loopback and established traffic, persistent rule files, rebuilds, and permission controls. |
| Fail2ban | 1.0.x | Current SSH and Nginx jails, custom filters, thresholds, ban state, logging, and service control pending its planned removal in favor of a simpler Iptables-only baseline. |
Outside of the so-called Application Layer, much of the way computers and servers now work has been pushed away from in-house teams and specialists and onto "the cloud." Terms like DevOps have become standard across companies and developers, while modern web development keeps drifting toward automation, APIs, dashboards, managed platforms, and whatever the latest cloud vendor wants to sell.
While this shift is exciting, there is now a massive and growing disconnect between these emerging technologies and the humans expected to implement or benefit from them. Typical small business owners, independent agencies, and freelancers face a steep learning curve if they want to maintain a competitive web development edge, let alone keep up with basic standards in website performance and security.
Silicon Valley gurus and corporations pump out new SaaS services, cloud platforms, and complex automation tools on a daily basis, while the typical small business website is still trying to figure out how to make contact forms, caching, SSL, email, backups, and basic security work correctly. Legacy shared hosting companies also have little motivation to make things clearer, since confusion keeps customers dependent on dashboards, support tickets, and upsells.
Thus, before the likes of Google, Amazon, Shopify, Wix, and other Wall Street-backed website builders take over more of the open web and pull users deeper into their private ecosystems, SlickStack hopes to bridge the knowledge gap between emerging technology and old-school web development to empower SMBs to achieve top notch website performance and security by offering a "controlled" LEMP-stack environment with limited options that is perfectly suited to the world's most popular open-source CMS: WordPress.
