2

(I have found some links to customising an initial install like this one and this one, but unless I'm missing something - which is quite possible, they don't answer my question)

I'm wanting to set up a minimal Wordpress install that users can then run with. I have written a script which downloads the latest wordpress and creates a wp-config.php page with the database settings etc. The first time a user goes to their site, it asks them for a site title, username, password and email address.

As someone created one of these sites and did not proceed to enter their details the site was eventually found and exploited by a hacker. It occurs to me that to fix this problem all I need to do is assign initial details for these fields and communicate them automatically to the site owner - but that seems easier said then done.

On attempting to set up a new blog, I see that the database schema is not created until this install page has run. I'm loathe to create an initial SQL schema and dump it in for fear that newer versions of Wordpress will use a different schema, breaking the install process (Is this fear justified?)

Is there a way I can go about programatically handling the "install.php" stuff - or at least have wordpress automatically create the schema and defaults so I can prepopulate a username and password ?

(It strikes me that as an alternative I can probably play around with password protecting install.php in Apache with a .htaccess file, but that does not seem like an elegant solution to me)

3 Answers 3

6

I'd highly recommend WP-CLI for such tasks. It is a tool that allows installation and configuration of WordPress on the command line.

What you are trying could easily be done:

wp core download
wp core config --dbname=<dbname> --dbuser=<dbuser> --dbpass=<dbpass>
wp core install --url=<url> --title=<site-title> --admin_user=<username> --admin_password=<password> --admin_email=<email>

There are a lot of other commands that you can use to customize your installation even further.

4
  • This looks like a really cool idea, and I was quite excited by it. Unfortunately it looks to be very insecure - One of the first things it appears to do is get a startup file remotely. While I have no reason to distrust the developers, I have no reason to trust them either ! If not for this issue, I would have marked this as the solution.
    – davidgo
    Commented Mar 20, 2014 at 19:44
  • I don't really get it. You have to download the tool to use it. Or is there anything I missed?
    – kraftner
    Commented Mar 21, 2014 at 8:51
  • I think there is something you missed (or I have misread - I've not seen this library before). The second line of the tool reads include 'phar://wp-cli.phar/php/boot-phar.php'; - which I understand to mean it pulls this code when the script is run - This code appears to reside on a remote server and is subject to change - and I imagine it can be rewritten to do arbitrary things.
    – davidgo
    Commented Mar 21, 2014 at 9:23
  • Again, correct me if I am wrong but as far as I understand phar archives this refers to a local file inside the phar archive.
    – kraftner
    Commented Mar 21, 2014 at 9:29
3

I worked out an easy and elegant way to solve this problem - After doing the installation I can simply use CURL to submit the values for the initial user through a web page with a command line like

curl --data "user_name=USERNAMEHERE&admin_password=PasswordHere&admin_password2=PasswordHere&[email protected]&blog_public=checked&Submit=submit" "http://site.name/wp-admin/install.php?step=2

Note that this solution does pass the program at the command line, so it might not be the most secure way of doing things if someone can see a list of processes running on the system doing the post (which is not a problem in my environment). Looking into this further I suspect I can use curl --data @FILE which would read the data from a file and probably not show it on the command line.

1

If you are using Linux, you are lucky enough, there is a command line tool EasyEngine which lets you install your complete site in 5 3 minutes, It was publicly released recently at Wordcamp Mumbai 2014. Not just installation, but also provides you other options to manage sites.

I'd say a really handy tool.

2
  • Cool idea, but I'm not willing to forgo apache !!
    – davidgo
    Commented Mar 20, 2014 at 19:48
  • Not a problem, maybe in future you'll opt for Nginx for sure :)
    – Kumar
    Commented Mar 21, 2014 at 4:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.