Building a WordPress Site with Amazon Lightsail - From SSL Setup to CDN Delivery

Build a WordPress site on Lightsail, configure SSL with Let's Encrypt, and publish it globally via CDN. This article also covers backup strategies.

About 8 min readLast updated: 2026-10-27

Building with the WordPress Blueprint

Lightsail's WordPress blueprint provides an environment with Apache, MySQL, PHP, and WordPress pre-configured, and you can access the WordPress admin panel from your browser immediately after creating the instance. The Bitnami-packaged blueprints, long the standard, have an announced end of availability: new versions stopped being provided as of May 19, 2026, and on November 19, 2026, WordPress, WordPress Multisite, LAMP, Nginx, and Node.js will be removed from the choices for new instances (Joomla, Magento, MEAN, Drupal, GitLab, Redmine, Ghost, Django, and PrestaShop on May 19, 2027). Instances that are already running keep working as they are, and you can still restore from snapshots you have already taken, but if you are building something new from now on, choose the Lightsail-packaged blueprint provided by AWS. How to check the initial password differs by blueprint type, and with the Bitnami-packaged version you view it by running cat $HOME/bitnami_application_password in the browser-based SSH terminal in the Lightsail console. The smallest plan with a public IPv4 address costs 5 USD per month (512 MB RAM, 2 vCPU, 20 GB SSD, 1 TB of data transfer), which is sufficient for a personal blog. With an IPv6-only bundle, you can also choose plans starting from 3.50 USD per month. For sites with tens of thousands of monthly page views, the 1 GB RAM plan (7 USD per month, 2 vCPU, 40 GB SSD, 2 TB of data transfer) or higher is recommended (as of August 2026).

SSL Setup and Domain Management

With the Bitnami-packaged blueprint, HTTPS can be configured automatically with bncert-tool. Simply connect to the instance over SSH, run sudo /opt/bitnami/bncert-tool, and enter your domain name, and Let's Encrypt SSL certificate acquisition, Apache HTTPS configuration, HTTP-to-HTTPS redirection, and automatic certificate renewal are all configured together. Because bncert-tool is bundled with the Bitnami package, the procedure differs if you built the instance with an AWS-provided blueprint. Check the official procedure that matches the blueprint of the instance you created before you configure the certificate. Domain DNS management can be done through Lightsail's DNS zones. Set an A record pointing to the instance's static IP and a CNAME record for the www subdomain. Lightsail static IPs are free, and they are not charged as long as they are attached to an instance. Note that publishing with an A record requires a public IPv4 address, so if you choose an IPv6-only bundle, you publish with an AAAA record.

CDN Delivery and Backups

Lightsail CDN is a CloudFront-based content delivery feature that you can enable simply by creating a distribution and specifying your instance as the origin. Static content such as images, CSS, and JavaScript is cached at edge locations worldwide and served from the location nearest to the user. Each distribution plan includes a monthly data transfer allowance, which is 50 GB per month on the smallest plan. For backups, it's recommended to enable automatic snapshots taken daily. Automatic snapshots retain the latest seven generations, and in case of failure you restore by creating a new instance from a snapshot. Manual snapshots can be stored with no retention limit and are used for backups before major changes.

WordPress Hosting Costs

The operating cost of a WordPress site is centered on the monthly Lightsail plan fee (as of August 2026). The 2 GB memory plan (12 USD per month, 2 vCPU, 60 GB SSD, 3 TB of data transfer) is a standard choice for small sites and can handle up to around tens of thousands of page views per month. Lightsail CDN can be used starting from 2.50 USD per month, and the smallest plan includes 50 GB of data transfer per month. Snapshots are charged about 0.05 USD per month per 1 GB of stored capacity, so you can keep storage costs down by limiting the number of generations. Compared to an EC2 + ALB + RDS setup (50 USD or more per month), Lightsail can run WordPress at significantly lower cost.

Tuning Page Load Speed

WordPress page load speed improves greatly when you make use of caching. Install a page cache plugin to serve pre-generated HTML and reduce access to the database. Compressing images to an appropriate size and enabling lazy loading makes the initial display lighter. If you place Lightsail CDN in front, static files are delivered from the edge and the load on the instance also goes down. Adding too many plugins has the opposite effect and slows the site down, so limiting them to the ones you truly need is also an essential measure for keeping the speed stable.

Security Basics

A public WordPress site is an easy target for attacks, so strengthen the basic defenses. Keep WordPress core, themes, and plugins updated to close known vulnerabilities. Protect admin screen logins with a strong password, a limit on login attempts, and two-factor authentication. Use the Lightsail firewall settings to open only the ports you need. If you enable automatic snapshots in case of emergency, you can restore to the state just before tampering or a failure occurs. On the assumption that attacks cannot be completely prevented, it is important to have a means of recovery ready.

Scaling and Moving to a Full-Scale Setup

When traffic grows and the plan's performance becomes insufficient, move to a higher plan. Because Lightsail cannot directly resize a running instance, take a snapshot, create a new instance on a larger plan from it, and switch over. When the scale grows further and you need availability and flexibility, consider moving to a setup that combines EC2, RDS, and a load balancer. Separating the database and distributing the load across multiple instances lets you scale beyond the limits of a single instance.

Operational Considerations and Deciding When to Move

Lightsail WordPress is easy to use, but because it is basically a single-instance setup, the whole site stops if that server goes down. For commercial sites that require redundancy, this becomes a constraint. Taking snapshots regularly and confirming the recovery procedure in advance is a realistic safeguard for availability. When performance hits a ceiling because of traffic growth, or when you need a multi-instance setup or fine-grained network control, that is the time to move to an EC2-based setup. As your requirements grow, revisit the setup without strain.

Summary

Lightsail is a platform on which you can build and run a WordPress site with little effort and cost. By combining instant deployment with blueprints, SSL setup using Let's Encrypt, global delivery through CDN, and backups with snapshots, you can run anything from a personal site to a small commercial site starting from a level of around 10 USD per month. Because what the blueprints offer keeps changing, checking the blueprints you can choose and the recommended setup before a new build lets you avoid migration work later.

References (Official AWS Resources)

The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.

If this page and the official documentation disagree, treat the official documentation as authoritative.

Why Auto Scaling Scales Out Fast but Scales In Cautiously - The Design Intent Behind Asymmetric Decision LogicThis article explains why EC2 Auto Scaling executes scale-out immediately while applying a cooldown period for scale-in, the flapping prevention mechanism, and the internal logic of target tracking scaling.Demand-Driven Infrastructure with AWS Auto Scaling - Designing and Optimizing Scaling PoliciesLearn how to use target tracking, predictive, and scheduled scaling policies effectively, and optimize costs with mixed instances policies that leverage Spot Instances.AWS Fault Domain Design - How the Three-Layer Structure of AZs, Regions, and Partitions Protects AvailabilityLearn why AWS infrastructure is designed with three layers of fault domains - AZs (fault isolation), Regions (geographic separation), and Partitions (political separation) - and how far failures propagate at each layer, with real-world examples.Distributed Systems Principles Learned from AWS Outages - How Past Major Incidents Reshaped ArchitectureUsing AWS's published incident reports as case studies - including the S3 outage (2017), Kinesis outage (2020), and the unique nature of us-east-1 - this article explains design principles such as Shuffle Sharding, Static Stability, and Cell-based Architecture.Why AWS Builds Regions Where It Does - The Hidden Criteria Behind Data Center Site SelectionWe explain the criteria AWS considers when deciding region locations, including power supply, geopolitical risk, data sovereignty legislation, network connectivity, and natural disaster risk, with concrete examples from specific regions.Why AWS Availability Zone IDs Differ Per Account - The Design Intent Behind AZ MappingExplains how us-east-1a maps to different physical AZs per account, why AZ IDs (use1-az1) were introduced, the design intent of even capacity distribution, and considerations for cross-account AZ specification.Batch Computing Infrastructure - Large-Scale Parallel Processing with AWS BatchLearn how to build large-scale batch processing with AWS Batch. Covers job queue design, auto-scaling compute environments, cost optimization with Spot Instances, and building batch infrastructure ideal for scientific computing and large-scale data processing.Broadcast-Quality Live Streaming - Building a Large-Scale Delivery Platform with AWS Elemental MediaLive and MediaPackageThis article explains a broadcast-quality live streaming platform built with AWS Elemental MediaLive and MediaPackage. It introduces real-time transcoding, DRM, ad insertion, and multi-CDN delivery.