WordPress, LAMP/LEMP and MEAN/MERN architecture

Compare the stacks

LAMP/LEMP commonly render server-side PHP with MySQL/MariaDB. MEAN uses MongoDB, Express, Angular and Node; MERN substitutes React. React/Angular build output can be static assets served by Nginx, while the Node API remains a running backend. A “stack” names components, not an automatic production architecture.

WordPress lab

1. Finish the PHP/web-server and database chapters. Verify a supported PHP/database combination from WordPress requirements.
2. Download WordPress only from its official distribution and verify the source/checksum where provided.
3. Create a dedicated schema/user with privileges on only that schema.
4. Place application files in a dedicated root and configure the selected virtual host.
5. Configure wp-config with database connection details and unique salts; restrict filesystem permissions.
6. Complete installation over HTTPS with a strong administrator credential.
7. Test a post, permalink, media upload and logout/login. Keep writable uploads separate from executable code where possible.

Nginx front-controller routing

location / {
    try_files $uri $uri/ /index.php?$args;
}

This is only the routing portion; also configure the PHP handler correctly. Deny PHP execution in upload locations and prevent access to configuration/backup files. WordPress plugin/theme updates introduce code changes; review sources, backups and rollback rather than installing arbitrary plugins on a production site.

MERN/MEAN deployment sequence

Build the frontend using the project's documented build command and serve only its generated public output. Proxy /api/ to the Node backend, watching trailing-slash semantics. Store MongoDB credentials server-side and keep database access private. Use a schema/validation layer and prepared/structured database APIs; do not pass arbitrary client-supplied query operators into the database.

Verify and debug

A frontend page loading does not prove the API works. Inspect browser network responses and backend logs. A 404 on refresh of a client-side route may need an SPA fallback; do not apply that fallback to API or missing asset routes. Test media write permissions without making the entire site world-writable.

Assignment

Draw browser, reverse proxy, backend and database boundaries for LEMP and MERN. Explain which component receives a password and why database credentials must never be embedded in a frontend bundle.

Official references

WordPress requirements WordPress hardening

Interview and revision check

Why can an SPA homepage work but a deep-link refresh fail?

The server may look for a physical file at the route. Configure an appropriate frontend fallback while preserving API/asset error handling.