Install WordPress on your own server

Install an application lists the Applications you can install, which are ten of them. Choose the website, choose a folder if you want it somewhere other than the root, and Install. What you get back is a working site with its own database and an administrator account, not an archive to unpack.

The version you get is the one the publisher has today. Dashmox asks them which release is current, fetches that, and checks it against the checksum they publish for that exact version, or against their own signature where they sign releases instead. If they cannot be reached it installs the version Dashmox vouches for and tells you which it used, rather than installing something nobody checked.

It needs a PHP website that has finished being set up, and the database module. A static site has nothing to run the application with.

An application nobody updates is the most common way a hosted website is lost. WordPress keeps itself up to date, including major versions, through a plugin that cannot be switched off from its own dashboard, and the panel asks it what it is waiting on. Installed software is where you see that.

The other nine are updated from their own dashboards, and the panel does not pretend otherwise. What it does do is read the version each one is running and compare it with what its publisher has published, so Installed software names the release you are behind rather than leaving you to go and look. A check that could not reach a publisher says so, because "up to date" and "nobody could be asked" look the same on a page and only one of them is true.

A WordPress site is code somebody else wrote, updated on somebody else's schedule, with plugins nobody reviewed. So the protections on a website assume a compromise rather than hoping against one:

• A script uploaded into wp-content/uploads is served as a file rather than run, which is how almost every compromise finishes
• xmlrpc.php is refused, unless you use the mobile app or Jetpack, in which case turn it back on
• Sign-in pages are rate limited, which makes the cheap automated attempt uneconomic
• PHP cannot run a command, so writing a file does not become having a shell

Each is a switch on the website's protection page, so one that gets in the way of something you genuinely need can be turned off.