MediaWiki 1.43.11 on AWS User Guide

Overview

This guide covers launching and using the MediaWiki 1.43.11 on Ubuntu 24.04 AMI from cloudimg on Amazon EC2. It is one version of the cloudimg BookStack, CMS, Blogs and Wikis listing on AWS Marketplace; you pick it as the software version when you subscribe and launch.

MediaWiki is the free and open source wiki engine that runs Wikipedia and thousands of other wikis: pages anyone you allow can edit in wikitext with a full revision history, talk pages, categories, templates, watchlists and recent changes, user groups and permissions, and a complete API. Version 1.43 is MediaWiki's current long term support (LTS) release line.

The cloudimg image adds:

• No web installer, no shared database. A plain MediaWiki download includes its web installer (mw-config/), which writes the configuration and creates the first administrator for whoever opens it first. This image does not ship the web installer at all, and it ships no database: the MariaDB data directory is empty in the image. Your instance's first boot initialises its own database and runs MediaWiki's own command line installer before the web server starts, which creates the schema, the administrator account Admin with a password generated on your instance, and LocalSettings.php.
• Secrets of your instance's own. The database password, the Admin password and MediaWiki's secret keys ($wgSecretKey, which protects sessions and tokens, and $wgUpgradeKey) are generated on your instance's first boot. Nothing from the image build is reused.
• The current LTS release. MediaWiki 1.43.11 is the newest release of the 1.43 LTS line. It includes the security fixes of 1.43.9 and 1.43.10 (eighteen CVEs, among them an open redirect on Special:Upload, a path traversal in the "no LocalSettings" page and unsafe unserialisation of log entries). The download is verified against a pinned checksum.
• Closed by default. Anyone who can reach the site may read it; only signed-in users can edit, and only an administrator can create accounts. File uploads, e-mail and InstantCommons (pulling images from Wikimedia Commons) are off until you switch them on (Step 7). A new public wiki that lets anyone register is quickly found by spam bots; opening it is your decision.
• HTTPS from the first boot. nginx serves MediaWiki on port 443 with a certificate generated on your instance's first boot. Port 80 redirects to HTTPS.
• Fail closed. nginx does not start until first boot has finished; if first boot cannot complete, the site stays offline rather than open.
• Only MediaWiki's entry points run. PHP runs only through index.php, api.php, load.php, rest.php and thumb.php. LocalSettings.php, the code folders (includes/, maintenance/, vendor/, cache/, languages/) and the release documents are never served, no other PHP file in the installation can be called, and files in images/ are served as static files only: every one with nosniff and a sandboxing content security policy, and only passive types (images, PDF, fonts, audio and video) open in the browser; anything else, SVG and HTML included, is sent as a download.
• A rate-limited login. On this image nginx limits sign in, account and password requests to 6 a minute from one address after a burst of 10, and MediaWiki's own throttle locks an account out of an address for five minutes after five wrong passwords. Both use the address of the connection, never a header a client sends.
• Hardened defaults. The MediaWiki code and LocalSettings.php belong to root and are read only to PHP; PHP cannot run shell commands and is confined to MediaWiki's folders. MariaDB has no network listener at all (MediaWiki talks to it over a local socket) and its root account signs in only through the socket as the operating system's root. Sessions and the login throttle are kept in the database, so they work without extra software. nginx, PHP and MariaDB are blocked from the instance metadata service, the AMI requires IMDSv2, requests for a host name the instance does not serve are dropped, and MediaWiki always uses the host name you configure, never one a request claims.
• Fully patched Ubuntu 24.04 LTS at build time, with unattended security upgrades switched on.

What is on the image: MediaWiki 1.43.11 (the official release with its bundled extensions and skins, checksum verified; the extensions Cite, CategoryTree, InputBox, Interwiki, Nuke, OATHAuth, ParserFunctions, Poem and WikiEditor are enabled), MariaDB 10.11, PHP 8.3 FPM, nginx, Ubuntu 24.04 LTS, cloud-init and the AWS Systems Manager agent. The database and uploads are on a separate 30 GiB EBS volume mounted at /var/lib/mediawiki.

Default user: ubuntu · Architecture: x86_64 · Recommended instance type: m5.large

Prerequisites

• An AWS account subscribed to the listing, an EC2 key pair and a VPC subnet with a route to the internet (or a private route you use for management).
• A security group that allows TCP 22 (SSH), TCP 443 (MediaWiki) and TCP 80 (redirects to HTTPS) from the networks that should reach them. Keep 22 to your own networks. Open 443 to your readers for a public wiki, or only to your team for an internal one.

Step 1: Launch the instance

In the AWS Marketplace listing choose Continue to Subscribe, then Continue to Configuration, pick MediaWiki 1.43.11 on Ubuntu 24.04 as the software version and your Region, then Launch through EC2. Choose m5.large, your key pair and a security group as above. Keep the second volume (the database and uploads) in the launch settings; you can make it larger there.

With the AWS CLI (replace the values in angle brackets):

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=mediawiki}]'

Step 2: Connect to your instance

Version	SSH user
MediaWiki 1.43.11 on Ubuntu 24.04	ubuntu

ssh -i <your-key.pem> ubuntu@<public-ip>

Step 3: Check the services

First boot takes under a minute (it creates the database and runs MediaWiki's installer). Then nginx, PHP, MariaDB and the first boot unit are active:

systemctl is-active nginx php8.3-fpm mariadb mediawiki-firstboot

active
active
active
active

nginx serves ports 80 and 443; PHP and MariaDB listen on local sockets only, so the only open ports are 22, 80 and 443:

sudo ss -tlnp | awk 'NR==1 || /nginx|sshd|php|maria/' | awk '{print $1, $4, $6}' | sed -E 's/,pid=[0-9]+,fd=[0-9]+//g'

State Local Peer
LISTEN 0.0.0.0:443 users:(("nginx"),("nginx"),("nginx"))
LISTEN 0.0.0.0:22 users:(("sshd"),("systemd"))
LISTEN 0.0.0.0:80 users:(("nginx"),("nginx"),("nginx"))
LISTEN [::]:443 users:(("nginx"),("nginx"),("nginx"))
LISTEN [::]:22 users:(("sshd"),("systemd"))
LISTEN [::]:80 users:(("nginx"),("nginx"),("nginx"))

The MediaWiki release, the PHP and MariaDB versions and the data volume:

grep "define( 'MW_VERSION'" /var/www/mediawiki/includes/Defines.php
php -v | head -1
mariadb --version
findmnt -no TARGET,FSTYPE,SIZE /var/lib/mediawiki

define( 'MW_VERSION', '1.43.11' );
PHP 8.3.6 (cli) (built: Oct 19 2026 15:16:58) (NTS)
mariadb  Ver 15.1 Distrib 10.11.14-MariaDB, for debian-linux-gnu (x86_64) using  EditLine wrapper
/var/lib/mediawiki ext4   29.4G

Step 4: Get your sign-in details

The credentials file holds the address MediaWiki is served as (your instance's public DNS name by default), the sign in page, the administrator login and password, and the database credentials, all generated on this instance. Show it with:

sudo cat /root/mediawiki-credentials.txt

MEDIAWIKI_URL=https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/
MEDIAWIKI_LOGIN_URL=https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/wiki/Special:UserLogin
MEDIAWIKI_ADMIN_USER=Admin
MEDIAWIKI_ADMIN_PASSWORD=<24 letters and digits>
MEDIAWIKI_DB_NAME=wiki
MEDIAWIKI_DB_USER=wiki
MEDIAWIKI_DB_PASSWORD=<48 hexadecimal characters>

Step 5: Visit the wiki and sign in

Open MEDIAWIKI_URL in your browser. The certificate is self signed (generated on your instance), so accept the browser warning once, or install your own certificate (Step 11). The Main Page shows a welcome text that first boot wrote, with the next steps:

Choose Log in (or open MEDIAWIKI_LOGIN_URL) and sign in with the username Admin and MEDIAWIKI_ADMIN_PASSWORD:

Admin is a member of the administrator (sysop), bureaucrat and interface administrator groups. Open Preferences from the user menu to set your e-mail address, signature, time zone and skin.

Step 6: Edit pages

Every page has Edit (and Edit source) and View history tabs. The editor is MediaWiki's wikitext editor with the WikiEditor toolbar (bold, italic, links, images, references, special characters, tables) and a Preview button:

Create a page by searching for its name and following the red link, or by linking to it ([[My new page]]) and following the link. Special:RecentChanges lists every edit, Special:SpecialPages every tool. Special:Version shows the MediaWiki release with the PHP and MariaDB versions, the enabled extensions and skins and their licences:

The enabled skins and extensions are loaded at the end of LocalSettings.php:

sudo grep -E "^wfLoad(Extension|Skin)" /var/www/mediawiki/LocalSettings.php

wfLoadSkin( 'MinervaNeue' );
wfLoadSkin( 'MonoBook' );
wfLoadSkin( 'Timeless' );
wfLoadSkin( 'Vector' );
wfLoadExtension( 'Cite' );
wfLoadExtension( 'CategoryTree' );
wfLoadExtension( 'InputBox' );
wfLoadExtension( 'Interwiki' );
wfLoadExtension( 'Nuke' );
wfLoadExtension( 'OATHAuth' );
wfLoadExtension( 'ParserFunctions' );
wfLoadExtension( 'Poem' );
wfLoadExtension( 'WikiEditor' );

The other extensions bundled with MediaWiki (VisualEditor, AbuseFilter, ConfirmEdit, Echo, Scribunto, SyntaxHighlight and more) are in /var/www/mediawiki/extensions but not loaded. Some need extra software or a shell, which PHP on this image cannot run (Scribunto and SyntaxHighlight, for example).

Step 7: Users, permissions and the closed-by-default settings

The image's own settings are in /etc/mediawiki/CloudimgSettings.php, which the last line of LocalSettings.php loads:

sudo tail -n 3 /var/www/mediawiki/LocalSettings.php

# cloudimg: per-instance host, closed-by-default permissions, caches and hardening (root-owned; see
# /usr/share/doc/mediawiki/CLOUDIMG.txt). Set a value again BELOW this line to change it.
require_once "/etc/mediawiki/CloudimgSettings.php";

To change one of those settings, add it to LocalSettings.php below that line, then reload the page. The settings in effect, as MediaWiki reads them:

cd /var/www/mediawiki && sudo -u www-data php maintenance/run.php getConfiguration --format json --settings "wgEnableUploads wgEnableEmail wgUseInstantCommons wgMainCacheType wgSessionCacheType wgPasswordAttemptThrottle" | python3 -m json.tool --compact

{"wgEnableEmail":false,"wgEnableUploads":false,"wgMainCacheType":1,"wgPasswordAttemptThrottle":[{"count":5,"seconds":300},{"count":150,"seconds":172800}],"wgSessionCacheType":1,"wgUseInstantCommons":false}

Anonymous visitors can only read (and set their own display options):

H=$(sed -n 's/^set \$mw_host "\(.*\)";$/\1/p' /etc/nginx/mediawiki-host.conf)
curl -sk --resolve "$H:443:127.0.0.1" "https://$H/api.php?action=query&meta=userinfo&uiprop=rights&format=json" | python3 -c 'import json,sys; u=json.load(sys.stdin)["query"]["userinfo"]; print("anonymous rights:", ", ".join(sorted(u["rights"])))'

anonymous rights: editmyoptions, editmyprivateinfo, read, viewmyprivateinfo

Accounts. Signed in as Admin, open Special:CreateAccount to create an account for each person, and Special:UserRights to put a user in the administrator or bureaucrat group. To let visitors register themselves, add $wgGroupPermissions['*']['createaccount'] = true; below the require_once line; consider loading the bundled ConfirmEdit extension (a CAPTCHA on sign up) first. To let anonymous visitors edit, add $wgGroupPermissions['*']['edit'] = true; (and ['createpage']). Special:Nuke removes every page a spammer created in one go.

Two-factor authentication. The OATHAuth extension is enabled: each user can turn on two-factor authentication with an authenticator app under Preferences > Two-factor authentication (Special:AccountSecurity). Turn it on for Admin:

Uploads. To accept file uploads, add $wgEnableUploads = true; below the require_once line. Uploaded files go to /var/lib/mediawiki/images on the data volume; thumbnails are made with PHP's GD library (PHP cannot run ImageMagick here), uploads are limited to 64 MB, and nginx serves the files as static files only, as described in the Overview. To allow more file types, set $wgFileExtensions, for example $wgFileExtensions = [ 'png', 'gif', 'jpg', 'jpeg', 'webp', 'pdf' ];.

E-mail. MediaWiki sends password reset links and notifications by e-mail, and the image has no mail server, so e-mail is off. To switch it on, set $wgEnableEmail = true;, $wgPasswordSender and $wgSMTP (your SMTP server, port, user name and password) below the require_once line. Until then, reset a forgotten password from the shell (Step 12).

InstantCommons. $wgUseInstantCommons = true; lets pages show images from Wikimedia Commons by name.

Step 8: Your data

MediaWiki's data is on its own EBS volume at /var/lib/mediawiki: the MariaDB data directory (mysql, initialised on this instance's first boot) and uploads (images, which the site serves as /images/):

sudo ls -l /var/lib/mediawiki | sed -E 's/ +/ /g' | cut -d' ' -f1,3,4,9-

total
drwxr-x--- www-data www-data images
drwx------ root root lost+found
drwxr-x--- mysql mysql mysql

The wiki's configuration is /var/www/mediawiki/LocalSettings.php, written by MediaWiki's installer on first boot: it holds the database password and the secret keys. Keep it with your backups.

MariaDB has four accounts: the system accounts root and mysql (which sign in only through the local socket as the matching operating system user), the locked mariadb.sys, and wiki, MediaWiki's own user with this instance's password. It has no network listener:

sudo mysql -N -e "SELECT CONCAT(User,'@',Host) FROM mysql.global_priv ORDER BY 1; SELECT @@skip_networking, @@datadir"

mariadb.sys@localhost
mysql@localhost
root@localhost
wiki@localhost
1   /var/lib/mediawiki/mysql/

Back the wiki up with EBS snapshots of the data volume and the root volume, or as files:

sudo mysqldump --single-transaction wiki | gzip > wiki-db.sql.gz
sudo tar -czf wiki-files.tar.gz -C / var/lib/mediawiki/images var/www/mediawiki/LocalSettings.php etc/mediawiki

MediaWiki can also export pages as XML (Special:Export, or sudo -u www-data php maintenance/run.php dumpBackup --full in /var/www/mediawiki).

Step 9: Security checks

Port 80 sends browsers to HTTPS, the health endpoint answers for load balancer checks, and the web installer, LocalSettings.php, the code folders and the release documents are not reachable:

H=$(sed -n 's/^set \$mw_host "\(.*\)";$/\1/p' /etc/nginx/mediawiki-host.conf)
curl -s -o /dev/null -w 'port 80: %{http_code} -> %{redirect_url}\n' --resolve "$H:80:127.0.0.1" "http://$H/wiki/Main_Page"
curl -sk --resolve "$H:443:127.0.0.1" "https://$H/healthz"
for p in /mw-config/ /LocalSettings.php /includes/WebStart.php /maintenance/run.php /vendor/autoload.php /cache/ /RELEASE-NOTES-1.43; do
  curl -sk -o /dev/null -w "$p: %{http_code}\n" --resolve "$H:443:127.0.0.1" "https://$H$p"
done
curl -s -o /dev/null -w 'unknown host name: %{http_code}\n' -H 'Host: example.com' http://127.0.0.1/ || true

port 80: 301 -> https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/wiki/Main_Page
ok
/mw-config/: 404
/LocalSettings.php: 404
/includes/WebStart.php: 404
/maintenance/run.php: 404
/vendor/autoload.php: 404
/cache/: 404
/RELEASE-NOTES-1.43: 404
unknown host name: 000

(000 means nginx closed the connection without an answer.) The credentials file is readable by root only, LocalSettings.php and the cloudimg settings by root and the web server's group, the uploads and cache folders by the web server only, and the code belongs to root:

sudo stat -c '%a %U:%G %n' /root/mediawiki-credentials.txt /var/www/mediawiki/LocalSettings.php /etc/mediawiki /etc/mediawiki/CloudimgSettings.php /var/lib/mediawiki/images /var/cache/mediawiki /var/www/mediawiki/index.php

600 root:root /root/mediawiki-credentials.txt
640 root:www-data /var/www/mediawiki/LocalSettings.php
750 root:www-data /etc/mediawiki
640 root:www-data /etc/mediawiki/CloudimgSettings.php
750 www-data:www-data /var/lib/mediawiki/images
750 www-data:www-data /var/cache/mediawiki
644 root:root /var/www/mediawiki/index.php

The certificate was generated on this instance and names its own addresses:

H=$(sed -n 's/^set \$mw_host "\(.*\)";$/\1/p' /etc/nginx/mediawiki-host.conf)
echo | openssl s_client -connect 127.0.0.1:443 -servername "$H" 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName

subject=CN = ec2-<public-ip-dashed>.<region>.compute.amazonaws.com, O = cloudimg
X509v3 Subject Alternative Name:
    DNS:ec2-<public-ip-dashed>.<region>.compute.amazonaws.com, IP Address:<public-ip>, IP Address:<private-ip>, IP Address:127.0.0.1, DNS:localhost

nginx, PHP and MariaDB cannot reach the instance metadata service; PHP cannot run shell commands and is confined to MediaWiki's folders; nginx hands PHP the configured host name and the real client address from the connection (never values a client sends, and never an Authorization header), and rate-limits sign in and other requests:

for u in nginx php8.3-fpm mariadb; do systemctl show $u -p IPAddressDeny; done
php-fpm8.3 -i 2>/dev/null | grep -E '^(open_basedir|disable_functions|expose_php) ' | cut -d' ' -f1-3
grep -E 'fastcgi_param (HTTP_HOST|SERVER_NAME|HTTP_X_FORWARDED_FOR|HTTP_X_FORWARDED_HOST|HTTP_AUTHORIZATION) ' /etc/nginx/snippets/cloudimg-mediawiki-php.conf
grep -h 'limit_req_zone\|limit_req_status' /etc/nginx/conf.d/cloudimg-mediawiki-guard.conf

IPAddressDeny=169.254.169.254/32 168.63.129.16/32 fd00:ec2::254/128
IPAddressDeny=169.254.169.254/32 168.63.129.16/32 fd00:ec2::254/128
IPAddressDeny=169.254.169.254/32 168.63.129.16/32 fd00:ec2::254/128
disable_functions => exec,passthru,shell_exec,system,proc_open,popen,pcntl_exec
expose_php => Off
open_basedir => /var/www/mediawiki/:/var/lib/mediawiki/images/:/var/cache/mediawiki/:/etc/mediawiki/:/var/lib/php/sessions/:/tmp/
fastcgi_param HTTP_HOST $mw_host;
fastcgi_param SERVER_NAME $mw_host;
fastcgi_param HTTP_X_FORWARDED_HOST "";
fastcgi_param HTTP_X_FORWARDED_FOR $remote_addr;
fastcgi_param HTTP_AUTHORIZATION "";
limit_req_zone $mw_login_key zone=mw_login:10m rate=6r/m;
limit_req_zone $mw_post_key zone=mw_post:10m rate=30r/m;
limit_req_zone $mw_post_key zone=mw_api:10m rate=60r/m;
limit_req_status 429;

The mw_post and mw_api limits allow 30 page saves and 60 API write requests a minute from one address (after a burst of the same size), which is plenty for people; raise them in /etc/nginx/conf.d/cloudimg-mediawiki-guard.conf if you run bots. If a burst of wrong passwords rate-limits you (HTTP 429, or MediaWiki's "too many recent login attempts"), wait a few minutes and try again.

sudo mediawiki-cred-roundtrip checks the whole sign in path on the instance: the redirect to HTTPS, the refused installer and LocalSettings.php, a sign in through MediaWiki's login form with the password from the credentials file, and that wrong and common passwords are refused.

Step 10: Maintenance scripts and jobs

MediaWiki's command line tools run from /var/www/mediawiki as the web server user, through maintenance/run.php:

cd /var/www/mediawiki
sudo -u www-data php maintenance/run.php showJobs
sudo -u www-data php maintenance/run.php runJobs
sudo -u www-data php maintenance/run.php rebuildrecentchanges

Never put a password on a maintenance command line (it would be stored in your shell history and the system logs); use the helpers in Step 12. Background jobs (link updates, category counts) run as part of page requests; for a busy wiki, set $wgJobRunRate = 0; and run runJobs from a systemd timer instead.

Step 11: Your own DNS name and certificate

Point a DNS record at the instance, then set the name MediaWiki is served as. This mints a new self signed certificate for the name, updates nginx, MediaWiki's $wgServer (used in links, redirects and feeds) and the addresses in /root/mediawiki-credentials.txt, refreshes MediaWiki's caches and keeps the name across reboots:

sudo mediawiki-set-hostname <your-domain>

To use a certificate from your own certificate authority instead, copy it over the generated pair and reload nginx (running mediawiki-set-hostname again replaces it with a self signed one):

sudo install -m 0644 <your-domain>.crt /etc/nginx/ssl/mediawiki.crt
sudo install -m 0600 <your-domain>.key /etc/nginx/ssl/mediawiki.key
sudo nginx -t && sudo systemctl reload nginx

Once browsers trust the certificate you can also add an HSTS header (add_header Strict-Transport-Security "max-age=31536000" always;) to /etc/nginx/snippets/cloudimg-mediawiki-headers.conf. The image does not send one: browsers ignore HSTS from a site whose certificate they do not trust.

Step 12: Passwords and upgrades

mediawiki-set-password gives Admin a new random password with MediaWiki's own authentication code, signs out every session of Admin and records the password in /root/mediawiki-credentials.txt. Run it without arguments, or pass your own password (24 to 96 letters and digits) on stdin. Users change their own password under Preferences.

sudo mediawiki-set-password
printf '%s\n' '<your-new-password>' | sudo mediawiki-set-password --stdin

Upgrades. Patch releases of the 1.43 LTS line are announced on the mediawiki-announce mailing list. Snapshot the instance, download the new release from https://releases.wikimedia.org/mediawiki/1.43/ (check its signature), read its release notes, and replace the code as root while keeping LocalSettings.php and the images link; then run the database updater:

tar -xzf mediawiki-1.43.<n>.tar.gz -C /tmp
sudo systemctl stop nginx
sudo rsync -a --delete --exclude LocalSettings.php --exclude images --exclude mw-config /tmp/mediawiki-1.43.<n>/ /var/www/mediawiki/
sudo rm -rf /var/www/mediawiki/mw-config /var/www/mediawiki/tests
sudo chown -R root:root /var/www/mediawiki && sudo chown root:www-data /var/www/mediawiki/LocalSettings.php
cd /var/www/mediawiki && sudo -u www-data php maintenance/run.php update --quick
sudo systemctl start nginx

Step 13: Server components

Component	Path
MediaWiki code (root owned)	/var/www/mediawiki
Configuration: database connection, secret keys, extensions	/var/www/mediawiki/LocalSettings.php
cloudimg settings: host, permissions, caches, hardening	/etc/mediawiki/CloudimgSettings.php, /etc/mediawiki/CloudimgHost.php
Localisation cache	/var/cache/mediawiki
Database (MariaDB datadir) and uploads	/var/lib/mediawiki/mysql, /var/lib/mediawiki/images (their own EBS volume)
nginx site and request limits	/etc/nginx/sites-available/cloudimg-mediawiki, /etc/nginx/conf.d/cloudimg-mediawiki-guard.conf
PHP settings	/etc/php/8.3/fpm/conf.d/99-cloudimg-mediawiki.ini
MariaDB settings	/etc/mysql/mariadb.conf.d/99-cloudimg-mediawiki.cnf
Certificate and key	/etc/nginx/ssl/
First boot script	/usr/local/sbin/mediawiki-firstboot.sh
Helpers	/usr/local/sbin/mediawiki-set-hostname, mediawiki-set-password, mediawiki-cred-roundtrip
Licence, release notes and image notes	/usr/share/doc/mediawiki/
Credentials	/root/mediawiki-credentials.txt (mode 0600)

Step 14: Security recommendations

• Allow port 22 in the security group from your own networks only.
• Keep the Admin password secret, turn on two-factor authentication for it (Step 7) and rotate it if it may have been shared (Step 12). Give each person their own account.
• Keep LocalSettings.php secret and backed up with the database (Step 8).
• Think before opening account creation or anonymous editing to the internet (Step 7); a CAPTCHA and Special:Nuke help against spam.
• Use your own DNS name and a certificate your browsers trust (Step 11).
• Keep MediaWiki on the newest 1.43 release (Step 12) and load only extensions you trust: an extension is PHP code that runs with MediaWiki's rights.
• Keep the operating system patched; unattended security upgrades are on, and sudo apt-get update && sudo apt-get upgrade applies everything else. MariaDB, PHP-FPM and PHP's intl extension come from Ubuntu's universe repository; sudo pro security-status --esm-apps shows whether Ubuntu Pro (ESM Apps) has security updates for them (none were pending when the image was built).
• Snapshot the data volume regularly (Step 8).

Support and licensing

MediaWiki is free software under the GNU General Public License version 2 or later (a copy is at /usr/share/doc/mediawiki/COPYING); the bundled extensions and skins carry their own free licences, listed on Special:Version. There is no per user or per CPU licence fee. This image installs the unmodified upstream release, without its web installer and test suites, plus the cloudimg settings file /etc/mediawiki/CloudimgSettings.php described above. The AMI price covers cloudimg's hardening, first boot setup and support.

• Email: support@cloudimg.co.uk
• Website: https://www.cloudimg.co.uk
• Support: 24/7, with a 24 hour response SLA