WonderCMS

Launch the image from the Azure Marketplace, then connect over SSH as azureuser:

ssh azureuser@<vm-ip>

The first-boot service generates the per-VM administrator credentials within a few seconds of the instance starting.

Confirm that nginx and PHP FPM are active and that nginx is listening on port 80:

sudo systemctl is-active nginx php8.3-fpm wondercms-firstboot
sudo ss -tlnp | grep ':80 '

WonderCMS records its version in index.php. Confirm the application, PHP and nginx versions:

grep -oE "define\('VERSION', '[0-9.]+'\)" /var/www/wondercms/index.php php -v | head -1 nginx -v

The image ships with no content store and no working default login. The first-boot service writes a fresh data/database.js with a per-VM password for the admin account, stored as a hash. It also moves the login page to a random address, so the well-known default admin password and the default /loginURL address are both rejected.

The bundled check confirms this end to end against the live store:

sudo systemctl is-active wondercms-firstboot.service
sudo bash /usr/local/sbin/wondercms-cred-roundtrip.sh

The per-VM credentials are written to a root-only file. Read the file to get your WONDERCMS_LOGIN_URL and WONDERCMS_ADMIN_PASSWORD:

sudo cat /stage/scripts/wondercms-credentials.log

Keep this file secure. WONDERCMS_LOGIN_URL is your private admin address, and WONDERCMS_ADMIN_PASSWORD is your administrator password. After your first sign-in, change the password from within the app.

The site responds on whatever address you use to reach it. Confirm that it is serving locally. Then browse to http://<vm-ip>/ to see the public site on the default sky theme:

curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://127.0.0.1/

Browse to your private login address (the WONDERCMS_LOGIN_URL from Step 5), enter your administrator password, and select Login. There is no username, because WonderCMS uses a single password login.

The content store is never web readable, so a request to http://<vm-ip>/data/database.js returns HTTP 403.

After you sign in, the Settings and logout buttons appear, and every editable region is outlined. Click any text to edit it in place, and click outside the text to save. Changes go live immediately.

Use the menu to move between pages, and create new pages from Settings. The public site itself needs no external assets. The in-browser editing interface loads a small set of static admin assets from the jsDelivr CDN.

Open Settings to manage the site. The Security tab shows your admin login URL, the site language and the administrator password change form. Change the login URL here to rotate your private login address again.

Other tabs let you switch themes, install plugins, manage the menu and upload files.

Component Path

WonderCMS application /var/www/wondercms/

Content store (JSON) /var/www/wondercms/data/database.js (denied to web clients)

Uploaded files /var/www/wondercms/data/files/

Themes /var/www/wondercms/themes/

nginx vhost /etc/nginx/sites-available/wondercms.conf

Firstboot script /usr/local/sbin/wondercms-firstboot.sh

Credentials /stage/scripts/wondercms-credentials.log (mode 0600 root:root)

• Change the administrator password under Settings, Security after your first sign-in, and store it in your own secrets manager.
• Enable HTTPS by installing certbot and requesting a certificate for your domain:

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

• Restrict the network security group so that ports 80 and 443 are open only to your CDN or load balancer, and port 22 is open only to your management network.
• Keep the OS patched by running sudo apt-get update and sudo apt-get upgrade regularly.
• Point your domain at the instance. Because the site is host-agnostic, no URL rewrite is needed. Once your certificate is in place, WonderCMS can also enforce HTTPS from Settings.
• Back up by copying /var/www/wondercms/data/, which holds your whole site in one place.