Start with a working application.

PXM can initialize Laravel, WordPress and phpMyAdmin in a new directory. Existing files are never replaced. Enable web routing first, then run as the account that owns PXM:

pxm site create app.example.com /home/you/sites/app --template laravel
pxm site create database.example.com /home/you/sites/phpmyadmin --template phpmyadmin

The parent directory must exist, belong to your account and not be writable by other accounts. The new directory stays private during initialization. Routing is registered only after setup completes and the application answers its configured HTTP health check. Public hostnames use automatic HTTPS; local names such as app.test use the explicit local certificate authority workflow.

Laravel installs the official Composer project and dependencies with managed PHP and Node.js. It generates an application key, applies initial migrations to a new private SQLite database and builds production frontend assets. Its environment starts with APP_ENV=production and APP_DEBUG=false. Database connections can be changed afterward using the application's normal deployment process.

phpMyAdmin uses the official verified archive and a compatible managed PHP 8.3 runtime. Database access uses cookie authentication against 127.0.0.1:3306. No database password is stored by the template. Passwordless logins and arbitrary remote servers are disabled, the web setup wizard is removed, and temporary data lives in a private hidden directory excluded from HTTP serving.

WordPress

Provide an existing empty MySQL database and an explicit administrator. Save two JSON files outside the project directory, owned by your account with mode 0600:

{"host":"127.0.0.1","port":3306,"name":"new_wordpress","username":"wordpress_user","password":"YOUR_DATABASE_PASSWORD"}

{"username":"your_admin","password":"YOUR_UNIQUE_ADMIN_PASSWORD","email":"you@example.com","title":"Your site"}

The administrator password must be at least 12 characters. Then run:

pxm site create blog.example.com /home/you/sites/blog \
  --template wordpress \
  --database-file /home/you/private/wordpress-database.json \
  --admin-file /home/you/private/wordpress-admin.json

PXM verifies the official WordPress file inventory and a pinned official WP-CLI checksum. It refuses a populated database, generates unique authentication salts, initializes the specified administrator without sending email, verifies installation, then registers the site. Database credentials and the administrator password are never passed in command-line arguments. The public installation wizard is never exposed during setup.

If initialization fails, no new route is registered. The private project directory and any setup data already written to the explicitly selected database remain for inspection. PXM never drops that database or deletes a partly initialized project automatically. Resolve the error before retrying with a new path.

Use --php VERSION to select a compatible managed PHP line. Laravel also accepts --node VERSION. phpMyAdmin 5.2 requires PHP 8.3 in PXM. These options install signed runtime packages when necessary. Application framework archives and dependency downloads come directly from their official sources; they are separate from the signed PXM runtime catalog.