This covers installing WordPress, the settings worth changing on day one, and the two things that cause most of the support tickets we see.
Installing WordPress
Sign in to cPanel and use the WordPress installer under Applications. It creates the database, installs WordPress and sets up the administrator account in one pass — considerably less error-prone than installing by hand.
During installation you will be asked for an administrator username and password. Two things matter:
- Do not use "admin" as the username. It is the first thing automated attacks try.
- Use the generated password. WordPress offers a strong one; take it and store it in a password manager rather than replacing it with something memorable.
The first ten minutes
- Settings > Permalinks — choose Post name. This gives readable URLs. Changing it later breaks existing links, so do it before you publish anything.
- Settings > Reading — make sure Discourage search engines is unticked once you are ready to be found. Installers sometimes leave it on.
- Settings > Discussion — if you do not want comments, turn them off now. An abandoned comment form is a spam magnet.
- Delete what you are not using. Unused themes and plugins still need patching and are still an attack surface. Remove them rather than deactivating them.
Keeping it secure
Nearly every compromised WordPress site we see was running an outdated plugin. Not a clever attack — an automated scan finding a known hole in something the owner forgot was installed.
- Turn on automatic updates for WordPress core, and for plugins you trust.
- Check the updates screen monthly even so. Some plugins cannot auto-update.
- Remove any plugin you have not used in six months.
- Use unique passwords for the WordPress admin and for cPanel. They are separate systems and a shared password links them.
Email from WordPress
WordPress sends mail using PHP by default, which frequently lands in junk folders because those messages are not authenticated. If password resets or contact form submissions are going missing, this is why.
Install an SMTP plugin and configure it to send through your mailbox on our servers rather than through PHP. Combined with the SPF, DKIM and DMARC records covered in our separate article, that fixes deliverability properly rather than papering over it.
When the site is slow
In rough order of how often it turns out to be the cause:
- Too many plugins, or one badly-written one. Deactivate them in batches to find the culprit.
- No caching. A caching plugin is the single biggest improvement on most sites.
- Unoptimised images. A 4 MB photo straight from a phone will do more damage than any amount of PHP tuning.
- An old PHP version. New accounts run the current stable release of PHP. If your site has been with us a while it may be on an older one — change it under MultiPHP Manager in cPanel. See our article on PHP versions first.
Backups
A WordPress site is files and a database. A backup of one without the other will not restore.
Take a full backup before every plugin or theme update on a site that matters. Use a backup plugin that captures both, or take a full cPanel account backup. Whatever we hold at server level is disaster recovery for the server, not a substitute for your own copy.
Locked out of wp-admin?
You can reset the administrator password directly in the database via phpMyAdmin, but it is easy to make things worse. Open a ticket from the client area and we will do it — tell us the domain and the administrator email address.
