Installing WordPress the Right Way: The First Hour

Installing WordPress takes about five minutes. Installing it properly takes about an hour. The difference between the two shows up months later, when the site has an “admin” user nobody remembers creating, a sample page still sitting in Google, and links that broke because someone changed the URL format after launch.

This lesson walks through that first hour. Do it yourself, or use it as a checklist when someone else does it for you. Either way, by the end you will have a clean, safe base that every later lesson builds on.

01How Should You Install WordPress in the First Place?

Use the installer in your hosting panel. Almost every host sold in India has one: many cPanel hosts use Softaculous, and Hostinger has its own WordPress installer in hPanel. It creates the database, copies the files and sets up the first user in one go. Uploading files by hand and creating the database yourself is still possible, but for a business site it only adds room for mistakes.

Before you click install, have three things ready. Your domain should already point at the hosting, which we covered in the domain, hosting and email lesson. An SSL certificate should be active, so the site starts on https from day one. Most hosts issue a free one automatically. And you need a business email address, not a personal Gmail, for the admin account.

The installer will ask a few questions. Answer them like this:

• Address: the https version of your domain, at the root, not in a folder like /wp or /blog.
• Admin username: anything except “admin” or your business name. Attackers try those first.
• Password: long and generated, saved in a password manager, never sent over WhatsApp.
• Admin email: a business address that someone actually reads, because WordPress sends security and update notices there.

As of November 2026 the current WordPress release is 7.1.4. The installer should give you the latest version. If it offers an older one, update straight away from Dashboard, Updates.

02Which Settings Should You Change Straight Away?

WordPress ships with defaults built for a personal blog. A business site needs a few of them changed, and most of them are much harder to change later.

That “discourage search engines” box deserves a second mention. It is one of the most common reasons a new site never appears on Google. It gets ticked during the build, the site launches, and nobody looks at that screen again.

Check it on launch day.

03What Should You Delete From a Fresh Install?

A new install arrives with demo content. It looks harmless, but it gets indexed, it confuses whoever edits the site later, and leftover plugins and themes are code that needs updating whether you use it or not.

• The “Hello world!” post and its sample comment.
• The “Sample Page”.
• Any plugins the host or installer added that you did not ask for. Some hosts preinstall their own tools, a page builder or a sample plugin. Keep what you will use, delete the rest, do not just deactivate it.
• Spare default themes. Keep the theme you will use and one current default theme as a fallback, and delete the others.

Take a clinic in Kharar setting up its first site. The receptionist’s nephew installs WordPress on a Sunday, adds a few pages and leaves the sample page in place. Three months later someone searches the clinic’s name, and one of the results is a page that starts “This is an example page”. Small thing. It still makes the clinic look careless to a patient deciding where to book.

04Who Should Have a Login, and at What Level?

Shared logins are where most small business sites go wrong. One admin password gets passed between the owner, the designer, a marketing freelancer and a cousin who “knows computers”. When something breaks, nobody knows who changed what, and when someone leaves, the password stays with them.

Give every person their own account, with the lowest role that lets them do their job. WordPress has the roles built in under Users.

• Administrator: the owner and the developer. Nobody else. This role can install plugins and delete the whole site.
• Editor: the person who manages pages and posts day to day.
• Author: someone who writes blog posts but should not touch pages.

For the clinic, that means the doctor who owns it holds one administrator account, the developer holds another, and the front-desk manager who updates timings gets an editor account. When the developer’s work is done, their account is removed or downgraded. Two-factor login for administrators is worth adding in the first week too; Module 4 covers how in WordPress security basics.

05Why Do You Need a Staging Copy?

A staging site is a private copy of your website where changes are tried before they go live. New theme, big plugin update, redesigned home page: it all happens on staging first. If something breaks, it breaks where no customer can see it.

Many hosts include a staging tool in their WordPress panel. If yours does not, a plugin such as WP Staging can make a copy inside your hosting account. Developers often build the whole first version on staging or on their own computer, then move it to the real domain at launch.

Two rules keep staging useful. It must be hidden from Google, either with the “discourage search engines” setting or, better, a password on the whole staging site. And when you push staging to live, check that form emails, phone numbers and payment settings point at the real ones, not test addresses.

For a five-page site, staging can feel like extra effort. It stops feeling that way the first time an update turns the home page white on a busy Monday morning.

06How Do You Know the First Hour Went Well?

Run through a short check before moving on to design. If you are judging someone else’s setup, ask them to show you each item on a screen share. It takes ten minutes:

Site opens on https with a padlock — No user called “admin” — Permalinks set to Post name — Timezone set to Kolkata — Sample post, page and unused plugins gone — Each person has their own login — Staging exists and is hidden from Google

If all seven are true, the foundation is sound. None of it is visible to customers, which is exactly why it gets skipped. When we take over a site for WordPress development or maintenance, these are the first things we look at, because problems here quietly make every later fix slower.

07What Comes Next?

You have a clean install with sensible settings, proper logins and a safe place to test. The next lesson is the first big choice that customers will actually see: themes and page builders, and how to choose between Elementor, the built-in block editor and a custom theme without getting locked into something you regret.