How to Install WordPress: Beginner’s Step-by-Step Guide

Installing WordPress used to mean wrestling with databases and FTP clients for an afternoon. In 2026 it takes about five minutes — most hosts do it for you with a single click. But “the button did it” leaves beginners stuck at the next step: the dashboard looks empty, the defaults are wrong for a business site, and nobody tells you what to configure before building. This guide shows how to install WordPress step by step, plus the settings to change right after.

This guide covers everything about how to install WordPress the right way: what you need before you start, the one-click install most people should use, the manual install for those who want full control, and — most importantly — the essential first settings, security steps, and plugins to set up on day one so your site starts fast, secure, and backed up.

What you need before you install WordPress

WordPress itself is free, but it needs two things to live on: a domain name (your address, like yourbusiness.com, roughly $10–$15/year) and web hosting (the server where your site’s files live, roughly $3–$10/month for quality shared hosting). Buy them from reputable providers — and preferably buy the domain from a dedicated registrar rather than your host, so you are never locked in.

For hosting, look for three things: one-click WordPress installation, free SSL certificates (non-negotiable — Google penalizes sites without HTTPS), and servers that are not painfully slow. Avoid the cheapest hosts in “top 10” listicles — those are ranked by affiliate commission, not quality. A few dollars more per month buys far better speed and support, which directly affects your Core Web Vitals.

Once you have hosting, log in to your hosting control panel (usually cPanel or a custom dashboard) with an email address you actually check — WordPress sends password resets and updates there. That is all the preparation required: no coding, no software to download.

Method 1: the one-click install (recommended for most people)

Almost every shared host offers a one-click WordPress installer — usually called Softaculous, QuickInstall, or simply “WordPress” in the control panel. This is the method 95% of people should use. It handles the database creation, file placement, and configuration automatically, and it takes longer to read this paragraph than to run it.

The steps are nearly identical on every host. In your hosting panel, find the WordPress installer and click it. Choose the domain where you want WordPress (use the https:// version — your host should offer free SSL; if it does not, switch hosts). You will be asked for a site title (changeable later, do not overthink it), an admin username, a strong password, and an admin email. Two critical details: never use “admin” as your username — it is the first thing every hacking bot tries — and generate a long random password rather than inventing one.

Click install, wait 1–3 minutes, and you will get links to your new site and your dashboard (yourdomain.com/wp-admin) — bookmark the dashboard link. The whole process takes about five minutes, and professionals use one-click installers too: the result is identical to a correct manual install.

Method 2: how to install WordPress manually

The manual install gives you full control and is worth knowing about if you are moving hosts, setting up a local development environment, or just want to understand what is happening under the hood. It takes 15–30 minutes and involves a few more steps, but none of them are difficult.

Here is the process, step by step. First, download the latest WordPress from wordpress.org and unzip it on your computer. Second, in your hosting control panel, create a MySQL database and a database user, then grant that user full privileges on the database — write down the database name, username, and password. Third, upload the unzipped WordPress files to your hosting account’s public folder (usually called public_html) using the file manager or an FTP client like FileZilla.

Fourth, visit your domain: WordPress launches its 5-minute setup wizard. Enter the database name, username, password, and host (usually “localhost”), and click submit. Finally, fill in your site title, admin username (not “admin”), password, and email, and click Install WordPress. Done — same result as one-click, and now you understand the machinery underneath.

Essential first settings after installation

A fresh WordPress install ships with defaults chosen for a 2005-era personal blog, not a 2026 business website. Before you build anything, fix these settings — it takes ten minutes and saves real headaches later. Go through them in order in your dashboard under Settings.

• Permalinks (Settings → Permalinks): change from the default “Plain” (?p=123) to “Post name.” This single setting affects your URLs, your SEO, and whether anyone can guess what a page is about from its link. Do this before you publish anything, because changing it later breaks existing links.
• Site title and tagline (Settings → General): set your business name and a short description. This appears in browser tabs and search results.
• Timezone and date format (Settings → General): set these to your actual location so scheduled posts publish when you expect.
• Comments (Settings → Discussion): for most business sites, uncheck “Allow people to submit comments on new posts.” Blog spam is relentless, and an unmonitored comment section fills with junk within weeks.
• Homepage (Settings → Reading): decide whether your homepage shows latest blog posts or a static page. Business sites almost always want a static homepage.
• Delete the defaults: remove the “Hello world!” post, the sample page, and the default comment. Also delete any pre-installed plugins you do not recognize — hosts love bundling bloatware.

While you are in there, check Settings → General to confirm your WordPress Address and Site Address both use https://. If your host installed the SSL certificate after WordPress, these sometimes still say http://, which causes mixed-content warnings. One letter, real consequences.

Day-one security: lock the doors before you decorate

New WordPress sites get probed by hacking bots within hours of going live — sometimes minutes. This is not personal; bots scan the entire internet automatically. Spend twenty minutes on security now and you will avoid the single most common WordPress disaster: a hacked site redirecting your visitors to spam.

Install Wordfence Security (free) immediately — firewall, malware scanner, and login protection in one plugin. Enable two-factor authentication on your admin account (Wordfence includes this free). Install UpdraftPlus (free) and schedule automatic backups to Google Drive or Dropbox before you build anything worth losing. Then go to Users and make sure there is exactly one administrator account with a strong unique password.

Two more quick wins: in Settings → General, make sure nobody can register on your site unless you need membership (set “Anyone can register” to off), and keep a habit of updating WordPress core, themes, and plugins monthly. We cover the full security and maintenance picture in our essential WordPress plugins guide — but these day-one steps handle the vast majority of the risk.

What to install next: theme and key plugins

With settings and security handled, you need a theme (how your site looks) and a handful of plugins (what it can do). For themes, start with something lightweight and well-maintained — Astra, Kadence, or GeneratePress are the current sweet spot: fast, free tiers are generous, and they work with every major page builder. Avoid flashy “multi-purpose” themes with 40 demo sites; they are usually slow and bloated.

If you want drag-and-drop page building, Elementor (free) is the most popular choice and pairs well with those themes. For plugins, install the foundations now rather than later: Rank Math for SEO, LiteSpeed Cache or WP Rocket for speed, ShortPixel for image optimization, and Fluent Forms for your contact form. That is a complete, professional starting stack — and every one of them has a capable free tier.

Resist the urge to install twenty plugins “to try out.” Every plugin is code running on your site: more plugins mean more update chores, more conflict risk, and more attack surface. Install what you need, delete what you do not, and your site will thank you with speed and stability. If you would rather skip all of this and start with a site that is already configured correctly, our website development service builds complete WordPress sites from $499 — installed, secured, optimized, and ready for content.

Troubleshooting common installation problems

Most installs go smoothly, but here are the four most common problems and their fixes:

• “Error establishing a database connection.” The classic. It means WordPress cannot reach your database — almost always a typo in the database name, username, or password during manual install. Double-check the credentials in your hosting panel and re-enter them carefully.
• White screen after install. Usually a plugin or theme conflict, or PHP running out of memory. Rename the plugins folder via your file manager (to “plugins-old”) — if the site loads, reactivate plugins one by one to find the culprit. Ask your host to raise the PHP memory limit to 256M.
• Site shows “Not Secure” warnings. Your SSL certificate is not active or WordPress is still configured for http://. Activate the free SSL in your hosting panel, then update both URL fields in Settings → General to https://.
• One-click installer shows an old WordPress version. Some hosts lag on updating their installer scripts. Install anyway, then immediately run the core update from Dashboard → Updates before doing anything else.

If you get stuck beyond these, your hosting company’s support chat is your best friend — they handle WordPress installs all day and can usually fix installer issues in minutes. And if the whole thing feels like more than you signed up for, that is a completely reasonable signal to hire someone: a professional install with proper configuration costs far less than the hours most beginners spend troubleshooting.

Frequently asked questions

Written by Muhammad Hakeem

Founder, Vibstack · LinkedIn · Published Oct 25, 2026 · Updated Oct 25, 2026