WordPress installation: steps to a secure start

1. Verify the destination directory and requirements

These instructions cover manually installing WordPress on an empty website through cPanel. Menu names may vary with panel language and version, and an automatic installer may not be available on every service. Verify your account's panel, version and access details in the service instructions.

1. Decide whether to publish at your domain root, on a subdomain or in a folder such as example.com/blog.
2. In cPanel's Domains section, check the domain's Document Root directory. Do not guess the folder name. If files already exist, back up both files and the database before installing over them.
3. Compare WordPress requirements with the PHP and database versions in your service. Check the domain's DNS record and HTTPS certificate.

Result of this step: You know the installation URL and its empty destination folder. If using a new test area instead of changing an existing website, restrict access to it.

2. Place WordPress files in the destination

If your panel has an automatic WordPress installer, check the destination domain, protocol and folder fields first. To publish at the root URL, verify that the tool's 'directory' field does not add an unnecessary wordpress folder. If the automatic installer creates the database, do not repeat the manual database step below.

For a manual installation, follow this order:

1. Download the current ZIP package from the official WordPress download page.
2. Open the destination directory verified in the first step using File Manager, then upload and extract the ZIP file.
3. If the archive extracts into a wordpress subfolder and the site should run at the root URL, move that folder's contents into the destination root. index.php, wp-admin and wp-includes should all appear inside the same destination.
4. After extracting and checking the files, remove the uploaded ZIP archive from the web directory.

Result of this step: The files are in your chosen web root, preventing the installation from accidentally appearing under /wordpress/.

3. Create and connect the database and user

Search cPanel for MySQL Database Wizard. Depending on the version, it may also be called 'Database Wizard'. The steps below follow WordPress's official cPanel database instructions.

1. At Create a Database, create the database for the new application. If the panel adds an account prefix, use the full name, including that prefix, in later steps.
2. At Create Database Users, create a user dedicated to this site and a strong password. The database user is different from your WordPress administrator account.
3. At Add User to Database, link the user you just created to the correct database. For WordPress installation and updates, apply All Privileges only to this application's database; do not grant server-wide permissions.
4. Record the full database name, full username and database server address supplied by the service. Store the password in your secure password manager.

Result of this step: You have not merely created a database and user; the user is linked to the correct database with the required permissions. Make the final check in the panel's database/user list.

4. Isolate database errors before installation

If the error persists, add the exact message and your checks to a support request. Do not paste passwords or the contents of wp-config.php into the message.

5. Complete the installer and administrator account

1. Open your chosen HTTPS URL in the browser. If installation does not start, append /wp-admin/install.php; include the subfolder in the URL if you installed into one.
2. After choosing the language, enter the database name, username, password and database server from your own panel records. Do not guess the server address. If WordPress asks you to save a wp-config.php file manually, use only the content generated by your own installation; do not share the file.
3. Start the installation; enter the site title, an individual administrator username, a unique strong password and an administrator email address you can access.
4. Once installation is complete, sign in at /wp-admin/. Use the dashboard's Visit Site link to check that the website opens at its HTTPS URL.

If your agency performs the installation, keep the client's account separate from the maintenance account. Do not grant the administrator role to a content contributor who does not need it. Do not enter passwords in public support messages or the example fields in this guide.

6. Check general settings and permalinks

1. Under Settings → General, check the site title, administrator email and that the time zone is Istanbul. Do not arbitrarily change the WordPress or Site Address of a working site; an incorrect URL can affect administrative access.
2. Under Settings → Permalinks, select a structure appropriate to your publishing model and click Save Changes. Open a test page to verify that inner-page URLs work. If changing the URL structure of an existing live website, plan redirects from the old URLs first.
3. Check search engine visibility under Settings → Reading according to your site's publishing status. Do not rely on this checkbox alone to hide a test environment; remove unnecessary blocking when going live.
4. Choose the components you will use under Appearance → Themes and Plugins, and remove those you do not use. Reopen the homepage and an inner page after making changes.

For an official explanation of how these settings work, see the WordPress permalink documentation.

7. Establish an update and backup routine

Under Dashboard → Updates, review the status of WordPress, themes and plugins. Before a major change, take a backup that allows files and the database to be restored together; test the update in a separate environment if possible. Keeping backups only in the website's own directory does not provide independent protection.

Base your automatic-update decision on application compatibility and testing availability. Record the copy's date, storage location and person responsible for restoration. Verify the hosting service's backup scope separately; a security plugin does not replace basic account and version management.

8. Complete the launch checks

• Do the homepage, a test inner page and an image open over HTTPS in a logged-out browser?
• Can you upload a small test image under Media → Add New? Remove unnecessary test content afterwards.
• Do the mobile menu, search and contact form work as expected? Verify that the form email reaches your own authorised test address.
• Have you reviewed warnings under Tools → Site Health and recorded those relevant to your application?
• Have noindex directives, access restrictions and incorrect site URLs left over from testing been removed?
• Are the file/database backup, update owner and renewal date defined?

If you see a different screen during setup, use the official WordPress manual installation documentation. For performance, see the WordPress optimisation guide; for package coverage, explore WordPress hosting options.