Setting Up a WordPress Site From Nothing, Step by Step

The way most people set up their first WordPress site is to buy hosting first, pick a domain in the checkout form because it is free for a year, and discover three weeks later that the domain is registered through the host, the email address on the order is the only one that can prove ownership, and moving either one is now a project. Nothing is broken. It is just harder to leave than it needed to be.

The steps below are in the order that avoids redoing things, which is most of what makes a first setup pleasant or miserable. You will need a card for the hosting, an hour for the first pass, and nothing else.

Register the domain first, then point it at the host before you install

A domain is a registration, not a purchase. You rent the name for a year at a time from a registrar, and the registrar is recorded as the place that can prove you own it. A host can also be a registrar, and there is nothing wrong with that, but the two roles answer different questions and it helps to decide them separately before money changes hands.

Pick a registrar you would keep if you changed hosts. The name matters more than the company: a short, spellable word or phrase beats a clever one, because you will say it out loud on the phone. A .com costs roughly twelve to twenty dollars a year at nearly every registrar. Two things are worth more than the price. Turn on auto-renew, because the day you forget is the day a domain squatter notices. And check who owns the registrant contact, because if it is not your email address you cannot move the domain without a support ticket.

The hosting account will offer you a domain free for the first year, and SiteGround's version covers .com, .org and .net. Take it if you are happy to keep the site there, because a year is a real saving. If you think you might move, register the name separately and point the hosting at it later. The saving is about the price of two coffees; the difference in exit cost is a transfer you may not be able to complete on your own.

Once the name is yours, it answers with placeholder records the registrar put there. Two kinds of change make it answer with your site. The first is nameservers, which hand the whole zone to the host and are what you want on a first site. The second is individual records, for when DNS stays somewhere else, usually because email already lives there. Pick one and stay with it; mixing the two is how a domain ends up pointing at a host that does not know about the mail.

Write the pair of nameserver hostnames into the registrar's control panel, save, and then wait. Propagation is usually minutes and sometimes several hours, and the only way to know is to ask a public resolver rather than your own laptop:

dig +short NS yourdomain.com
dig +short A yourdomain.com
dig +short A www.yourdomain.com

When the A record returns the address your host gave you, the domain is attached. If you get nothing back, wait and run it again; if the registrar's parking address is still there after an hour, the nameservers were not saved. Do this before installing WordPress, because the installer needs the site's final address and a site installed on a temporary domain has to be moved afterwards.

Buy the hosting, choosing the plan from your visitor number

You need three things from a host at this stage: somewhere to install WordPress, a database, and a control panel that does both. Everything else is convenience, and the convenience worth paying for is support you can reach on a weekday evening.

This is the step where SiteGround comes in, so here is the arrangement in plain terms: WPSifero earns a commission if you sign up through the link below, and it does not change which plan I would suggest for a given site.

SiteGround sells three shared plans: StartUp, GrowBig and GoGeek. The choice between them is capacity, not features, because all three carry the same core set: a domain free for the first year, an SSL certificate, email accounts, a CDN, daily backups, an out-of-the-box caching layer, WordPress tooling including a one-click installer and automatic core updates, and the Speed Optimizer and Security Optimizer plugins. StartUp is one website, 10 GB of space and a guide of about 10,000 visits a month, listed at $2.99 a month for the first twelve months and renewing at $17.99. GrowBig is unlimited websites, 50 GB, a guide of about 100,000 visits and staging, listed at $4.99 and renewing at $29.99. GoGeek is 100 GB, a guide of about 400,000 visits, staging plus Git and priority support, listed at $7.99 and renewing at $44.99.

The number that picks the plan is your realistic monthly visitor count, not your hopes for it. One site with a few thousand visits belongs on StartUp. Several sites, or one you expect to grow past ten thousand visits a month, belongs on GrowBig, and the reason is staging as much as traffic: testing an update on a copy before it touches the live site is worth more than the difference in price. GoGeek is for a site that already has an audience. Read the renewal figure before you read the discount: SiteGround's shared hosting page lists StartUp, GrowBig and GoGeek with the introductory price and the renewal price on the same card. Choose the twelve-month term, or the price you saw is not the price you pay.

Where SiteGround stops being the right choice is worth knowing before you buy, not after. It is shared hosting, so if you need root access, a PHP extension nobody else wants, or a server you configure yourself, this is the wrong product. Running several sites on different PHP versions with dependencies installed by Composer will fight a single shared account. If a launch is expected to arrive all at once, a plan with a fixed visit guide and a renewal price fits worse than one billed by the hour. And if you would rather not have your email tied to your hosting account, keep the mail somewhere else, which makes the next migration a site move rather than a communications project.

Install WordPress once, and take the defaults

SiteGround's plan includes a WordPress installer in the client area. It asks for three things: where the site should live, an administrator account, and a password. Install it in the root of the domain if this is the only site on the account, so the address is yourdomain.com rather than yourdomain.com/wp, because a path is one more thing to redirect later. Pick a site title you can change and an admin username you would not mind someone guessing, which means not admin. Let the installer create the database, and leave the table prefix alone: the default is fine on shared hosting, and renaming it defends against an attack a strong password and an updated core already cover.

Turn on SSL before anyone else visits

An SSL certificate is what makes the browser show a padlock and encrypt the connection. SiteGround provisions a free Let's Encrypt certificate and renews it automatically, so the work is not obtaining one but making the site use it. Do this before you announce the address: a site reachable at both http:// and https:// gives search engines two copies of every page and splits whatever links arrive.

1. Enable the certificate for the domain in the hosting control panel and wait for it to show as active.
2. Load https://yourdomain.com/ directly and confirm the padlock. A security warning here is usually a certificate that has not finished issuing.
3. In WordPress, set both the WordPress Address and the Site Address to the https:// version, on the Settings screen or with wp option update home https://yourdomain.com and wp option update siteurl https://yourdomain.com.
4. Open the browser console and look for mixed content warnings, which appear when the page still asks for an image or a stylesheet over http://. Fix the URLs in the database, do not leave the warning.
5. Run one fetch of the whole site at the new scheme, then check the HTTP status of three or four pages in the browser's network panel.

The step people skip is the fourth one. A padlock on the homepage does not mean every page is clean, and mixed content is the most common reason a brand new site shows as "not secure" on one page and fine on another.

Set the email addresses up before you publish the address

Mail decides whether the site looks professional. An @gmail.com address on a contact page is not a failure, but an address at your domain is what makes a receipt or a reply look like it came from a business. SiteGround includes email accounts on these plans, so you can create hello@yourdomain.com the same afternoon.

Two things go wrong. The first is deliverability: a brand new domain has no sending reputation, so mail lands in spam until the authentication records are in place. Add the SPF record, make DKIM signatures work so messages are signed, then add a DMARC policy that asks for reports rather than rejecting anything. The second is coupling. The moment a mailbox lives in the same account as the website, leaving the host means exporting mailboxes and reconstructing records, so decide now whether that is acceptable. Keeping email with a provider you would keep anyway costs a few dollars a month and removes that problem from every future migration. Send a test to a Gmail and an Outlook address and confirm the message arrives.

Take a backup, then restore it, then write the first post

A fresh WordPress install is the cheapest it will ever be to back up, which makes it the right moment to learn how. Two layers are worth having. The first is the daily backup your host already runs, which is fast to restore and lives inside the account you are restoring. The second is a copy you control, exported by a backup plugin to storage outside the account, so that losing access does not lose the site. Run the first export on the day you install WordPress, while the archive is small and a mistake costs nothing.

Then do the part almost nobody does: restore it somewhere. Import the archive into a staging copy or a local install. A backup you have never restored is a promise rather than a backup, and the failure mode is discovering that the archive excludes the uploads directory on the day you need it. Once the restore works, put it on a schedule you will keep. A weekly database export is enough for a blog.

Only then write the post. Before you publish, set the permalink structure, because changing it later breaks every link that already exists; the post name option is the usual choice. Write the post as a draft, preview it on a phone as well as a laptop, and add two pages before you promote anything: one that says who you are and one that says how to reach you. Then publish.

Advertisement · SiteGround

What to do on Monday

1. Register the domain with auto-renew on and your own email as the registrant, then write the registrar password somewhere you will find it in a year.
2. Buy twelve months of the plan that matches your realistic visitor number, and read the renewal price on the same page before you pay the introductory one.
3. Point the nameservers at the host, install WordPress in the root, and enable SSL.
4. Create the mailboxes and the SPF, DKIM and DMARC records, then send yourself a test message from the new address.
5. Export a backup and restore it on a staging copy. If the restore works, set the permalink structure and publish the first post.