You installed WordPress. There is a default post called “Hello world!”, a sample page, and a theme that looks nothing like your business. The next hour decides whether the site is findable, secure, and backed up — or one of the millions that quietly sit unindexed for a year.
Nine steps, in the order that matters.
1. Delete the sample content
Posts → delete “Hello world!”. Pages → delete “Sample Page”. Also delete the default plugins you will not use — Hello Dolly and Akismet if you are not running comments yet. An empty site is easier to build on than a site with placeholder text you forget to remove.
2. Set permalinks before you publish anything
Settings → Permalinks → Post name. Do this first, because changing permalinks after Google has indexed URLs means setting up redirects for every one of them.
Settings > Permalinks > Post name
https://example.com/sample-post/While you are there: Settings → General for the site title, tagline, timezone and admin email address. The admin email is where password resets and update notices go — make it a mailbox you actually read.
3. Turn on HTTPS and force it
Most hosts issue a free Let’s Encrypt certificate automatically. Once it is active, force HTTPS so nobody can reach the insecure version:
Settings > General
WordPress Address (URL): https://example.com
Site Address (URL): https://example.comThen check that http:// redirects to https://. If it does not, enable the redirect at the host or with a plugin — but do not leave both versions serving the site, because that splits your analytics and duplicates content.
4. Choose a theme you can maintain
Pick one from the official directory or a reputable vendor, and check two things: when it was last updated, and whether it ships with a child theme or custom CSS option. Never edit a parent theme directly — the next update erases your changes.
Install one theme. Active themes each carry their own code, and unused themes still need updating to stay safe.
5. Build the four pages every site needs
| Page | What it must do |
|---|---|
| Home | Say what you do, for whom, and what to do next |
| About | Who is behind it and why they are credible |
| Contact | A working form plus a real email address |
| Privacy policy | Required the moment you collect any personal data |
Set the homepage under Settings → Reading if you want a static front page instead of the blog index. Test the contact form by submitting it and confirming the email arrives — not just that the page renders.
6. Tell search engines you exist
- Settings → Reading → make sure “Discourage search engines” is unchecked. It is ticked on some one-click installs, and it is the single most common reason a new site never appears in Google.
- Install one SEO plugin (Rank Math or Yoast), run its wizard, and submit the sitemap in Google Search Console.
- Verify the property in Search Console with the domain or URL-prefix method before you need it — fixing indexing later is slower than starting clean.
7. Set up backups, then test one
A backup you have never restored is a file, not a backup. Install a backup plugin or enable the host’s daily backups, send copies off the server, and restore to a staging copy once so you know the process works.
8. Lock the login down
- Delete the “admin” username if it exists; use a distinct username instead.
- Set a generated 20-character password, stored in a manager.
- Enable two-factor authentication for every administrator.
- Create your editor or author accounts with the lowest role that works.
- Keep the site, theme and plugins updated on a schedule.
That list takes twenty minutes and prevents most of the compromises small sites experience.
9. Make email actually arrive
WordPress sends password resets and form notifications through PHP’s mail function by default, which lands in spam on many hosts. Configure SMTP with a real mailbox or a transactional service, then send yourself a test from the contact form and check the spam folder.
The launch checklist
| Check | Pass looks like |
|---|---|
| Visibility | Search engines allowed, sitemap submitted |
| HTTPS | http redirects to https, padlock present |
| Forms | Submission arrives in the inbox, not just the database |
| Backups | Off-server copy, one successful test restore |
| Users | No “admin” account, 2FA on every administrator |
| Password reset email arrives in the inbox | |
| Performance | Images compressed, caching enabled, LCP under 2.5s |
| Legal | Privacy policy published, cookie notice if you set cookies |
Most of this is a one-time setup. Keeping it true over time is the maintenance job — updates tested, backups verified, logins monitored — which is what a WordPress care plan exists to cover. If you have not bought hosting or a domain yet, how domains and hosting fit together is the step before this one.
FAQ
How long does this take?
An afternoon for the settings and security steps, longer for content and design. Nobody regrets spending the first hour on permalinks, HTTPS and backups.
Do I need plugins immediately?
Four categories cover most sites: SEO, backup, security, and caching. Everything else should earn its place — every plugin is code you now have to maintain.
Should I use a page builder?
Only if you will maintain it. The block editor handles most business sites; builders add capability and a dependency. The trade-off is covered in Elementor vs Gutenberg.
What if I already published with the wrong permalinks?
Change them, then set up redirects from the old URLs. If the site is brand new and barely indexed, the damage is small — which is why doing it first is worth the two minutes.
Is a coming-soon page a good idea?
Yes while you build, as long as you remember to turn it off. The failure mode is a site that is finished and still hidden six weeks later.
For the wider questions that come up in the first month — cost, plugins, SEO, security — the WordPress FAQ answers twenty of them.
One exception to the order above: if the site is a blog, do the categories and the posts page before you write anything, because moving posts between categories later is dull work. The sequence is laid out in how to create a blog on WordPress.
