Fast answer
Install WordPress from your host’s one-click installer, then immediately set Settings → Permalinks to Post name, set the site language for the front end, create a second administrator account, and delete every sample page, post and plugin you did not choose.
The first hour, in order
- Run the host’s one-click installer. Choose a username that is not admin and a password you have not used anywhere else.
- Log in, then go to Settings → General and confirm the site title, tagline, and timezone. Set the front-end language here; keep your own admin language separate if you prefer working in another one.
- Go to Settings → Permalinks and choose Post name. Save. This is the single most consequential setting in WordPress and it is nearly impossible to change later without breaking links.
- Open Settings → Reading and confirm search engines are allowed to index the site. It is off by default in some installs and nobody notices for months.
- Delete the sample page and the sample post. Empty the trash. An empty site is easier to design than a site you are afraid to delete from.
Why permalinks first
Every link you ever share, every citation an AI engine stores, and every backlink you earn points at the URL structure you choose today. Switching from ?p=123 to /post-name/ after launch means redirects for every page, forever. Choose the clean structure before the first post exists and you never think about it again.
Accounts, roles and who can break what
You need exactly two accounts: one administrator for daily work, one separate administrator as a recovery login with a different email. Everyone else — editors, contributors, whoever helps with content — gets the least role that lets them do the job.
- Administrator — can install plugins and edit users. Two of these, no more.
- Editor — can publish and edit anyone’s content. Right for a writer you trust.
- Author — can publish their own content only.
- Contributor — can write but not publish. The safe default for anyone new.
Strip it down before you decorate it
A default install plus a template pack can leave you with forty pages, twelve plugins and three font families. None of that is your brand; all of it is surface area for something to break. Before choosing a theme, delete unused plugins, then install only what you can name the purpose of in one sentence.
Keep the plugin list short enough to audit: one for SEO, one for forms, one for backups or caching, and nothing else until a real need appears. Every plugin you remove is a support thread you will never read.
Before you write anything
- Set up automatic backups and confirm one restore works.
- Create the pages you know you need: Home, About, Services, Contact, Privacy, Terms.
- Build the navigation menu once, from those pages, so nothing is orphaned later.
- Add a favicon and a site icon — the tab is part of the brand whether you design it or not.
Checklist for this step
- Admin username is not admin; password stored in a manager
- Second recovery administrator exists with a different email
- Permalinks set to Post name and saved
- Search engine visibility is on
- Front-end language set correctly
- Sample page and post deleted, trash emptied
- Every installed plugin has a one-sentence reason to exist
- Automatic backup configured and one restore tested
- Navigation menu built from real pages
- Favicon and site icon uploaded
Common mistakes
- Writing ten posts before touching permalinks. Now you need redirects on day one.
- Installing a page builder, a block pack, and a second block pack. They fight, and you lose the afternoon.
- Leaving the default admin username. It removes one of the two things an attacker needs.
- Skipping the backup test. An untested backup is a file, not a plan.
W — Order matters more than speed
Two hours of setup done in the right order saves days of migration later. The expensive decisions in WordPress are almost all made in the first hour and discovered in month six.
Keep the order.
Every step assumes the one before it is finished. Skipping ahead is how sites end up rebuilt twice.