Disclosure: This post contains affiliate links; we may earn a commission at no extra cost to you.
The safest way for a beginner to install WordPress in 2026 is through a reputable host’s official installer. It creates the database, places files correctly, issues HTTPS, and avoids exposing database credentials in a hand-edited file. A manual install remains useful when the host lacks an installer or you need to understand the stack.
This guide covers self-hosted WordPress from WordPress.org. A hosted WordPress.com plan has a different setup and does not require installing the software yourself.
Before you begin
You need:
- a registered domain or temporary host URL;
- a hosting account supporting modern PHP, MySQL or MariaDB, and HTTPS;
- access to the hosting control panel;
- a unique administrator email;
- a password manager; and
- control of DNS if the domain is registered elsewhere.
WordPress’s current recommended baseline is PHP 8.3 or newer, MariaDB 10.11 or MySQL 8.0 or newer, and HTTPS. WordPress 6.9 still supports older minimums such as PHP 7.4 and MySQL 5.7/MariaDB 10.3, but those old software branches may be end-of-life. Use a maintained host configuration.
Our top pick: Bluehost
Method 1: use the host installer
The labels differ, but the process is similar on Bluehost, Hostinger, SiteGround, DreamHost, and cPanel-based hosts.
1. Add the domain
Add the domain to the hosting account. If registered elsewhere, the host will provide nameservers or DNS records. Changing nameservers delegates the full DNS zone; changing individual A, AAAA, or CNAME records keeps DNS at the registrar.
Do not delete existing MX or TXT records if email already works. Record the DNS zone before changes. Propagation can be quick or take hours depending on cache and TTL.
2. Open the WordPress installer
Choose the correct domain and installation path. Leave the directory field empty when WordPress should appear at https://example.com/. Entering wordpress or blog installs it at a subdirectory such as example.com/blog/.
Avoid accidental staging or temporary domains as the final site URL. They can be changed later, but URL replacement adds work.
3. Create administrator credentials
Do not use admin as the username. Generate a long unique password and store it. Use a protected email account because password resets go there.
Set a working site title; it can change later. If the installer offers a search-engine visibility option, discourage indexing while the site contains demo content, then remember to remove the setting before launch.
4. Decline unnecessary plugins
Hosts may preselect SEO, security, analytics, page-builder, ecommerce, or marketing plugins. Install only what you understand. WordPress core already handles pages, posts, users, media, menus/navigation, and sitemaps.
You need one SEO plugin at most, one caching system compatible with the host, and a backup plugin only when host backups are insufficient.
5. Complete installation and HTTPS
Run the installer, wait for confirmation, and sign in at https://example.com/wp-admin/. Verify the browser shows HTTPS without certificate warnings.
Under Settings → General, both WordPress Address and Site Address should use https:// unless an advanced subdirectory configuration intentionally differs. Do not change these fields casually; an incorrect URL can lock you out.
Essential post-install configuration
Set the timezone, date, language, and administration email under General Settings. Go to Settings → Permalinks and choose a readable structure such as Post name before publishing.
Under Settings → Reading, confirm search visibility. A checked “Discourage search engines” box requests non-indexing but is not access control. Password-protect or firewall a private staging site.
Delete sample posts, pages, and comments. Remove unused plugins and themes, retaining one current default theme for troubleshooting if desired.
Enable automatic minor/core security updates and establish a deliberate plugin/theme update schedule. Turn on host-account and WordPress administrator MFA where supported.
Backups before design
Create the first backup after clean installation and test the restore interface. Confirm whether the host backs up files, database, email, and DNS, and how many restore points exist.
Keep an off-platform copy before major theme changes, migrations, or ecommerce launches. A backup stored only inside the same hosting account can disappear during account compromise or suspension.
Method 2: manual installation
Manual installation follows WordPress’s official process:
- Download WordPress only from WordPress.org.
- Create a MySQL/MariaDB database and a restricted database user.
- Upload the extracted WordPress files to the document root through SFTP or a trusted file manager.
- Visit the site or
/wp-admin/install.php. - Provide database name, username, password, host, and table prefix.
- Finish the site-title and administrator setup.
Use SFTP rather than unencrypted FTP. Ensure the extracted contents—not an extra enclosing wordpress folder—sit in the intended document root.
WordPress can create wp-config.php through the installer when permissions allow. Otherwise, copy wp-config-sample.php, enter database details, and obtain fresh authentication salts through the official WordPress service. Never share this file; it contains credentials.
The database user needs privileges for its WordPress database, not every database on the server. File permissions should follow host guidance rather than recursively setting everything writable.
WP-CLI for repeatable installations
Developers with shell access can use WP-CLI:
wp core download
wp config create --dbname=DB_NAME --dbuser=DB_USER --prompt=dbpass
wp db create
wp core install --url=https://example.com --title="Site Title" --admin_user=siteowner --admin_email=owner@example.com --prompt=admin_password
Do not place secrets in shell history. Use prompts, environment-specific secret handling, or deployment tools. Run WP-CLI as the correct restricted system user, not indiscriminately as root.
Common installation problems
Error establishing a database connection: Confirm database name, user, password, hostname, privileges, and that the database service is running. localhost is common but not universal.
403 Forbidden: Check document root, file ownership, permissions, security rules, and whether an index file exists. Do not solve it by making every file world-writable.
Redirect loop or mixed content: Confirm WordPress/Site URLs, reverse-proxy HTTPS headers, CDN settings, and cached redirects. Avoid installing multiple SSL-fix plugins.
Blank page or critical error: Enable appropriate logging through host tools, inspect the error log, and disable the most recently added plugin or theme through the control panel/SFTP if the dashboard is unavailable.
Site shows a host parking page: DNS may still point elsewhere, a CDN may cache the old response, or the wrong document root is selected.
Launch checklist
Create About, Contact, Privacy, and required disclosure pages. Set a maintained theme, optimize images, test mobile navigation and forms, and configure reliable transactional email for important messages.
Verify Search Console and submit the sitemap after removing the no-index setting. Test password reset, 404 pages, backups, analytics consent, and form delivery. Remove staging copies or protect them from indexing.
Verdict
Use the official host installer unless you have a reason not to. The installation takes minutes; securing account access, validating backups, configuring HTTPS, and avoiding unnecessary plugins determine whether it remains healthy.
FAQ
Is WordPress free?
The software is free and open source. Hosting, domains, premium extensions, email, and maintenance can cost money.
Can I install WordPress without a domain?
Yes on a temporary host URL or local environment, but migrate URLs carefully before launch.
Should WordPress be in the root or /blog/?
Use the root for a WordPress-powered main site. Use /blog/ only when another system owns the root or the architecture intentionally separates it.
Do I need cPanel?
No. Many hosts use custom panels, and manual/WP-CLI installation works without cPanel.
