10 WordPress settings to change right after installation

WordPress works right after installation, but it is not ready to publish. URLs still look like ?p=123, a "Hello world" post and a few sample plugins are left on the site, the time zone is probably wrong, and comments are open to everyone. Each of these causes trouble later, especially the URLs, which are hard to change after you publish.

Do these ten tasks once, in this order. It takes about half an hour. If you have not installed WordPress yet, start with installing WordPress on cPanel hosting.

1. Title, tagline, language and time zone#

Start at Settings > General. Enter the site title and tagline; many themes and SEO plugins use these two values. If you do not have a slogan, leave the tagline empty so the default "Just another WordPress site" text does not appear.

Then choose the site language and set the time zone to your own city, for example London or New York. A wrong time zone makes scheduled posts go out too early or too late. Set the date and time format here as well.

2. https and the site address#

On the same page there are two fields, "WordPress Address" and "Site Address". If an SSL certificate is active on your domain, both should start with https://. Without it, browsers show a "Not secure" warning. If you do not have a certificate yet, activate one from your host first and change these addresses afterwards, otherwise you may lock yourself out of the dashboard.

3. Fix permalinks now#

Go to Settings > Permalinks and choose the "Post name" structure. URLs like /my-article/ are more readable for people and for search engines. If you change the structure after publishing, all the old URLs break and you will need redirects. For more technical detail, see technical SEO for WordPress.

If every page returns a 404 error after you change permalinks, click "Save Changes" once more to regenerate the rewrite rules. If that does not help, the .htaccess file is not writable.

4. Choose your homepage#

Under Settings > Reading, decide whether the front page shows your latest posts or a static page. A business site usually wants a static page. Create two pages, for example "Home" and "Blog", and assign them here as the homepage and the posts page.

5. Search engine visibility#

On the same Reading page there is an option that asks search engines not to index the site. Keeping it on while you build the site is correct. But on launch day it must be turned off. Many sites sit for months with no Google traffic because someone forgot this checkbox. The reverse also applies: a test site should not be indexed.

6. Comments and spam#

Decide under Settings > Discussion. Useful options:

• Manually approve the first comment from each author.
• Allow comments only from logged-in users, if the site does not need discussion.
• Automatically close comments on old posts.
• Turn off pingback notifications, which mostly bring spam.

For a service site, it is simpler to close comments entirely. Open them later only on the specific posts or products that need a conversation.

7. Delete the sample content#

WordPress usually creates a "Hello world" post, a sample page and a sample comment. Move them all to the trash and empty the trash. Delete the default plugins you do not use too, not just deactivate them. A deactivated plugin still leaves its files on the server and can be an attack target. If you prefer the command line and have WP-CLI on your host:

wp post delete 1 2 --force
wp comment delete 1 --force
wp plugin delete hello

IDs 1 and 2 are normally the sample post and page; check with wp post list before running this.

8. Create a secure admin user#

Do not keep the username "admin", because it is the first one bots try. Create a new administrator with a username that is hard to guess, using an email address you actually read, then delete the old user and reassign its content to the new one. For day-to-day writing, use an author or editor account rather than the administrator. More details are in the WordPress security checklist.

Also change the public display name in your profile so the login username is not visible on the site.

9. Automatic updates and backups#

WordPress usually installs small core security updates by itself. For plugins and themes you can turn on automatic updates only for the ones you trust, but the more important the site, the more you should update manually and with a backup; this is explained in safe WordPress updates.

Set up a backup routine right now: files and database, plus one copy somewhere other than the hosting account. Without a tested backup, any later mistake can be the end of the site.

10. Media sizes and site email#

Under Settings > Media, adjust the thumbnail, medium and large image sizes to match your design so WordPress does not generate useless versions. Images larger than you need slow the site down; more in speeding up WordPress.

Also check the administration email address in the General settings. Security notices, password resets and important errors go there. Emails from shared hosting may land in spam; if needed, send mail through SMTP.

Quick review#

Summary#

• Set permalinks to "Post name" before publishing your first post.
• Get the title, language, time zone and https address right on day one.
• On launch day, make sure search engine indexing is not blocked.
• Close comments or require manual approval, depending on the type of site.
• Delete sample content and unused plugins instead of just deactivating them.
• Remove the admin user and set up automatic backups.