A new WordPress site: the first-day steps, from domain to security

A WordPress site is most exposed in its first days. SSL certificates are published in public logs (Certificate Transparency), and bots that watch those logs reach a new domain within hours of its certificate being issued. If the install page is still open or the admin password is easy to guess, they try it before you do.

The order below works on any host. Where it applies, we also say how it's done in the AYT panel.

1. The domain and DNS

From the registrar you need the domain registered in your name or your company's, and access to its DNS. Check the contact details in your registrar account. If an agency bought the domain on its own account, ask for the transfer now, while you're on good terms.

Then point the domain at your hosting, in one of two ways:

• change the nameservers to your host's and manage DNS from its panel;
• keep DNS where it is, at the registrar or in Cloudflare, and change only the domain's A record and the one for www.

Both work at AYT. If your DNS is already in Cloudflare, you connect the account with an API token and edit the records from our panel.

The change usually shows up within an hour, but some networks remember the old address for a day or two. If the domain already has mailboxes in use, move email separately, once the site works.

2. Installing WordPress

Install WordPress from the panel instead of uploading the archive by hand. The installer creates the database with its own user and a long password and writes the security keys into wp-config.php. In WordPress Toolkit at AYT it's one form: the domain, the site title, the admin account and the language.

A few choices in that form stay with you for a long time. The admin username can be anything except "admin" or the domain name, because bots try those first. Generate the password, at least 16 characters, and keep it in a password manager. The admin email has to be one you read: password resets and WordPress warnings go there.

3. HTTPS

Once DNS points at the server, the Let's Encrypt certificate is issued and renewed without you doing anything. Then check two things.

In Settings → General, both addresses (WordPress Address and Site Address) start with https://. If you change them after adding content, images can stay in the database with http://, and browsers block them as "mixed content".

Pick one form of the address, with www or without, and redirect the other to it. Google treats them as two different sites. In the AYT panel you set the redirect and the HTTP to HTTPS switch from the domain's page.

4. Backups

On AYT's paid plans we copy the files and the database every night to another server. The first copy is made the night after the install. Until then you have no copy, so if you want to try ten plugins on day one, try them on staging, a copy of the site on a subdomain, and put on the live site only what you keep.

Also check where your host keeps the copies. A copy on the same server disappears with the server.

5. Basic security

Part of it is the server's job. At AYT, the ModSecurity firewall stops known attacks on WordPress, CrowdSec blocks addresses that keep trying passwords, and PHP files can't run from wp-content/uploads. The rest is in wp-admin:

• Turn on two-factor authentication for administrators, for example with the Two Factor plugin.
• Switch off the file editor in wp-admin. The security check in WordPress Toolkit does it in one click, and it also turns off XML-RPC, which you don't need unless you use the WordPress mobile app or Jetpack.
• Delete the themes and plugins you don't use. A deactivated plugin is still on disk, along with its vulnerabilities.
• Give each person their own account with the role they need. Someone who writes posts needs the Author or Editor role.

6. Before you announce the site

Send a test message from the contact form to a Gmail address and check that it lands in the inbox. Mail sent from your domain needs SPF and DKIM to stay out of spam; in the AYT panel they're set up for you.

In Settings → Reading, untick "Discourage search engines from indexing this site". The box often stays ticked from when the site was being built, and a month later the owner wonders why it isn't on Google.

If you use Google Analytics, ad pixels or forms, you need a privacy policy and a cookie policy. Open the site on a phone too, on mobile data, and not only on the office Wi-Fi.

On paid plans, monitoring checks the site every minute and emails you if it stops responding, so you hear about an outage before your customers do.

If the site already lives with another provider, you don't have to start over. We move it for free, with files, databases and email, on any of the paid plans.