How to Install WordPress on cPanel: Domain, SSL and First Settings

What do you need to install WordPress on cPanel?

You need three things: a web hosting plan with cPanel, a domain you own, and that domain pointed at the hosting. WordPress runs on PHP and stores its content in a MySQL or MariaDB database, and cPanel provides both, so there is no server to build. WordPress.org recommends a current PHP release (at the moment PHP 8.3 or newer), so if the PHP selector in cPanel is set to an old version, raise it before you install.

There are two ways to install. The automatic installer in your panel downloads the files, creates the database and writes wp-config.php for you. A manual install takes more steps but shows you where everything lives, and it is the fallback when no installer is available or you want an unusual layout. Both end with the same WordPress.

• A web hosting plan with cPanel access
• A registered domain and access to its DNS settings
• A current PHP version (check the PHP selector in cPanel)
• A unique admin username and a long password
• An email address you actually read, for site notifications

How do you point a domain at hosting: nameservers or an A record?

Changing nameservers hands all of your DNS to the hosting provider. You enter the hosting's nameservers at your registrar, and from then on you manage A, MX and TXT records in cPanel's Zone Editor. If your email will live on the same hosting, this is the option with the fewest moving parts.

The A record method leaves DNS where it is and only points the root domain and www at the hosting's IP address. It makes sense when your DNS sits with a service like Cloudflare or your email is with another provider. Either way, changes can take anywhere from minutes to a few hours to propagate. Waiting until the domain resolves to the new server before installing WordPress makes the SSL step much smoother. When you buy the domain and hosting together from TheCrewHost, the nameservers are usually set correctly from the start.

How do you install WordPress with Softaculous or WP Toolkit?

Which installer you see depends on the host. The two common ones are Softaculous and cPanel's own WP Toolkit, and some panels have both. They work the same way: pick WordPress, choose where to install it, enter the site and admin details, and the installer does the rest. Typing WordPress into the search box on the cPanel home screen is the quickest way to find it.

A few fields matter. Choose the https:// protocol; if SSL is not ready yet, waiting for the certificate is cleaner than changing the address later. Pick either the www or the non-www address and stick with it. Leave the directory field empty to install at the domain root; typing blog there puts the site at yourdomain.com/blog. Set the language you want, and do not use admin as the username.

Installers usually offer extras such as automatic updates, backups and a custom table prefix. Leaving minor and security updates on is sensible. When the install finishes you get the dashboard address, yourdomain.com/wp-admin, so save the login in a password manager.

How do you set up SSL and force HTTPS?

Free SSL on cPanel normally comes from AutoSSL. As soon as the domain resolves to the server, AutoSSL requests a certificate from the provider your host has configured (Let's Encrypt, for example) and renews it before it expires. You can see the status on the SSL/TLS Status page, and run a check manually there after you have just pointed a domain. When no certificate appears, the usual reasons are DNS that does not point at the server yet or a missing www record.

Once the certificate is active, send every visitor to HTTPS. Many cPanel versions have a Force HTTPS Redirect toggle per domain on the Domains page; turning it on redirects all http requests. If you do not have it, a redirect rule in .htaccess does the same job. In WordPress, make sure the WordPress Address and Site Address fields under Settings > General both start with https://.

If you built the site over http first, old links and images inside your content can trigger mixed content warnings. Fix them with a search-and-replace tool that swaps http for https in the database, and take a backup before you run it.

How do you install WordPress manually on cPanel?

Start in MySQL Databases: create a database and a user, then add the user to the database with ALL PRIVILEGES. cPanel prefixes both names with your account name, so a database you call wp is really accountname_wp. Those full names are what go into wp-config.php, and getting them wrong is the most common manual-install mistake.

Next, download the latest WordPress zip from WordPress.org, upload it to public_html with File Manager and extract it there. The files land in a wordpress subfolder, so move them up one level if you want the site at the root. Open your domain in a browser and the setup wizard asks for the database name, username, password and host. On cPanel the host is almost always localhost.

The wizard writes wp-config.php for you. If file permissions block it, copy wp-config-sample.php to wp-config.php and fill in DB_NAME, DB_USER, DB_PASSWORD and DB_HOST by hand. Replace the authentication keys and salts in the same file with fresh values from the WordPress.org secret key generator.

Which settings should you change right after installing?

Go to Settings > Permalinks and choose Post name. The default ?p=123 style addresses are hard to read and look poor when shared, and changing the structure before you publish saves you from broken links later. Then open Settings > General, set the site language (Türkçe if your audience is in Türkiye), pick your city's time zone (Istanbul for Türkiye) and adjust the date format.

A fresh install ships with a sample post, a sample page and a sample comment. Delete them, and remove default themes and plugins you will not use: an inactive plugin that never gets updated can still be a weakness. If the site is not ready for the public, Settings > Reading has an option to discourage search engines; switch it off again when you launch.

• Permalinks: Post name
• Site language and time zone matching your audience
• Delete the sample post, page and comment
• Remove unused themes and plugins
• Confirm the administration email address is correct

How do you keep a WordPress site secure?

Most hacked WordPress sites fall to weak passwords and outdated plugins rather than clever attacks. Give the admin account a username nobody will guess and a long, unique password, and give people who only write content the Editor or Author role instead of Administrator. WordPress core has no built-in two-factor login, but a plugin such as Two Factor adds app-based codes or security keys in a few minutes.

Install a plugin that limits failed login attempts to slow down brute-force bots. Apply core, theme and plugin updates promptly, and when choosing plugins check the last update date and active install count; skip anything abandoned for years. Only install plugins from the WordPress.org directory or developers you trust, because pirated copies of premium plugins regularly carry malware.

How should you set up backups and caching?

A WordPress backup has two parts: the files (especially wp-content and wp-config.php) and the database. Use the backup tool your host provides in cPanel if there is one, but do not rely on a single copy; a plugin such as UpdraftPlus can also send backups to external storage. Take a manual backup before major updates or plugin changes, and test a restore now and then.

Caching serves ready-made HTML instead of having PHP rebuild every page on every visit. If the server runs LiteSpeed, the LiteSpeed Cache plugin gives the best results; on Apache or Nginx, plugins like WP Super Cache or W3 Total Cache do the job. Run only one caching plugin at a time, since two will fight each other. Resizing images before upload and using modern formats such as WebP often helps as much as caching does.

How do you fix common WordPress errors?

Most errors trace back to the last thing you changed: a new plugin, a theme update or a PHP version switch. Since WordPress 5.2, a fatal error triggers a recovery mode email to the admin address, and its link lets you disable the plugin that broke things. If the email never arrives, renaming the suspect plugin's folder under wp-content/plugins in File Manager has the same effect.

To see the real cause, set WP_DEBUG and WP_DEBUG_LOG to true in wp-config.php for a while; errors are written to wp-content/debug.log. Turn them off again afterwards, because visible error output can reveal server paths to visitors.

Install WordPress on cPanel in 8 steps

1. 1

   Point the domain

   Change the nameservers at your registrar to the hosting's nameservers, or point A records for the root domain and www at the hosting IP, then wait for propagation.

2. 2

   Check the PHP version

   Make sure a current PHP version is selected in cPanel's PHP selector.

3. 3

   Get SSL working

   Confirm on the SSL/TLS Status page that AutoSSL has issued certificates for the root domain and www, and run a manual check if needed.

4. 4

   Open the installer

   Find Softaculous or WP Toolkit in cPanel, choose WordPress, select https:// and leave the directory empty for a root install.

5. 5

   Enter site and admin details

   Add the site name, a username other than admin, a long password, the right email and your language, then start the install.

6. 6

   Force HTTPS

   Turn on Force HTTPS Redirect on the Domains page or add an .htaccess redirect, and check that both addresses in Settings > General use https.

7. 7

   Apply first settings

   Set permalinks to Post name, pick your time zone, and delete the sample content and unused themes.

8. 8

   Add security, backups and caching

   Install a two-factor and a login-limiting plugin, schedule backups to external storage and add a single caching plugin.

Frequently Asked Questions