WordPress on cPanel: the fastest method in 2026
Installing WordPress with Softaculous from cPanel in a few minutes, and the settings to fix right afterwards so you do not end up with a vulnerable site.
Installing WordPress by hand — downloading the archive, uploading it, creating the database, filling in `wp-config.php` — has no reason to exist any more on cPanel hosting. An installer does all of it in five minutes.
The installation
In cPanel, look for Softaculous or WordPress Manager, under Software. Choose WordPress, then Install.
The fields that matter:
The protocol. Always `https://`. If the option shows an error, your SSL certificate is not active yet — fix that first, not after.
The domain and the directory. Leave the "directory" field empty to install at the root. This is the most frequent mistake: leaving the default `wp` gives you a site at `yourdomain.com/wp`, and you will have to redo everything.
The site title. Editable later, of no importance at this stage.
The admin account. Here, though, pay attention. Change the `admin` username offered by default: it is the first name tried by every automated attack. Use a long, randomly generated password. Use an email address you actually read.
The language. Chosen here, it saves you having to translate everything afterwards.
Start the installation. Two minutes later, the site exists.
The six settings to fix immediately
The default installation leaves several things open. Before adding a single page:
- Permalinks. Settings → Permalinks → "Post name". Addresses go from `?p=123` to `/my-article`. Do this before publishing, otherwise you will have to set up redirects.
- Comments. If you do not intend to moderate, turn them off. A small-business site without moderation fills with spam in a few weeks.
- Visibility. Settings → Reading: check that "Discourage search engines from indexing this site" is unchecked. That forgotten box is the number one cause of sites invisible in Google.
- Default plugins. Delete the ones you will not keep. An inactive plugin is still a file on the server, and therefore a potential hole.
- Unused themes. Same thing: keep the active theme and one default fallback, delete the rest.
- Automatic updates. Turn them on at least for security fixes.
Backups
Softaculous can schedule backups. Turn them on, but check where they land: if they stay on the same hosting, an incident at the host takes the site and its copies with it. Plan an external destination.
After the installation
The site is empty and working. The real work starts: the theme, the page structure, the content. But the foundation is clean — and a clean foundation at the start avoids a premature redesign two years later.