How to Make a Website Using WordPress

WordPress runs about four in ten websites, and you do not need to write code to use it. In one afternoon you can go from an empty domain to a working site with pages, a menu and a contact form.

This guide covers the whole build, including the five settings people skip on day one and then spend months fixing.

What it costs

A real site starts for the price of a domain and one month of hosting. Buy the paid theme later, once the site is doing something.

Step 1: Domain and hosting

Pick a domain someone can spell after hearing it once. Short, no hyphens, no numbers. .com if you can get it.

For hosting, ignore the marketing and check four things:

• PHP 8.1 or newer — older versions are slower and no longer get security fixes
• Free SSL included
• Daily backups — the day you need one, you will need it badly
• A one-click WordPress installer — Softaculous or WordPress Toolkit

More on choosing in what actually matters in cheap web hosting. If you would rather run your own server, see how to install WordPress on an Ubuntu server.

Step 2: Install WordPress

In cPanel, open Softaculous or WordPress Toolkit and choose WordPress. Fill in:

• Protocol: https:// — not http
• Directory: leave it empty so the site lives at your domain root, not at /wp/
• Admin username: not "admin". Every bot on the internet tries that name first.
• Admin password: long and random
• Admin email: one you actually read — password resets go there

Installation takes about a minute. You then log in at yourdomain.com/wp-admin.

Step 3: The five settings to fix immediately

Do these now. Each one is painful to change later.

1. Permalinks

Settings → Permalinks → Post name.

The default gives you yoursite.com/?p=123, which is bad for readers and worse for Google. Change it before you publish anything — changing it after means every existing URL breaks.

2. Site address

Settings → General. Both the WordPress Address and Site Address must start with https:// and must agree on www or no www. Mismatched values cause redirect loops.

3. Delete the sample content

The "Hello World" post, the Sample Page and the default comment. They make a site look abandoned before it launches.

4. Discourage search engines — temporarily

Settings → Reading has a checkbox to discourage indexing. Tick it while you build.

Then untick it on launch day. Forgetting this is one of the most common reasons a new site never appears in Google, and people spend months blaming their SEO plugin.

5. Set the timezone

Settings → General → Timezone. Choose Karachi. Otherwise scheduled posts publish at the wrong time and comment timestamps look wrong.

Step 4: Choose a theme

The theme controls how the site looks. Appearance → Themes → Add New.

Good free options: Astra (fast and flexible), Kadence (good-looking defaults), GeneratePress (very light), Twenty Twenty-Four (made by WordPress itself).

Judge a theme on three things, and ignore the demo screenshots:

1. Does it look right on a phone? Most of your visitors are on one.
2. How fast is the demo? Run it through PageSpeed Insights.
3. When was it last updated? Anything untouched for over a year is a risk.

Avoid free themes from random websites. Nulled and pirated themes very commonly contain hidden back doors or spam links. Install only from the WordPress theme directory or a paid developer you can identify.

Step 5: Build the pages

Pages → Add New. Most sites need four to start:

• Home — what you do, who it is for, one clear next step
• About — who is behind this. Visitors check, and so does Google.
• Services or Products
• Contact — form, email, phone, and a real address if you have one

Then set the front page: Settings → Reading → A static page, and pick Home. Without this, WordPress shows your blog posts on the front page, which is right for a blog and wrong for a business site.

The block editor in one minute

Everything in WordPress is now a block. Press / in the editor and type what you want — /image, /heading, /button, /columns. That single shortcut removes most of the learning curve.

Step 6: The menu

Appearance → Menus. Create one, add your pages, set it as the primary menu.

Keep it to five or six items. Long menus get ignored, and on a phone they wrap into a mess.

Step 7: Plugins — fewer than you think

Plugins are where most WordPress sites go wrong. Each one adds code, slows the site and adds something else to keep updated. Install what you need and nothing else.

That is six, and it covers almost every ordinary site. If you find yourself at twenty plugins, something has gone wrong.

Two SEO plugins at once will fight each other and output duplicate meta tags. Pick one: Yoast or All in One SEO.

Step 8: Security basics

WordPress is targeted constantly precisely because it is popular. Four things stop almost all of it:

1. Never use "admin" as the username. If you already did, create a new admin account, log in as that, and delete the old one.
2. Keep everything updated — core, themes, plugins. Outdated plugins are the number one way WordPress sites get hacked.
3. Delete what you do not use. An inactive plugin can still be exploited. Deactivating is not enough — delete it.
4. Turn on automatic backups and check once that a restore actually works. An untested backup is a guess.

Step 9: SSL

Most hosts now issue a free certificate from cPanel. If yours has not, follow how to install a free SSL certificate on a WordPress site.

Once it is active, confirm the padlock shows with no warning triangle. A triangle means mixed content — something on the page is still loading over HTTP.

Step 10: Make it fast

WordPress is not slow by nature; it becomes slow through big images and too many plugins. Three fixes cover most of it:

1. Compress images and serve WebP. A phone photo is often 4 MB. It should be under 200 KB.
2. Add a caching plugin.
3. Put Cloudflare in front — the free tier is enough.

Full walkthrough: make WordPress faster with W3 Total Cache and Cloudflare.

Launch checklist

• Untick "Discourage search engines" in Settings → Reading
• Send yourself a message through the contact form and confirm it arrives
• Open every page on a phone
• Check the padlock on every page
• Submit the site to Google Search Console and submit the sitemap
• Run one backup and confirm the file downloads

Common problems

"Error establishing a database connection"

The credentials in wp-config.php are wrong, or the database server is down. Check the database name, user and password — and remember cPanel prefixes them with your account name.

The white screen of death

A PHP fatal error, usually from a plugin or theme. Rename the plugin folder over FTP to force everything off, then re-enable one at a time. See the whitelabel error guide.

Pages show 404 after changing permalinks

Go to Settings → Permalinks and press Save without changing anything. That rewrites the .htaccess rules. If it persists, the server needs AllowOverride All.

I am locked out of wp-admin

Use the password reset link. If email is broken, reset the password directly in phpMyAdmin — edit the wp_users table and set the password field with the MD5 function.

The site is slow

Check image sizes first; it is images nine times out of ten. Then plugin count. Then hosting.

Is WordPress the right choice?

Honestly, not always.

Choose WordPress if you will add content regularly, want a familiar admin screen, and need plugins for forms, shops or memberships.

Choose something simpler if the site is five pages that never change. Plain HTML loads faster, costs less to host and has nothing to update. WordPress carries a lot of machinery you would never use.

Where to go next

• Set up SEO properly
• Speed the site up
• Add a shop with WooCommerce
• Move the site to another host