Install WordPress

In cPanel, open the WordPress installer, choose your domain, and fill in the site title, admin username, password and email. It takes about a minute.

Three choices in the installer that matter

• Do not use "admin" as the username. Every automated attack tries it first. Anything else halves the problem.
• Leave the directory blank if the site should live at the root of the domain. Putting wp there gives you yourdomain.com/wp, which you will regret.
• Choose https:// as the protocol if the certificate is already issued. Changing it afterwards means editing the database.

Four things to do straight after

1. Settings > Permalinks > Post name. The default puts a query string in every URL. Change it now, before anything is linked to.
2. Turn on automatic updates for the core and for plugins. Unpatched plugins are the most common way a WordPress site is compromised.
3. Delete what you are not using - the sample page, the sample post, and the extra themes and plugins that came bundled. Files on disk are reachable whether or not they are active.
4. Force HTTPS. Set both the WordPress Address and Site Address to the https:// form under Settings > General.

Installing it yourself instead

If you would rather do it by hand: create a database and a database user in cPanel and note the credentials, upload the WordPress files to public_html, then visit your domain and follow the setup screens. The only step people miss is granting the user all privileges on the database.

If you see a blank page

Check the PHP version is 8.x, check .htaccess exists (it is hidden by default in File Manager), and turn on WP_DEBUG in wp-config.php to see the actual error rather than a white screen.