WordPress Hosting Setup Guide: From Purchase to Live Site | Pick Hosting

Last month I helped a client migrate a WooCommerce store doing $40K/month in revenue. The site went down for 11 hours because someone pointed the A record before the SSL certificate was provisioned. That’s $18,000 in lost sales from a five-minute DNS mistake.

This guide walks through every step of WordPress hosting setup—from purchasing a plan to having a fully optimized, live site—so you don’t make the same expensive errors.

Choosing the Right Hosting Plan

Before you touch a single config file, you need to pick the right plan. This matters more than most people think because migrating later means downtime, and downtime means lost money.

For a standard WordPress site getting under 50K monthly visits, shared hosting works fine. You’ll pay $3-$12/month for the intro term. But here’s what the sales page won’t tell you: that $3.99/month plan renews at $12.99-$17.99/month. Always check the renewal price.

For sites with 50K-500K monthly visits or WooCommerce stores, managed WordPress hosting or a VPS is where you should be. Plans run $25-$60/month, but you get dedicated resources, server-level caching, and staging environments.

Shared vs. Managed vs. VPS: The Real Differences

Shared hosting puts your site on a server with 200-500 other sites. Your “unlimited” bandwidth isn’t unlimited—read the fair use policy. When someone else on the server gets a traffic spike, your site slows down. Average TTFB (Time to First Byte) I’ve measured on shared plans: 450-900ms.

Managed WordPress hosting gives you WordPress-specific optimization at the server level. Providers like Kinsta and SiteGround handle updates, backups, and caching. TTFB typically ranges from 150-350ms. The tradeoff: you’re locked into WordPress only, and many plans restrict certain plugins (especially caching plugins, since they run their own).

VPS hosting through providers like Cloudways gives you a dedicated slice of server resources. You get root access, install whatever you want, and scale on demand. TTFB ranges from 100-300ms depending on your configuration. The tradeoff: you’re responsible for more of the stack.

Pick the tier that matches your current traffic, not your aspirational traffic. You can always upgrade later.

Step 1: Purchase and Initial Server Setup

Once you’ve selected a host, here’s the exact sequence for setup. I’m going to cover this for managed hosts and VPS separately, since the processes diverge.

Managed Hosting Setup (SiteGround, Kinsta, WP Engine)

Create your account and select a data center closest to your primary audience. If 70% of your traffic comes from the US East Coast, pick a US East data center. This alone can shave 50-100ms off load times.
Install WordPress through the dashboard. Every managed host has a one-click installer. During installation, you’ll set your site title, admin username, and password. Don’t use “admin” as your username—bots try this first in brute-force attacks.
Set up a staging environment before you do anything else. Kinsta gives you one by default. SiteGround includes it on GrowBig plans and above. This is where you’ll build your site before pointing DNS.
Note your temporary URL. Your host provides a temporary domain (something like site123.kinsta.cloud or yourdomain.sg-host.com). Bookmark this—you’ll use it for the entire build process before going live.

VPS Setup (Cloudways, DigitalOcean, Vultr)

Provision a server. On Cloudways, select your provider (DigitalOcean or Vultr are the best value), pick 1GB RAM minimum for a single WordPress site (2GB for WooCommerce), and choose your data center.
Deploy the WordPress application. On Cloudways this happens during server provisioning. On raw VPS providers, you’ll need to install a stack yourself—I recommend the WordOps stack (Nginx + PHP 8.2+ + MariaDB + Redis) if you’re comfortable with the command line.
Record your server IP address and SFTP credentials. You’ll need both for DNS configuration and file access.
SSH into the server and run updates:

sudo apt update && sudo apt upgrade -y

This takes 2-5 minutes and ensures you’re starting from a patched baseline.

Step 2: DNS Configuration

DNS is where most setup guides gloss over the details, and it’s where most people break things. Here’s the complete process.

Understanding the Records You Need

You need, at minimum, two DNS records:

A Record: Points your root domain (example.com) to your server’s IP address
CNAME Record: Points www.example.com to example.com (or vice versa)

If you’re using email on the same domain, you also need:

MX Records: Point to your email provider (Google Workspace, Zoho, etc.)
TXT Records: SPF and DKIM records for email authentication

Where to Edit DNS Records

Your DNS is managed wherever your nameservers point. This is usually your domain registrar (Namecheap, Google Domains, Cloudflare) unless you’ve changed nameservers to point elsewhere.

Here’s my recommendation: Move your DNS to Cloudflare regardless of your host. Cloudflare’s free DNS is faster than almost every registrar’s DNS, and it gives you a CDN and DDoS protection at no cost. The propagation on Cloudflare is also noticeably faster—usually under 5 minutes versus 15-60 minutes on registrar DNS.

The Correct Order for DNS Changes

This is critical. Follow this exact sequence:

Build your site on the temporary URL first. Get everything working—theme, plugins, content, forms, email.
Provision your SSL certificate (covered in the next section) BEFORE pointing DNS.
Lower your TTL to 300 seconds (5 minutes) on your current DNS records 24-48 hours before the switch. This means when you make the change, the old records expire from caches quickly.
Make the DNS change during low-traffic hours for your audience. For US audiences, that’s typically 2-5 AM Eastern.
Verify propagation using dig or whatsmydns.net:

dig example.com +short

This should return your new server IP. Full global propagation typically takes 15-60 minutes with a low TTL, though it can take up to 48 hours in edge cases.

After confirming everything works, raise your TTL back to 3600 (1 hour) or higher. Low TTLs increase DNS lookup times slightly.

Common DNS Mistakes That Cause Downtime

Mistake 1: Pointing DNS before SSL is ready. Your site loads over HTTP and either shows a security warning or breaks entirely if you have HSTS enabled.

Mistake 2: Forgetting to update MX records. If you move DNS management to a new provider but don’t recreate your MX records, your email stops working. I’ve seen this take down business email for 3 days because nobody noticed until Monday morning.

Mistake 3: Setting a CNAME on the root domain. You can’t technically have a CNAME on a bare domain (example.com). Some DNS providers support CNAME flattening (Cloudflare calls it a “flattened CNAME”), but if yours doesn’t, use an A record for the root and a CNAME for www.

Step 3: SSL Certificate Setup

Every site needs SSL. Period. Google penalizes HTTP sites in search rankings, and browsers flag them as “Not Secure.” Here’s how to set it up correctly.

Free SSL via Let’s Encrypt

Most managed hosts provision Let’s Encrypt certificates automatically when you add your domain. On SiteGround, it happens within the Site Tools panel. On Kinsta, it’s under the Domains section of your site dashboard. The certificate is issued within 2-15 minutes.

On a VPS, you can install Certbot and issue a certificate yourself:

sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com

Certbot will automatically modify your Nginx configuration to redirect HTTP to HTTPS and set up auto-renewal.

Free SSL via Cloudflare

If you’re using Cloudflare (which I recommended above), you have two options:

Flexible SSL: Cloudflare encrypts the connection between the visitor and Cloudflare, but the connection between Cloudflare and your server is unencrypted. This is fast to set up but insecure—don’t use it for any site handling passwords or payments.

Full (Strict) SSL: Cloudflare encrypts both connections. You need a valid certificate on your server. Install a Cloudflare Origin Certificate (free, valid for 15 years) on your server, then set SSL mode to Full (Strict). This is the correct setup.

Forcing HTTPS and Fixing Mixed Content

After SSL is active, install the WordPress plugin “Really Simple SSL” or handle it manually. Manual is better for performance (one less plugin):

In wp-config.php, add:

define('FORCE_SSL_ADMIN', true);

In your .htaccess file (Apache) or Nginx config, add an HTTP-to-HTTPS redirect.
Update WordPress URLs under Settings > General to use https://.
Run a search-and-replace on the database to change all http://example.com references to https://example.com. Use WP-CLI:

wp search-replace 'http://example.com' 'https://example.com' --all-tables

Check for mixed content warnings in Chrome DevTools (Console tab). These happen when your HTTPS page loads images, scripts, or stylesheets over HTTP. Fix each one individually.

Step 4: Essential WordPress Configuration

With DNS resolving and SSL working, it’s time to configure WordPress itself.

Security Basics

Do these immediately, before you install a single plugin:

Change the database table prefix. If you used the default wp_ prefix during installation, change it now. This blocks the most basic SQL injection attacks.

Disable file editing in the dashboard:

define('DISALLOW_FILE_EDIT', true);

Install a security plugin. Wordfence (free tier) or Solid Security (formerly iThemes Security). Configure login attempt limiting to 5 attempts per 15 minutes. This blocks brute-force attacks, which start hitting your site within hours of going live.

Set up automated backups. Your host probably includes daily backups, but don’t rely solely on them. Use UpdraftPlus to back up to a separate location (S3, Google Drive, Dropbox). Configure daily database backups and weekly full-site backups.

PHP and Server Configuration

Check which PHP version your server is running:

wp --info | grep "PHP Version"

You want PHP 8.2 or 8.3 minimum. PHP 8.2 is roughly 5-10% faster than 8.1 for WordPress workloads. Every managed host lets you switch PHP versions from their dashboard.

Set your PHP memory limit to at least 256MB for standard sites and 512MB for WooCommerce:

define('WP_MEMORY_LIMIT', '256M');

Permalink Structure

Go to Settings > Permalinks and select “Post name” (/%postname%/). This is the best structure for SEO and readability. Never use the default ?p=123 structure—it hurts search rankings and looks amateurish.

After saving, verify that a few pages load correctly. If you get 404 errors, your .htaccess file isn’t being written properly (Apache) or your Nginx config needs a try_files directive.

Step 5: Performance Optimization

Here’s where hosting setup becomes hosting optimization. A default WordPress install on decent hosting loads in about 2-3 seconds. With proper optimization, you can hit under 1 second.

Caching Configuration

If you’re on managed hosting: Don’t install a caching plugin. SiteGround, Kinsta, and WP Engine all run server-level caching that’s faster than any plugin. Installing W3 Total Cache or WP Super Cache on top of server caching causes conflicts—I’ve seen it double load times instead of halving them.

If you’re on a VPS: Install WP Rocket ($59/year, worth every penny) or use the free Nginx FastCGI cache. WP Rocket handles page caching, browser caching, and cache preloading in one plugin. For a free alternative, LiteSpeed Cache is excellent if you’re running the OpenLiteSpeed web server.

Configure your caching to exclude logged-in users, WooCommerce cart/checkout pages, and any page with personalized content.

Image Optimization

Images are typically 60-80% of a page’s total weight. Do this:

Convert all images to WebP format. WebP is 25-35% smaller than JPEG at equivalent quality. Use ShortPixel or Imagify (both integrate with WordPress).
Enable lazy loading. WordPress 5.5+ includes native lazy loading for images. Verify it’s working by checking that your <img> tags have loading="lazy" attributes.
Serve properly sized images. If your content column is 800px wide, don’t upload 3000px images and rely on CSS to scale them down. The browser still downloads the full-size file. Use WordPress’s built-in responsive images or manually resize before uploading.

I ran a test on a client site last year: proper image optimization alone dropped the page weight from 4.2MB to 1.1MB and cut load time from 3.8 seconds to 1.4 seconds. Nothing else changed.

Database Optimization

WordPress databases accumulate junk over time: post revisions, transients, spam comments, trashed posts. Clean this up:

wp transient delete --all
wp comment delete $(wp comment list --status=spam --format=ids) --force
wp post delete $(wp post list --post_status=trash --format=ids) --force

Limit post revisions in wp-config.php:

define('WP_POST_REVISIONS', 5);

For WooCommerce stores, schedule a monthly cleanup of expired transients and orphaned order metadata. WP-Optimize handles this with a scheduler.

CDN Setup

If you’re not using Cloudflare already, set up a CDN. Cloudflare’s free tier is sufficient for most sites. It caches static assets (images, CSS, JS) at edge locations worldwide, reducing load times for visitors far from your server.

Cloudflare setup takes about 10 minutes:

Add your site to Cloudflare
Update your domain’s nameservers to Cloudflare’s
Wait for propagation (usually 15-30 minutes)
Set SSL to Full (Strict)
Enable Auto Minify for JavaScript, CSS, and HTML
Turn on Brotli compression

For comparison of CDN options and hosting providers that include CDN, check our hosting comparison pages.

Core Web Vitals Targets

Google uses three Core Web Vitals metrics. Here are the targets and how to hit them:

Largest Contentful Paint (LCP) — Under 2.5 seconds

Preload your hero image: <link rel="preload" as="image" href="hero.webp">
Use server-level caching
Choose a server geographically close to your audience

Cumulative Layout Shift (CLS) — Under 0.1

Set explicit width and height attributes on all images
Avoid injecting content above the fold after page load
Reserve space for ads and embeds with CSS aspect-ratio

Interaction to Next Paint (INP) — Under 200ms

Defer non-critical JavaScript: <script defer src="...">
Break up long JavaScript tasks
Minimize third-party scripts (every chat widget, analytics tool, and social embed adds JS)

Measure these with PageSpeed Insights and Chrome’s Lighthouse. Test your actual production URL, not your staging site—CDN configuration, SSL, and server caching all affect the numbers.

Step 6: Pre-Launch Checklist

Before you announce your site to the world, run through this checklist. I use this on every deployment:

That last one catches people more often than you’d think. WordPress has a checkbox to “Discourage search engines from indexing this site.” If you checked it during development and forget to uncheck it, Google won’t index your new site.

Ongoing Maintenance

Setup isn’t done when the site goes live. Schedule these tasks:

Weekly: Check for WordPress core, theme, and plugin updates. Apply them on staging first, then push to production.

Monthly: Review backup logs. Run a database optimization. Check Google Search Console for crawl errors.

Quarterly: Audit your plugins—delete any you’re not actively using. Each plugin is a potential security vulnerability and adds load time. I recently audited a client site that had 47 plugins installed. We removed 19 that were either unused or duplicated functionality. Load time dropped by 600ms.

Annually: Review your hosting plan. Check if your renewal price makes sense or if a different provider offers better value for your current traffic level.

The entire setup process—from purchasing hosting to having a fully optimized live site—takes 4-8 hours if you follow this guide step by step. Most of that time is waiting for DNS propagation and building your actual content. The technical setup itself is maybe 90 minutes of focused work.

Start with the right host for your traffic level, follow the DNS sequence exactly, and don’t skip the optimization steps. A properly set up WordPress site is fast, secure, and low-maintenance. A poorly set up one becomes a recurring source of problems that eat your weekends. Choose wisely.

Disclosure: Some links on this page are affiliate links. We may earn a commission if you make a purchase, at no extra cost to you. This helps us keep the site running and produce quality content.