Module 2 · 2.2

English

Nederlands English Deutsch

Installing with an installer

Module 2: Installing and setting up · Reading time: 8 minutes

Learning objective: After this lesson you can install WordPress with an installer and make informed choices about the admin account, automatic updates and backups.

Key concepts: installer (Installatron, Softaculous, WP Toolkit), admin username, password, admin email, automatic updates, rollback, backup location, My Applications

What an installer does for you

An installer is part of your hosting panel that installs software with a few clicks. With DirectAdmin this is often Installatron, with cPanel usually Softaculous, with Plesk the WP Toolkit. All three work in roughly the same way. An installer:

downloads the latest WordPress from wordpress.org;
creates a database and a database user, with a strong password;
writes wp-config.php, with new keys and salts;
runs the installation: creating tables, creating the admin account, setting the website name and language;
then keeps track of the installation in a list, so you can update, back up or clone it with one click.

What the installer does in steps 1 to 4 you can also do by hand (lesson 2.3). The advantage of the installer is mainly in step 5: updates, backups and cloning (staging, lesson 8.3) without hassle.

The choices that matter

You can leave most fields as they are. For these choices, it pays to think for a moment.

Where: domain, protocol and path

Domain: choose the real domain, not a temporary server address (lesson 2.1).
Protocol: choose https:// if you already have a certificate, and choose with or without www as you decided in lesson 2.1.
Path: leave empty for the root folder. If you enter blog, WordPress will be installed at https://example.com/blog/.

Who: the admin account

Username: not admin, administrator or your domain name. These are what break-in programs try first. The installer often fills in a random name; that's fine. The username isn't really a secret (lesson 7.3), but there's no need to make guessing any easier than it has to be.
Password: long and random. Let the installer generate one and save it in your password manager straight away.
Email: an address you actually check. WordPress sends password links, automatic update notifications and the email about a critical error (lesson 5.4) to this address. An address nobody reads means you'll miss those warnings.

Automatic updates

Most installers offer three settings:

Setting	What happens	Who it's for
Minor versions and security updates only	7.1.3 automatically becomes 7.1.4; 7.1 doesn't automatically become 7.2	The safe default for most websites
All versions, with backup	Major versions are also updated automatically	Simple websites without customisation
Not automatic	You do everything yourself	Only if someone really does it every week

You also choose whether plugins and themes are updated automatically. This is sensible for most websites: most break-ins happen through a vulnerability in a plugin for which an update was already available (lesson 7.1). Also keep an option such as Automatic Update Rollback switched on: the installer then makes a backup before the update and restores it if the update fails.

WordPress itself also has automatic updates (lesson 7.2). If you use the installer's version, they do the same job; one doesn't rule out the other.

Backups

An installer can make scheduled backups of the files and database of this one website. Two things to know:

These backups are usually stored in your own package and count towards your storage space. Leave a lot of them in place, and your package fills up.
They are stored on the same server as your website. If that server fails, or an intruder gets into your package, they may be lost too. An installer backup is handy for "quickly undo a failed update", but it is not a complete backup plan (lesson 8.1).

After the installation

After about half a minute, WordPress is ready. You'll see the installation in the installer's list (with Installatron this is called My Applications) with the address, the version, the PHP version and the number of backups.

Do the following straight away:

Sign in at https://example.com/wp-admin/ with the username and password from the installer. Many installers also have a button to sign in without a password; handy, but you'll still need the password.
Check whether the website is at the correct address (with https, with or without www).
Go through the first settings (lesson 2.4).

What an installer doesn't do

An installer installs WordPress, but doesn't finish the job. It doesn't choose a theme for you (you get the default theme), doesn't set up permalinks or privacy, and knows nothing about your email. And if you later move files by hand (for example, moving the website from a subfolder to the root folder), the installer loses track of the installation. So move a website using the installer's clone function, not with File Manager.

Did you install WordPress by hand or with another host? Many installers can import an existing installation, so you can still update and back it up with one click afterwards.

In practice: what it looks like in a panel

As an example, we use Installatron in DirectAdmin. Softaculous in cPanel and the WP Toolkit in Plesk have the same fields, with slightly different names.

Open Installatron Applications Installer under Extra Programs.
Search for WordPress and click + install this application.
Under Location, choose the domain, https://, with or without www, and leave the path empty.
Under Settings, fill in the admin username, the password, the email address and the name of your website.
Under Advanced, choose the automatic update setting, leave rollback switched on and choose whether you want automatic backups.
Click + Install.

At WebOké you can also do this from My WebOké with the Website Manager; it uses the same installer.

Summary

An installer downloads WordPress, creates the database, writes wp-config.php and then keeps track of the installation.
Choose an admin username that isn't admin, a long password and an email address you actually check.
Switch on automatic updates for minor versions, plugins and themes, with rollback.
Installer backups are stored on the same server and fill up your storage; they are not a complete backup plan.
Move a website using the clone function, not with File Manager.

Quiz

Exercise

Exercise A2.2: Checking your new installation. Install WordPress with an installer, on your domain or on a test subdomain such as test.example.com (using your own domain). Enter the address. The program checks whether the website responds with https, whether it's WordPress (the wp-json reference) and whether the REST entry point points to the same address where you access it (so not to a temporary server address or to http).

Exercise D2.2: Record your choices. Note which setting you've chosen for automatic updates of WordPress, plugins and themes, whether rollback is switched on, where the installer stores backups and how many. Explain in one sentence why you chose this way. Tick that your admin username isn't admin and that the password is stored in a password manager.

Exercise D2.2: Record your choices

You do this exercise yourself; no one checks it. Tick off what you've done and mark the exercise as done.

The administrator username is not "admin"
The password is stored in a password manager
The administrator email address is one I read
Rollback (restore after a failed update) is switched on

Which setting did you choose for automatic updates of WordPress, plugins and themes?

Where does the installer store backups, and how many?

Why did you choose this?

Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.

Cookies at WebOké

Cookie settings

Necessary

Marketing