SellingIt.org

Step 1: Choose a Hosting Provider

First, you need a web hosting provider that supports WordPress. Some popular options include:

Bluehost
SiteGround
DreamHost
HostGator

Step 2: Get a Domain Name

You'll also need a domain name, which can often be purchased through your hosting provider.

Step 3: Download WordPress

If your hosting provider doesn’t offer a one-click installation, you can manually download WordPress from the official WordPress website.

Step 4: Upload WordPress to Your Hosting Account

Using an FTP client (like FileZilla), upload the extracted WordPress files to the public_html (or equivalent) directory on your hosting account.

Step 5: Create a MySQL Database

Log in to your hosting control panel (like cPanel) and create a new MySQL database. Make a note of the database name, username, and password.

Step 6: Configure WordPress

Rename the wp-config-sample.php file to wp-config.php and edit it with your database details:


// ** MySQL settings ** //
/** The name of the database for WordPress */
define('DB_NAME', 'your_database_name');

/** MySQL database username */
define('DB_USER', 'your_database_user');

/** MySQL database password */
define('DB_PASSWORD', 'your_database_password');

/** MySQL hostname */
define('DB_HOST', 'localhost');

Step 7: Run the WordPress Installer

Navigate to your domain (e.g., http://yourdomain.com) in a web browser, and you should see the WordPress installation screen. Follow the prompts to complete the installation:

Select your language.
Enter your site title, username, password, and email.
Click "Install WordPress."

Step 8: Log in to WordPress

Once the installation is complete, log in to your new WordPress site by navigating to http://yourdomain.com/wp-admin and using the username and password you set during the installation.

Step 1: Database Security

Make sure your database name, username, and password are unique and secure. Update the following lines in your wp-config.php file:


define('DB_NAME', 'your_database_name');
define('DB_USER', 'your_database_user');
define('DB_PASSWORD', 'your_database_password');

Step 2: Security Keys

Generate unique keys and salts using the WordPress.org secret-key service and add them to your wp-config.php file:


define('AUTH_KEY', 'your_unique_phrase');
define('SECURE_AUTH_KEY', 'your_unique_phrase');
define('LOGGED_IN_KEY', 'your_unique_phrase');
define('NONCE_KEY', 'your_unique_phrase');
define('AUTH_SALT', 'your_unique_phrase');
define('SECURE_AUTH_SALT', 'your_unique_phrase');
define('LOGGED_IN_SALT', 'your_unique_phrase');
define('NONCE_SALT', 'your_unique_phrase');

Step 3: Database Table Prefix

Change the default table prefix from wp_ to something more unique to avoid SQL injection attacks:


$table_prefix = 'your_unique_prefix_';

Step 4: Debugging Mode

Ensure that debugging mode is disabled on a live site to prevent exposing sensitive information:


define('WP_DEBUG', false);

Step 5: File Editing

Prevent users from editing theme and plugin files through the WordPress admin panel by adding this line:


define('DISALLOW_FILE_EDIT', true);

Step 6: Auto-Save Interval and Post Revisions

Reduce the frequency of auto-saves and limit the number of post revisions to save database space:


define('AUTOSAVE_INTERVAL', 300); // seconds
define('WP_POST_REVISIONS', 3);

Step 7: WordPress Updates

Enable automatic updates for WordPress core, themes, and plugins:


define('WP_AUTO_UPDATE_CORE', true);

Step 8: SSL for Admin

Force SSL on the WordPress admin area to secure the login process:


define('FORCE_SSL_ADMIN', true);

Step 1: Protect wp-config.php

Add the following code to your .htaccess file to prevent unauthorized access to wp-config.php:


<files wp-config.php>
    order allow,deny
    deny from all
</files>

Step 2: Protect .htaccess

Add the following code to your .htaccess file to prevent unauthorized access to .htaccess itself:


<files .htaccess>
    order allow,deny
    deny from all
</files>

Step 3: Disable Directory Browsing

Add the following code to your .htaccess file to disable directory browsing:


Options -Indexes

Step 4: Disable PHP Execution in Specific Directories

Add the following code to your .htaccess file to prevent PHP execution in directories like uploads:


<Directory /path/to/your/wordpress/wp-content/uploads/>
    <Files *.php>
        deny from all
    </Files>
</Directory>

Step 5: Restrict Access to wp-admin

Add the following code to your .htaccess file to restrict access to the WordPress admin area by IP address:


<Files wp-login.php>
    order deny,allow
    Deny from all
    Allow from xx.xx.xx.xx
</Files>

Step 6: Block Bad Bots

Add the following code to your .htaccess file to block common bad bots:


<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTP_USER_AGENT} ^.*(badbot1|badbot2|badbot3).* [NC]
    RewriteRule .* - [F,L]
</IfModule>

Step 7: Enable Browser Caching

Add the following code to your .htaccess file to enable browser caching:


<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType image/jpg "access plus 1 year"
    ExpiresByType image/jpeg "access plus 1 year"
    ExpiresByType image/gif "access plus 1 year"
    ExpiresByType image/png "access plus 1 year"
    ExpiresByType text/css "access plus 1 month"
    ExpiresByType application/pdf "access plus 1 month"
    ExpiresByType text/x-javascript "access plus 1 month"
    ExpiresByType application/x-shockwave-flash "access plus 1 month"
    ExpiresByType image/x-icon "access plus 1 year"
    ExpiresDefault "access plus 2 days"
</IfModule>

Step 8: Force HTTPS

Add the following code to your .htaccess file to force HTTPS:


<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

Step 1: Accessing the Admin Panel

To access the WordPress admin panel, navigate to http://yourdomain.com/wp-admin and enter your username and password. If you have just installed WordPress, use the credentials you created during the installation process.

Step 2: General Settings

Navigate to Settings > General and configure the following settings:

Site Title: Enter the name of your website.
Tagline: Enter a brief description of your website.
WordPress Address (URL): Ensure this is correct.
Site Address (URL): Ensure this is correct.
Email Address: Enter the email address for admin purposes.
Membership: Decide if you want anyone to be able to register.
New User Default Role: Set this to Subscriber unless you have a specific reason to choose another role.
Timezone: Set your timezone.
Date Format: Choose your preferred date format.
Time Format: Choose your preferred time format.
Week Starts On: Select the day your week starts.

Click Save Changes to apply the settings.

Step 3: Configuring Permalinks

Navigate to Settings > Permalinks and choose a permalink structure. The "Post name" option is recommended for SEO-friendly URLs. Click Save Changes to apply the settings.

Step 4: Setting Up Security Plugins

Install and activate security plugins such as Wordfence, iThemes Security, or Sucuri Security. Configure the settings to:

Enable a firewall.
Set up login protection (e.g., limit login attempts).
Enable malware scanning.

Step 5: Configuring Backup Plugins

Install and activate a backup plugin like UpdraftPlus or BackupBuddy. Configure the settings to:

Schedule regular backups (daily or weekly).
Store backups in a secure location (e.g., cloud storage like Google Drive or Dropbox).

Step 6: Optimizing Performance

Install and activate performance optimization plugins such as WP Super Cache, W3 Total Cache, or WP Rocket. Configure the settings to:

Enable caching.
Minimize and combine CSS and JavaScript files.
Optimize database performance.

Step 7: Configuring Discussion Settings

Navigate to Settings > Discussion and configure the following settings:

Default Article Settings: Enable or disable options as per your needs.
Other Comment Settings: Customize settings like comment author must fill out name and email.
Email Me Whenever: Select options for receiving email notifications.
Before a Comment Appears: Choose options for comment moderation.
Comment Moderation and Comment Blacklist: Configure as needed to manage spam.

Click Save Changes to apply the settings.

Step 8: Managing Users and Roles

Navigate to Users > All Users to view all users. To add a new user, go to Users > Add New and fill in the required details. Assign appropriate roles based on the user’s responsibilities:

Administrator: Full access to all settings.
Editor: Can publish and manage posts, including those of other users.
Author: Can publish and manage their own posts.
Contributor: Can write and manage their own posts but cannot publish them.
Subscriber: Can only manage their profile.

Step 1: Keep WordPress Updated

Regularly update WordPress, themes, and plugins to their latest versions. Updates often include security patches that protect against vulnerabilities.

Step 2: Use Strong Passwords

Ensure all users have strong, unique passwords. Use a combination of uppercase and lowercase letters, numbers, and special characters. Consider using a password manager to generate and store passwords securely.

Step 3: Limit Login Attempts

Install a plugin like Limit Login Attempts Reloaded to restrict the number of login attempts per user. This helps prevent brute force attacks.


# Limit login attempts in .htaccess
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [NC,OR]
    RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$ [NC]
    RewriteRule ^(.*)$ - [R=403,L]
</IfModule>

Step 4: Use Two-Factor Authentication

Add an extra layer of security by enabling two-factor authentication (2FA) for all users. Use plugins like Google Authenticator or Two-Factor.

Step 5: Install Security Plugins

Install and configure security plugins like HaxorProof, Wordfence, iThemes Security, or Sucuri Security. These plugins provide features like firewall protection, malware scanning, and login security.

Step 6: Regular Backups

Regularly back up your website to ensure you can restore it in case of a security breach. Use plugins like UpdraftPlus or BackupBuddy to schedule automatic backups.

Step 7: Secure Hosting Environment

Select a reputable hosting provider that offers robust security features, such as SSL certificates, firewalls, and regular malware scanning.

Step 8: Secure File Permissions

Ensure your file permissions are correctly set to prevent unauthorized access. Typically, set directories to 755 and files to 644.


# Set directory permissions
find /path/to/your/wordpress/ -type d -exec chmod 755 {} \;

# Set file permissions
find /path/to/your/wordpress/ -type f -exec chmod 644 {} \;

Step 9: Disable File Editing

Disable file editing within the WordPress dashboard to prevent unauthorized changes to your files. Add the following line to your wp-config.php file:


define('DISALLOW_FILE_EDIT', true);

Step 10: Monitor and Scan for Malware

Regularly scan your website for malware using security plugins. Monitor your website for any unusual activity and take immediate action if any issues are detected.

Step 1: White Screen of Death

If you encounter a white screen with no error message, it’s often caused by exhausted memory or a plugin/theme conflict.

Increase Memory Limit: Add the following line to your wp-config.php file:
```
define('WP_MEMORY_LIMIT', '64M');
```
Disable Plugins: Disable all plugins by renaming the plugins folder in wp-content to plugins_old. Then, rename it back and activate plugins one by one to identify the problematic one.
Switch to a Default Theme: Temporarily switch to a default WordPress theme like Twenty Twenty-One to check if the issue is theme-related.

Step 2: Internal Server Error

An internal server error is usually caused by plugin conflicts, corrupted .htaccess file, or exhausted PHP memory limit.

Check .htaccess File: Rename your .htaccess file to .htaccess_old and refresh your site. If it works, go to Settings > Permalinks and click Save to generate a new .htaccess file.
Increase PHP Memory Limit: Add the following line to your wp-config.php file:
```
define('WP_MEMORY_LIMIT', '64M');
```
Deactivate Plugins: Deactivate all plugins and reactivate them one by one to find the cause.

Step 3: Error Establishing a Database Connection

This error occurs when WordPress cannot connect to the database. It may be due to incorrect database credentials or a corrupted database.

Check Database Credentials: Verify the database name, username, password, and host in your wp-config.php file.


define('DB_NAME', 'your_database_name');
define('DB_USER', 'your_database_user');
define('DB_PASSWORD', 'your_database_password');
define('DB_HOST', 'localhost');

Repair Database: Add the following line to your wp-config.php file and navigate to http://yourdomain.com/wp-admin/maint/repair.php:
```
define('WP_ALLOW_REPAIR', true);
```
Remove the line after repairing the database.

Step 4: 404 Error

A 404 error indicates that the page cannot be found. This often occurs due to issues with permalinks.

Reset Permalinks: Go to Settings > Permalinks and click Save Changes.

Check .htaccess File: Ensure your .htaccess file has the correct rules for WordPress:


# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

Step 5: Memory Exhausted Error

This error occurs when WordPress exhausts the allocated memory.

Increase Memory Limit: Add the following line to your wp-config.php file:
```
define('WP_MEMORY_LIMIT', '64M');
```
Deactivate Plugins: Deactivate all plugins and reactivate them one by one to identify the cause.

Step 6: Issues with Themes and Plugins

Themes and plugins can cause conflicts and errors.

Deactivate All Plugins: Rename the plugins folder to plugins_old and then reactivate plugins one by one.
Switch Themes: Temporarily switch to a default WordPress theme like Twenty Twenty-One.

Step 7: Locked Out of Admin Panel

If you can’t access the admin panel, you can regain access by resetting your password or disabling plugins.

Reset Password: Use the "Lost your password?" link on the login page or reset the password via phpMyAdmin.
Deactivate Plugins: Rename the plugins folder to plugins_old.

Step 8: Slow Loading Website

A slow website can be due to various factors, including hosting, plugins, and themes.

Optimize Images: Use a plugin like Smush to optimize images.
Use Caching: Install a caching plugin like WP Super Cache or W3 Total Cache.
Optimize Database: Use a plugin like WP-Optimize to clean up your database.

Step 9: Image Upload Issues

If you encounter errors when uploading images, it could be due to incorrect file permissions or exceeding the upload limit.

Check File Permissions: Ensure the wp-content/uploads folder has 755 permissions.


# Set directory permissions
find /path/to/your/wordpress/wp-content/uploads/ -type d -exec chmod 755 {} \;

Increase Upload Limit: Add the following lines to your .htaccess file:


php_value upload_max_filesize 64M
php_value post_max_size 64M
php_value max_execution_time 300
php_value max_input_time 300

Step 10: Stuck in Maintenance Mode

If your site is stuck in maintenance mode, delete the .maintenance file in your WordPress root directory.


# Remove maintenance file
rm /path/to/your/wordpress/.maintenance

Step by Step Guides

Install WordPress