Installation & Initial Setup

WordPress Fundamentals

Chapter 2 · Installation & Initial Setup

WordPress Fundamentals 1 named the LAMP stack WordPress runs on without asking you to build any of it yourself. This chapter is the one moment in this course where that stack becomes directly visible — not because you need to build it, but because knowing what's happening underneath makes every setting in the next few chapters make sense rather than feel arbitrary.

Hosting Requirements

Any host advertising WordPress support needs to provide, at minimum: a current PHP version, a MySQL or MariaDB database, and enough disk space for WordPress core plus whatever media and plugins accumulate over time. HTTPS support is effectively mandatory today, not optional — covered in full technical depth in HTTPS/TLS Fundamentals, and specifically for a Debian-hosted setup, in Setting Up a Web Server on Debian's own Let's Encrypt chapter.

Hosting type	What you get
Shared hosting	Cheapest, easiest to start with; resources shared with other sites on the same server
Managed WordPress hosting	A host specifically tuned for WordPress — automatic updates, built-in caching, staging environments
A VPS you administer yourself	Full control, the most work — effectively building the exact stack Setting Up a Web Server on Debian covers from scratch

One-Click Installers — The Common Path

Most hosting providers offer a one-click WordPress installer (Softaculous is a common example) built into their own control panel. It handles creating the MySQL database, downloading WordPress, and running the setup wizard automatically — for the overwhelming majority of site owners, this is genuinely the right choice, not a shortcut to feel guilty about.

The Manual Install — What Actually Happens Underneath

Understanding the manual process is worth doing once, even if you'll use a one-click installer afterward — it demystifies exactly what that installer is automating for you.

Create a MySQL database and a database user with privileges on it — the same fundamental operation covered in MySQL Installation & Administration
Download the WordPress software and upload its files to your hosting
Visit the site in a browser — WordPress detects there's no configuration yet and launches its own famous "five-minute install" wizard
Enter the database connection details when prompted, then choose a site title, an admin username, and an admin password

"Five-minute install" isn't marketing exaggeration

This nickname is decades old at this point and still broadly accurate — the actual installation wizard genuinely is that fast. Almost everything covered in the rest of this course happens after this point, inside the dashboard, not during installation itself.

wp-config.php At a Glance

This single file, generated during installation, is WordPress's own core configuration — the first file WordPress reads on every single page load, before anything else happens.

define( 'DB_NAME', 'wordpress_db' ); define( 'DB_USER', 'wp_user' ); define( 'DB_PASSWORD', 'a-strong-password' ); define( 'DB_HOST', 'localhost' ); $table_prefix = 'wp_'; define( 'WP_DEBUG', false );

DB_NAME / DB_USER / DB_PASSWORD / DB_HOST — the database connection details, the exact information a manual install prompts for
Authentication unique keys and salts — long random strings (generated automatically, not shown above) that make WordPress's own login cookies harder to forge
$table_prefix — every WordPress database table starts with this prefix (wp_ by default); changing it away from the default is a small, genuine hardening step, revisited properly in WordPress Intermediate/Advanced's own security chapter
WP_DEBUG — toggles PHP error/warning output; left true accidentally on a live site can leak technical details to visitors, so this should always be false once a site is genuinely live

An Initial Security Checklist

A few minutes now, done once

A strong, unique admin password — this is the single highest-value step, and WordPress's own install wizard will suggest one
A non-obvious admin username — never literally admin, which is the first guess in any automated attack; the real reasoning behind this is covered fully once WordPress Fundamentals 8 introduces the role hierarchy
HTTPS enabled from day one — per HTTPS/TLS Fundamentals, this protects login credentials and all site traffic in transit, not just the checkout page of an online store
A non-default table prefix, if installing manually — a small, genuine layer of obscurity against automated attacks that target the default wp_ prefix specifically

This is the beginner-facing version of a much deeper conversation — real, code-level security (nonce verification, capability checks, output escaping) is covered in full in WordPress Intermediate/Advanced's own dedicated Security Hardening chapter.

Hands-On Exercises

Exercise 1

Explain what a one-click installer is actually doing on your behalf, using the manual-install steps from this chapter as your reference.

📄 View solution

Exercise 2

A site has been live for months and a developer notices WP_DEBUG is still set to true. Explain why this is a real problem, not just a stylistic oversight.

📄 View solution

Exercise 3

Explain why an admin username of "admin" is considered a security weakness, connecting your answer to what an automated attack is actually doing.

📄 View solution

Chapter 2 Quick Reference

Hosting needs: current PHP, MySQL/MariaDB, disk space, and HTTPS — effectively mandatory today
One-click installers automate database creation, file upload, and the setup wizard — the right choice for most site owners
Manual install: create the database → upload files → run the five-minute install wizard
wp-config.php — the core config file: database credentials, auth keys/salts, table prefix, WP_DEBUG
Initial security: a strong admin password, a non-"admin" username, HTTPS from day one, a non-default table prefix
Next chapter: The Dashboard & Core Concepts