A fresh WordPress install works out of the box — but its defaults are generic, and a few are actively bad for SEO and security. Fixing them takes fifteen minutes now and saves real pain later, once you have content and traffic that make changes risky. Here is the checklist, in the order it appears in your dashboard.
General settings
1. Site title and tagline: set a real title; delete the default “Just another WordPress site” tagline or replace it with a short description. 2. Site address and HTTPS: ensure both URLs use https:// — your SSL is free and automatic on quality hosting (see our WordPress hosting guide). 3. Timezone: set your city so scheduled posts publish when you expect. 4. Admin email: use an address you actually check.
Reading and discussion
5. Search visibility: Settings → Reading — confirm “Discourage search engines” is unchecked once you are ready to be found. 6. Homepage display: choose a static page or your latest posts, whichever fits. 7. Comment moderation: Settings → Discussion — require approval before comments appear, or disable comments if you do not want them. 8. Disable pingbacks: uncheck the pingback/trackback options; they mostly attract spam.
Permalinks — the one that matters most for SEO
9. Permalink structure: Settings → Permalinks → “Post name.” Clean URLs (yoursite.com/your-topic) are an SEO fundamental and must be set before you have content — changing them later breaks links unless you set up redirects.
Users and security
10. Delete or rename the default admin user: “admin” is the first username bots try. 11. Strong unique password + 2FA on every admin account. 12. Set your display name: so your login username is not published as the post author. These matter — our website security basics covers why login hardening stops most automated attacks.
Content and performance
13. Delete sample content: remove the “Hello World” post and sample page. 14. Set a media image size policy: and commit to WebP and correctly-sized images from day one (see our speed guide). 15. Install the lean starter plugin stack: SEO plugin, caching (LiteSpeed Cache on LiteSpeed hosting), backups, and a security hardener — four plugins, not twenty.
Then, and only then, publish
With these fifteen done, your site is secure, findable, and fast by default. Everything after — themes, content, design — builds on a clean foundation instead of fighting bad defaults. New to installing WordPress? Start with our 5-minute Softaculous install guide.
Frequently asked questions
Which WordPress setting is most important to change first?
Permalinks (set to “Post name”). It affects every URL on your site and every SEO signal, and changing it after you have content requires redirects to avoid breaking links. Set it before publishing anything.
Should I disable comments in WordPress?
If you do not plan to moderate a community, disabling comments removes a major spam and security surface. If you want engagement, keep them but require approval before they appear.
Do I need to change the default admin username?
Yes. “admin” is the first username automated attacks try. Create a new administrator account with a unique username, then delete or demote the default one.
Run WordPress on hosting tuned for it: one-click install and LiteSpeed on every UWeb Solutions plan.