The complete guide to starting a new website

abram

·

A business website you own, on a server you control, built with the editor WordPress already ships. Nine steps, one weekend, and the real costs at the end.

This is the path we use for every site we build, including this one. It skips the page builder, the security suite, and the forty-plugin install. What’s left is small enough to understand and cheap enough to keep. If you can follow a recipe, you can follow this.

Before you start

  • A domain. Register it with a plain registrar, not your host: you want to be able to leave either one without the other noticing. Canadian business? A .ca tells people where you are and who you serve. Budget ~$15/year.
  • Email somewhere else. Your web server should never be your mail server. Use a mail provider (Google Workspace, Fastmail, Proton, your registrar’s mail) and keep it off the box you’re about to build.
  • A password manager. You’re about to create four or five accounts. Every one gets a unique generated password, and every one that offers two-factor gets it turned on.
  • Three hours, split across two days. The second day is for content. Don’t try to do it all in one sitting.

Get hosting you control

“Self-hosted” means WordPress runs on a server you rent by the month, not on a platform that rents you a slice of theirs. The difference shows up the first time you want to move hosts, export everything, or just look at your own files.

Our pick is a small cloud server plus a management layer:

  1. Create a DigitalOcean account and note that they have a Toronto region. Pick it. Your data stays in Canada, and Canadian visitors get the shortest trip.
  2. Create a SpinupWP account. SpinupWP is a control panel for servers you own. It connects to DigitalOcean with an API token, builds the server, installs nginx, PHP, MySQL and wp-cli, sets up page caching, firewalls, backups and Let’s Encrypt, and stays out of your way afterwards.
  3. Provision a server from inside SpinupWP: 1 vCPU / 2 GB RAM is plenty for a business site with tens of thousands of visits a month. Choose Ubuntu LTS, Toronto, and add your SSH key when asked (SpinupWP will walk you through generating one).
  4. Add a site in SpinupWP: your domain, a fresh database, PHP 8.3, page caching on, HTTPS on. Tick “install WordPress”. That’s the install. We’ll finish it below.

If you truly won’t touch a server, a managed WordPress host is fine, but pick one that gives you SSH access and wp-cli, and confirm where its servers physically are. The rest of this guide still applies; you just skip the provisioning.

* The server is about $8–12/month. SpinupWP is a separate small subscription. Together they still undercut most “managed WordPress” plans, and the server is yours.

Point the domain through Cloudflare

Put Cloudflare’s free plan between your domain and your server from day one. It gives you DNS, HTTPS, a firewall, and brute-force protection before you’ve installed a single plugin. We wrote the full setup separately: Cloudflare for WordPress: security and speed. The short version for now:

  1. Add your domain to Cloudflare and change the nameservers at your registrar.
  2. Create an A record for @ and one for www, both pointing at your server’s IP. Leave them DNS only (grey cloud) for the moment; proxying comes after the certificate is valid.
  3. Wait for DNS to resolve (minutes, occasionally an hour), then let SpinupWP issue the Let’s Encrypt certificate for the site.

Finish the WordPress install

Visit your domain. WordPress asks for a site title, a username, a password, and an email. Three rules:

  • The username is not admin. Bots try that one first, every hour, forever.
  • The password comes from your password manager.
  • Tick “Discourage search engines from indexing this site”. You’ll untick it at launch. Nobody needs to find an empty site.

Then five settings before anything else, all under Settings in the sidebar:

  1. General: timezone (Toronto, not UTC), tagline (a real sentence, or blank), and confirm both URLs start with https://.
  2. Permalinks: choose Post name. Your URLs become /about/ instead of /?p=12. Do this before you write anything, because changing it later means redirects.
  3. Discussion: untick “Allow people to submit comments on new posts” unless you genuinely want comments. Most business sites don’t, and every open comment form is a spam inbox.
  4. Media: nothing to change, but remember the number 2000. No image you upload needs to be wider than 2000 pixels.
  5. Plugins: delete Hello Dolly and Akismet. You’ll add what you need in the plugins section.

If you’d rather do this from a terminal, SSH in and wp-cli does the same in four lines:

wp option update timezone_string 'America/Toronto'
wp rewrite structure '/%postname%/' && wp rewrite flush
wp option update default_comment_status closed
wp plugin delete hello akismet

Install a block theme

Modern WordPress has two kinds of themes. Classic themes give you a settings screen and expect a page builder plugin to do the real layout. Block themes let you edit everything (header, footer, page templates, colours, fonts) in the same editor you write pages in. Nothing extra to license, update, or get locked into.

We use Ollie. It’s free on WordPress.org, it ships a library of well-designed patterns (pre-built sections you drop into a page), and its design is controlled by tokens: change the brand colour once and every button follows.

  1. Appearance → Themes → Add New, search “Ollie”, install, activate.
  2. Delete the default Twenty-Something themes. Every theme on disk is code that needs updating, active or not. Keep one.
  3. Appearance → Editor → Styles. Set your brand colour, your text colour, and your two fonts (one for headings, one for body; that’s enough). Ollie bundles its fonts locally; if you add one, upload it rather than linking to Google Fonts so visitors aren’t sent to a third party to render your page.
  4. Editor → Patterns → Header. Add your logo (an SVG or a PNG around 400 px wide), trim the navigation to the pages you’ll actually have.
  5. Editor → Patterns → Footer. Business name, city, a contact link, a privacy link. Delete anything the pattern included that you don’t mean.

Want changes that survive theme updates? Make a child theme: a folder with a style.css header that names Ollie as the parent, plus your own theme.json for colour and font tokens and a patterns/ folder for your sections. That’s exactly how this site is built. If you’re not editing code, skip this: the Styles screen covers most businesses.

* If you’ve spent years in a page builder, budget an afternoon to unlearn it. The block editor stops feeling strange faster than you’d think.

Add the six plugins

Every plugin is code a stranger wrote, running on your server, that you now have to keep updated. So each one has to earn its place. This is the full list; reasons and caveats are on the stack page:

  • The SEO Framework: titles, descriptions, sitemap, social cards. Install, activate, then open each page’s SEO box as you write and fill in the title and description by hand. No wizard, no ads.
  • WPForms: one contact form. Build it with Name, Email, Message; turn on the built-in anti-spam token (no puzzles for humans). Install only the addons a form actually uses.
  • Postmark: delivers the email WordPress sends (form notifications, password resets). Sign up, verify your domain with the two DNS records it gives you, paste the server token into the plugin, send the test message. Your server shouldn’t send its own mail; it lands in spam.
  • Fathom Analytics: visitor counts without cookies or a consent banner. Create a site in Fathom, paste the site ID into the plugin. Done.
  • ShortPixel: compresses every image you upload and serves modern formats. Free tier covers a small site’s launch; then pennies per image.
  • Two-Factor: the lean two-factor plugin maintained by the WordPress core team. Turn it on for every administrator in Users → Profile. Use an authenticator app, save the backup codes in your password manager.

What’s deliberately missing: a page builder (the block editor is the builder), a caching plugin (SpinupWP caches at the server, where it belongs), an analytics suite, and a security suite. Brute-force protection happens at the edge, in the Cloudflare setup. If you’re on shared hosting with no edge control, add Fuse Limit Logins, and that’s still only seven.

Harden the install

Open wp-config.php over SSH or SFTP and add three lines above the “That’s all, stop editing” comment:

define( 'DISALLOW_FILE_EDIT', true );     // no code editor inside wp-admin
define( 'WP_AUTO_UPDATE_CORE', 'minor' ); // security releases install themselves
define( 'WP_POST_REVISIONS', 20 );        // keep the database tidy

Then a handful of small protections that don’t need a plugin with a dashboard. Create wp-content/mu-plugins/hardening.php (“mu” means must-use: it loads automatically and can’t be deactivated from the admin) with:

<?php
// Disable XML-RPC (legacy API; almost nothing needs it, bots love it).
add_filter( 'xmlrpc_enabled', '__return_false' );

// Stop username discovery via ?author=1 and the public users endpoint.
add_action( 'template_redirect', function () {
    if ( is_author() && ! is_user_logged_in() ) {
        wp_redirect( home_url(), 301 ); exit;
    }
} );
add_filter( 'rest_endpoints', function ( $endpoints ) {
    if ( ! is_user_logged_in() ) {
        unset( $endpoints['/wp/v2/users'], $endpoints['/wp/v2/users/(?P<id>[d]+)'] );
    }
    return $endpoints;
} );

// Don't advertise the WordPress version.
remove_action( 'wp_head', 'wp_generator' );

// Sensible browser security headers.
add_action( 'send_headers', function () {
    header( 'X-Frame-Options: SAMEORIGIN' );
    header( 'X-Content-Type-Options: nosniff' );
    header( 'Referrer-Policy: strict-origin-when-cross-origin' );
    header( 'Permissions-Policy: camera=(), microphone=(), geolocation=()' );
} );

Thirty lines, no settings screen, nothing to keep updated. With two-factor and the Cloudflare rules, that’s the security setup, and it covers more than most sites running a full security suite.

Add content, pages first

Day two. WordPress has two content types. Pages are the permanent ones: Home, About, Contact. Posts are dated articles that pile up in a feed. A business site needs pages on day one and posts only when you have something to say.

The five pages

Write these in a plain text file first, then paste. Keep the words plain.

  1. Home: who you help, what you do, one call to action. A visitor should know all three without scrolling.
  2. Services (or Products, or Menu): what you do, one section each.
  3. About: who you are, where you are, why you’re good at this. A photo of a real person.
  4. Proof: reviews, past work, credentials. Name it whatever fits: Work, Reviews, Projects.
  5. Contact: the WPForms form, your phone, your hours, your address if you have one people visit.

Build a page in the block editor

  1. Pages → Add New. Type the title. The slug (URL) is generated from it; check it in the sidebar and shorten it if it’s long.
  2. Click the + and open the Patterns tab. Ollie’s patterns are grouped: Hero, Features, Testimonials, Call to Action. Insert one, then click any text in it and replace it with yours. That’s the technique: patterns for structure, your words inside.
  3. For plain sections, type / to summon a block by name: /heading, /paragraph, /image, /list, /columns, /buttons. Those six cover ninety percent of a business page.
  4. Headings in order. The page title is the H1. Sections are H2. Sub-sections are H3. Never pick a heading level for its size; change the size in the block’s typography settings instead.
  5. Images: resize to 2000 px wide or less before uploading, and fill in the Alt text field with what the image shows. ShortPixel handles the rest.
  6. Links: select text, press Ctrl/Cmd + K, start typing a page name and WordPress finds it. Link pages to each other; a site where every page links to two others is easier to navigate and easier for search engines to understand.
  7. In the sidebar, scroll to The SEO Framework box. Write the title (under 60 characters) and the description (one plain sentence, under 155). This is what search results show.
  8. Publish. Then open it in a private window and on your phone. Fix what’s wrong. Repeat.

Wire the site together

  • Settings → Reading: set “Your homepage displays” to A static page, choose your Home page. If you’ll publish articles, create an empty page called Blog or Articles and set it as the posts page.
  • Appearance → Editor → Navigation: the header menu. Five pages, in the order above, Contact last. Nothing nested.
  • Privacy page: Settings → Privacy creates one. Rewrite it in your own words: what you collect (a contact form), what you don’t (no cookies, no tracking; true if you stuck to the six plugins), where it’s hosted (Canada), and how to reach you.

Write posts

Same editor, same blocks. Two differences: set a featured image (it becomes the card in your article list and the social-share preview), and write the kind of thing only you could write: how you do the work, what you’ve learned, what you’d tell a customer across the counter. Skip the “10 best X” lists. Nobody needs another one, and you have better material.

Launch

  1. Settings → Reading: untick “Discourage search engines”. This is the switch that makes the site real.
  2. Finish the Cloudflare setup: origin certificate, proxy on (orange cloud), the login rate-limit rule. Fifteen minutes.
  3. Google Search Console: add your domain (Cloudflare makes the DNS verification a one-click step), then submit https://yourdomain.ca/sitemap.xml. The SEO Framework generates it.
  4. Take a backup. SpinupWP schedules them; turn the schedule on, point it at off-server storage, and download one copy yourself today. Until you’ve restored one, you don’t know it works.
  5. Send the contact form to yourself. Reset your password. Both emails should arrive in seconds via Postmark. If they don’t, fix that before anything else; it’s how customers reach you.

Keep it running

A self-hosted site asks about ten minutes a month:

  • Updates: one pass a month. Plugins and theme first, then a major WordPress version if one is waiting. Read the update notes for anything that says “breaking”. Minor security releases already install themselves.
  • Delete, don’t deactivate. Anything you’re not using comes off the server.
  • Check the backup actually ran. Once a quarter, restore one to a test site to prove it works.
  • Look at Fathom once a week. Which page do people land on? Which one do they leave from? Improve that one.

Ship it, then make it better every week. Start small. Burn bright.

* Total damage: domain ~$15/year · server ~$8–12/month · SpinupWP subscription · Fathom subscription · Postmark a few dollars at most · theme and plugins $0. Everything on that list is cancellable, and everything you made leaves with you.

Comments

Leave a Reply

Your email address will not be published. Required fields are marked *