Installing WordPress

From an empty domain to a working WordPress site, and then properly under management in the panel. This page is about that first step and about the things you want to arrange straight after it. What you can do with a site once it stands — updates, vulnerabilities, hardening, restore points — is in Your WordPress sites.

Screenshot — Panel → Hosting → Accounts → your account → WordPress. Screenshots of this page are captured with openwolf designqc into .wolf/designqc-captures/.

What you need

1. A domain on your account. If it is not there yet, add it first (Accounts → your account → Websites). A subdomain is fine.
2. A certificate. That happens on its own — see SSL and certificates. Install WordPress only once https:// works, or your site address ends up in the database as http:// and you have to correct it later.
3. Room in your plan for one more database.
4. A PHP version WordPress can run on. The server now checks that before it does anything: PHP 7.4 or newer, with json and a MySQL driver in it. If something is missing the screen says what has to change instead of stranding halfway through the install. On an ordinary website this simply holds; you only notice it if you have pinned your site to an old PHP version.

Installing

The installation itself runs on the server that serves your website. One line does everything: download WordPress, create the database and its user, write wp-config.php with fresh security keys, create the tables and create an administrator.

corectl wp install yoursite.com \
  --title "Your site" \
  --admin-user anna \
  --admin-email anna@yoursite.com \
  --locale en_GB

The administrator's password is generated by the server and printed once. Write it down straight away.

To bring a theme and a few plugins along in the same step:

corectl wp install yoursite.com \
  --title "Your site" --admin-user anna --admin-email anna@yoursite.com \
  --locale en_GB \
  --theme twentytwentyfour \
  --plugins wordpress-seo,wp-mail-smtp

The flags:

For WordPress in a subdirectory (yoursite.com/blog), use --path blog.

The assistant cannot do this for you. wp.install is on the list of actions the AI never performs: it installs third-party code and creates an administrator. That stays a human act.

Where WordPress comes from

Since round 4 the server no longer fetches WordPress from wordpress.org but from your provider's mirror: a pinned version, with a checksum agreed in advance. What you notice is only this:

• It is faster, because the mirror is on the same network.
• You get the version your provider released, not automatically whatever shipped this morning.
• --locale nl_NL still works, as long as your provider mirrored the Dutch build. If they did not, you get a clear refusal that names the languages that are there — never an English site nobody told you about.

To see what is on the shelf:

corectl app mirror list --app wordpress

What you install inside WordPress later — themes, plugins — still comes from wordpress.org. Your provider mirrors what they install, not the whole plugin directory.

Bringing the site under management

Then go to WordPress in the panel and click Find installations. The panel searches this account's websites, finds the installation and puts it in the list with its site card: version, updates, vulnerabilities, PHP, SSL.

Nothing is installed inside WordPress in the process — no plugin, no must-use file. The panel looks from the outside.

corectl wp scan                     # search every website on this node
corectl wp attach yoursite.com      # add one installation by hand
corectl wp list
corectl wp sites                    # the list with the site card

If you uploaded WordPress yourself or brought it in through a migration, this is exactly the same step.

Signing in to wp-admin

Two ways:

• From the panel — click the site and choose Open wp-admin. You are signed in in a new tab without a password. The link works once and expires after five minutes, and it is never minted by the assistant: only by a person pressing that button.
• By yourself — https://yoursite.com/wp-admin with the administrator name and the password shown at installation time.

corectl wp login yoursite.com       # prints a single-use login link

If you have lost the administrator password, the single-use link is the quickest way back: sign in, then change your password inside WordPress.

What to arrange right after installing

1. Move the scheduled tasks to the server. By default WordPress only runs its tasks when somebody visits. On a quiet site that means backups and scheduled posts run late, or never.

corectl wp cron set yoursite.com --system on
corectl wp cron yoursite.com        # how are the tasks running now?

1. Set automatic updating the way you want it. The default is security updates automatically and the rest not. Your WordPress sites has the whole explanation.

corectl wp policy yoursite.com
corectl wp policy set yoursite.com --core minor --plugins security --themes off --safe on

1. Apply the hardening. One action switches the baseline measures on: XML-RPC closed, file editing in wp-admin off, versions hidden, user enumeration blocked.

corectl wp harden yoursite.com                    # what exists, and what is on
corectl wp harden apply yoursite.com --set baseline

In the panel this is Secure on the site card, or in bulk for every site at once.

1. Run the vulnerability scan once, so you know what you are starting from.

corectl wp vuln sync                # fetch the feed
corectl wp vuln yoursite.com        # what is open on this site

1. Check the PHP version. Recent WordPress likes a recent PHP.

corectl php list
corectl php set yoursite.com --version 8.4

A site that is not for the public yet

Put a password in front of it: the browser asks before WordPress runs at all, including wp-admin. Handy while you are building.

corectl wp protect yoursite.com --on
corectl wp indexing yoursite.com --off     # ask search engines to stay away
corectl wp protect yoursite.com --off      # when you go live
corectl wp indexing yoursite.com --on

Do not forget that second line when you go live — a site that keeps sending search engines away does not get found.

Removing it again

Detaching takes the site out of the panel and leaves the installation alone:

corectl wp detach yoursite.com

The files and the database go through Files and Databases, or by removing the whole domain.

When it goes wrong

The page that was already there

A new website starts with one file: index.html, the page that says a website is on its way. Installing WordPress over that page is fine — the installation reads it as "empty" and clears it away itself once WordPress is in place.

If the folder holds anything else, even a single file or a single .htaccess, the installation refuses:

corectl wp install mysite.com
# error: docroot_not_empty: /home/customer1/domains/mysite.com/public_html is not
# empty (index.php) — WordPress is only installed into an empty document root.

That is on purpose. An installation that writes over the top is a website you have lost. If you are sure the folder can go, clear it yourself under Files first and try again.

See also

• Your WordPress sites — updates, vulnerabilities, hardening and restore points.
• Making a test environment — a copy to practise on, and pushing back to live.
• SSL and certificates — make sure https:// exists before you install.
• Databases and phpMyAdmin — the database that belongs to your site.