Install WordPress the right way

The right way to complete a WordPress install is simple: place the files in the real document root, create one database with one dedicated user, and finish the setup over HTTPS so the site never starts life on plain HTTP. Use WP Toolkit on your cPanel account, or the official package from wordpress.org. Avoid random zip downloads, and do not park the site in a /wordpress folder “for now.”

Choose the real document root

For the primary domain, the document root is public_html. A subdomain has its own root folder. WP Toolkit asks for the install path; pick the path visitors will actually request. Installing under /wordpress means every URL carries that folder, or you face a messy move later. If DNS already points here, AutoSSL or Let’s Encrypt should have a certificate ready. Complete the installer on https:// so siteurl and home are not saved as http:// from the first login.

A zip from an unknown blog is not a clean WordPress package. It is also a common way to pick up plugins you never chose. Stick with Toolkit or wordpress.org, then remove leftover installer files. You can delete readme.html if you prefer. Do not leave the default admin account named admin with a weak password.

Create one database and one user

In cPanel MySQL, create a database, a user, and a strong password. Grant that user privileges on that database only. Avoid using the main cPanel login as the MySQL user when you can help it, and never use root. Two WordPress installs sharing one database with colliding table prefixes will overwrite each other’s data. If you need two sites, create two databases. The default wp_ table prefix is fine; hiding the prefix is not a security plan by itself.

Finish the setup after the installer

Log in once over HTTPS. Rename or replace the admin user if it is still called admin. Turn on updates through WP Toolkit or another reliable updater. You do not need three backup plugins on day one, because account-level snapshots already cover the hosting account. LiteSpeed Cache can wait until the homepage is more than the default “Hello world” post.

If you want the stack we set up for this workflow, WordPress hosting already includes WP Toolkit, LiteSpeed, and AutoSSL. The install path still has to be the real document root. The installer will not fix a /wordpress folder you chose as a temporary home.