WordPress is easy to install. Building a site that performs well, stays secure, and ranks in search is harder — and the decisions that affect those outcomes most are made before you install a single plugin. Getting the fundamentals right at the start saves significant rework later. Here are the five things worth deciding before you begin.
1. Choose your hosting tier before anything else
Hosting determines your site’s performance ceiling, maintenance burden, and reliability — and it’s much harder to migrate away from the wrong choice than to start on the right tier. The relevant split for WordPress isn’t between individual hosts; it’s between shared hosting and managed WordPress hosting:
- Shared hosting (Hostinger, SiteGround Shared, Bluehost): £3–8/month. Your site shares server resources with hundreds of others. Fine for a personal blog or low-traffic content site. Not reliable for a business site that needs consistent load times under real traffic.
- Managed WordPress hosting (Kinsta, WP Engine, Cloudways): £25–50/month. Server-level caching, isolated environments, automatic core and plugin updates, daily backups, staging environments, and WordPress-specific support. The extra cost is the right trade for any site where speed, uptime, or security matters.
The performance difference isn’t marginal. Managed WordPress hosts include server-level caching (Kinsta uses LiteSpeed, WP Engine has EverCache) that is faster and more reliable than a caching plugin on shared hosting. For a full breakdown of what each tier actually costs — hosting, theme, plugins, and development combined — see what a WordPress website costs to build and run in 2026. For the performance configuration that goes on top of your hosting, see the high-performance WordPress guide.
Don’t choose your host based on the introductory price. Renewal prices are often significantly higher, and migrating a live site to a new host mid-project to fix a performance problem is expensive in time and risk.
2. Pick a theme that doesn’t fight your performance goals
Your theme sets the structural weight your site starts with before you’ve added a single page. A lightweight theme ships a small stylesheet, minimal JavaScript, and mobile-first CSS. A heavy multipurpose theme bundles sliders, shortcodes, custom post types, and animation libraries — whether you use them or not.
For most projects, the right approach is a minimal base theme (Astra, GeneratePress, or Kadence) paired with a page builder. The theme stays out of the way structurally; the page builder (Elementor, Divi, or Bricks) handles visual layout. This separation is more maintainable and performs better than themes that bundle their own drag-and-drop system. The Elementor vs Divi vs Bricks comparison covers which builder fits which type of project.
Two things to verify before committing to a theme:
- Mobile-first CSS: Google indexes the mobile version of your pages first. A theme that prioritises desktop layout and layers mobile on top with
max-widthoverrides is starting from the wrong end. Astra, GeneratePress, and Kadence are built mobile-first. The mobile-first design guide covers what to look for in a theme’s CSS approach. - Active maintenance: A theme with no updates in the past six months is a compatibility risk. WordPress core and PHP release updates regularly — themes fall behind. Check the update history before buying.
3. Map your site structure before touching WordPress
The most common pre-build mistake is installing WordPress and building as you go, then discovering the URL structure is inconsistent, the navigation doesn’t match how users move through the site, or key content types weren’t planned. Fixing this after publication requires redirects and frequently creates SEO debt.
Before installing anything, decide:
- Key pages and their hierarchy: Home, About, Services (with sub-pages?), Blog, Contact — and what lives at each URL level.
- Permalink structure: Set
/%postname%/for posts before publishing anything. WordPress’s default?p=123format is not search-friendly, and changing permalinks on a live site with indexed content requires 301 redirects on every URL. - Custom content types: If your site needs a portfolio, a team directory, a case study archive, or a product catalogue, decide this upfront. Adding a custom post type mid-build after content is already in standard posts requires migration.
- Internal linking plan: Identify which pages should link to which — services pages linking to case studies, blog posts linking to services. Planning this in the architecture stage means you can build it in rather than retrofitting it later.
For eCommerce sites, plan your WooCommerce product category taxonomy before importing any products — restructuring categories mid-build changes URLs and creates redirect requirements. If you’re still deciding between WooCommerce and Shopify, the WordPress vs Shopify for eCommerce comparison covers the cost and capability trade-offs before you commit.
4. Decide your plugin stack before you install anything
WordPress has over 60,000 plugins. Each active plugin adds PHP execution, database queries, and potential conflicts with other plugins. Most well-optimised WordPress sites run 10–20 active plugins. Over 30 is a common cause of performance degradation and update fatigue.
Plan your essential stack before you install anything, one plugin per job:
- SEO: Rank Math (free tier is genuinely competitive with premium alternatives for most sites). For a comparison of Rank Math, Yoast, and what each premium tier adds, see the WordPress SEO plugins guide.
- Security: Wordfence Free (solid, 30-day signature delay on the free tier) or Solid Security (formerly iThemes Security, rebranded 2023). For a full comparison of free and premium security plugin options, see the WordPress security plugins guide.
- Backup: UpdraftPlus with remote storage configured (Amazon S3, Google Drive, or Dropbox). The free tier works; premium adds a better scheduler and more remote destinations. A backup stored only on your server doesn’t protect you if the server fails.
- Caching: WP Rocket ($49/year) or LiteSpeed Cache (free with a LiteSpeed server — check if your host uses it). Both are reliable; the right choice depends on your host’s stack. See the WP Rocket vs W3 Total Cache vs LiteSpeed comparison for a detailed breakdown.
- Contact forms: Contact Form 7 (free, no-frills) or WPForms Lite (free, friendlier interface). Both work; Gravity Forms ($59/year) if you need conditional logic, multi-page forms, or CRM integrations.
Keep updates current from day one. Outdated plugins are the most common vector for WordPress security incidents — not the software itself, but third-party plugins that stopped receiving security patches. The WordPress update guide covers how to manage this without breaking your site.
5. Set up SEO infrastructure before you publish your first page
Fixing SEO structure after a site goes live is significantly harder than building it in from the start. URL changes require redirects. Missing metadata needs to be added to every post. Incorrect heading structure needs page-by-page correction. Do this before you publish anything:
- Install your SEO plugin first — before you write content. Rank Math or Yoast configures your site title, tagline, Open Graph settings, and XML sitemap automatically. Without an SEO plugin active from the start, early posts may be indexed without proper metadata.
- Set permalinks to
/%postname%/immediately after installing WordPress, before any content exists. This is in Settings → Permalinks. If you publish pages or posts first and then change this setting, all existing URLs break and need 301 redirects. - Connect Google Search Console and submit your sitemap before launch. Search Console is how Google communicates crawl errors, manual actions, and Core Web Vitals issues — you want it monitoring from the day your site goes live.
- Configure robots.txt to block thin or duplicate pages from indexing: author archives, date archives, tag pages (if they’re thin), and the wp-admin area. Rank Math and Yoast both handle this in their settings.
- Use heading tags for structure, not styling: H1 for the page title (one per page), H2 for main sections, H3 for sub-sections. Using H2 or H3 because you want a particular font size is one of the most common on-page SEO mistakes on self-built WordPress sites.
- Image optimisation: WordPress generates
srcsetautomatically and converts uploaded images to WebP (since WordPress 5.8). Optimise originals before uploading — compress to 80–85% JPEG quality or use PNG only when transparency is required. The mobile-first design guide coversfetchpriorityand lazy loading configuration for your LCP image.
For the full setup guide on SEO plugins, schema markup, and what each tier of Rank Math and Yoast actually includes, see the WordPress SEO plugins guide.
Once these five fundamentals are in place, the ongoing work is maintenance — keeping WordPress core, themes, and plugins updated, monitoring security alerts, and verifying backups are completing and restorable. The complete WordPress maintenance guide covers the full ongoing cycle. If you want a realistic budget before starting, what a WordPress site costs to build and run in 2026 has specific cost ranges for every component.
