Blog / friday roundup
Six settings we change on every new WordPress site
Six WordPress settings our team changes before a new site goes live, based on the support tickets we end up fixing when nobody does.
A fresh WordPress install works out of the box, which is exactly why most people never open Settings at all. Then six months later a ticket arrives: the URLs all changed, the contact form replies bounce, Google has indexed nothing. Almost every one of those tickets traces back to a default nobody touched on day one. Here are the six we change ourselves, in the order we change them, on any new site we set up.
Permalinks, before the first post goes out
The default permalink structure gives you query strings instead of readable URLs, and it is the one setting that gets more expensive the longer you leave it. Change it to Post name under Settings, Permalinks, on day one. If a site has been live for a year with the default and you switch, every existing link breaks unless you map redirects for all of it, which is a job we have done for customers and would rather nobody needed. Our notes on redirects cover what that cleanup looks like if you are already past this point.
The "Discourage search engines" checkbox
Under Settings, Reading there is a checkbox that adds a noindex instruction for the whole site. It is the right call while you are building, and it is the single most common reason a new site gets zero traffic for weeks after launch. We see it maybe twice a month: the site looks perfect, Search Console reports nothing indexed, and the box is still ticked. Put a note in your launch checklist and untick it the same hour you go live.
A real admin address on your own domain
WordPress will happily keep sending password resets and update notices to whatever address was typed during install, which is often a personal Gmail belonging to a developer who moved on two years ago. Point the address under Settings, General at a mailbox on the site's own domain, and make sure somebody still reads it. We also set a second address for the admin user account itself, because the two are separate fields and people assume they are one. Creating those mailboxes takes about a minute in cPanel, and our business email accounts are included with hosting if you are not running mail elsewhere.
Comments and pingbacks, off by default
Unless a site actually wants a discussion under each post, the comment system is a spam target with no upside. Under Settings, Discussion we untick allowing comments on new posts and untick link notifications from other blogs, which kills both the comment flood and the trackback flood. On servers where a brochure site left comments open, we have watched the spam hit a few thousand attempts a day, all of it hammering the database for nothing. If you do want comments, turn on manual approval for a first comment and leave it that way.
HTTPS everywhere, not just on the home page
Every account here gets a free certificate through Let's Encrypt, so the certificate is rarely the problem. The problem is the site address fields under Settings, General still saying http, which leaves you loading half a page over plain HTTP and seeing warnings in the browser. Set both the WordPress Address and Site Address to the https version, then reload a page with images and check the address bar rather than trusting the admin. The Let's Encrypt project documentation is worth a skim if you want to understand what the certificate actually proves, which is less than most people assume.
Automatic updates for core, deliberate updates for everything else
WordPress ships with minor core updates on automatically and that default is correct, so leave it. What we change is the rest: we decide up front whether plugin updates run automatically or get reviewed, and we write the answer down somewhere the next person will find it. Sites where nobody decided are the ones that sit eleven versions behind until something gets exploited, and cleaning that up is a much worse afternoon than clicking update. We have written before about why updates matter and what unpatched plugins look like from the server side.
None of this takes longer than fifteen minutes on a new install, and it removes most of the reasons a small site ends up in our support queue in its first year. If you are setting up a site now and want a second pair of eyes on the configuration before you point the domain at it, open a ticket with our support team and we will look at it with you.