Plesk's WordPress Toolkit handles the install, the database and the first round of hardening. It's faster and safer than doing it by hand.
Install it
- Sign in to Plesk from your service page in the client area.
- Open WordPress in the left sidebar.
- Click Install.
- Set the site title, your admin username and a strong password.
- Choose whether it goes at the domain root or in a subfolder.
Sixty seconds later you have a working site.
Don't use admin as the username. It's the first thing every brute-force script tries. Pick something else — you can always change the display name separately.
Before you tell anyone the address
Install SSL. SSL/TLS Certificates → install the free Let's Encrypt certificate → tick Redirect from http to https.
Set the site URL to https under Settings → General, or you'll get mixed-content warnings on every page.
Turn on auto-updates for WordPress core and plugins in the Toolkit. Unpatched plugins are how nearly every compromised site we see got compromised.
Delete what you're not using. Every inactive theme and plugin is still code on disk that can be exploited. The default themes and Hello Dolly can go.
Plugins worth having
- A security plugin — Wordfence or Solid Security. One, not both.
- A caching plugin — WP Super Cache or W3 Total Cache. Again, one.
- An SEO plugin — Yoast or Rank Math for sitemaps and meta control.
- A backup plugin — optional. We back up daily anyway, but your own
copy means you're never waiting on us.
Resist adding more. Every plugin is a dependency you now have to keep patched, and plugin count correlates almost perfectly with how slow a WordPress site is.
Making it fast
The three things that matter most, in order:
- Compress your images. Unoptimised photography is the single
biggest cause of slow WordPress sites. ShortPixel or Imagify will do it in bulk.
- Enable caching. Turning on page caching typically cuts load time
by more than half.
- Use a current PHP version. Set it under Plesk → PHP Settings.
PHP 8.2+ is substantially faster than 7.x and still receiving security fixes.
Moving an existing site here
Don't do it by hand. Open a ticket — migrations are free, we run them out of hours, and we test on a staging URL before pointing your domain at anything.