WordPress installs with defaults that work, but several of them are wrong for serious blogs. Skipping the post-install settings check means publishing with the wrong permalink structure, exposing your site to comment spam, broadcasting your username, and running into several other small problems that add up over time.

This is the 15-minute checklist for new installs, covering the settings that matter before your first real post goes live.

WordPress settings dashboard showing the panels to configure on a new install

1. General settings (Settings → General)

Site title and tagline

Set your real blog name and tagline. These appear in search results and browser tabs, so they matter more than most new bloggers assume.

The default tagline (“Just another WordPress site”) is the obvious giveaway of an unconfigured site, and it’s worth fixing before anyone sees it.

WordPress address and site address

Should both be the same URL (HTTPS, with or without www, but consistent either way).

Administration email

The email WordPress uses for important notifications. Use one you actually check regularly.

Timezone

Set to your timezone. WordPress uses this for post timestamps, scheduled posts, and more. The default UTC isn’t what most bloggers want.

Date format and time format

Pick what you want displayed on posts. The default usually works fine.

Week starts on

Mostly affects calendar widgets. Set this to your local convention.

2. Writing settings (Settings → Writing)

Default post category

WordPress creates “Uncategorized” by default. Don’t leave posts sitting in it.

Either:

  • Create your real categories first, then set the default to one of them.
  • Rename “Uncategorized” to your default catch-all category.

Default post format

“Standard” is usually right. Other formats (Aside, Quote, Image, etc.) are for specific theme features you may not use.

3. Reading settings (Settings → Reading)

Homepage displays

Choose whether the homepage shows your latest posts or a static page you’ve created.

For a typical blog, “Your latest posts” is the right call. For a more curated landing page, choose “A static page” and assign your custom homepage.

Blog pages show at most

This controls how many posts appear on archive pages. The default is 10, and for most blogs, 10 to 12 is about right. Go higher if you’re running a magazine-style layout with more posts per row.

Search engine visibility

The “Discourage search engines from indexing this site” checkbox should be UNCHECKED for production sites. According to the official WordPress documentation, checking this box adds a noindex tag that asks search engines to skip your site entirely.

Many new bloggers accidentally leave this checked from development. The result is that Google can’t index the site. Always verify this setting on launch day.

4. Discussion settings (Settings → Discussion)

Default article settings

“Allow people to submit comments on new articles” should be turned on or off depending on your blog’s policy. We cover the tradeoffs in detail in our comments vs. no comments post.

Other comment settings

  • Comment author must fill out name and email: on.
  • Users must be registered and logged in to comment: off for most blogs.
  • Automatically close comments on posts older than X days: on, 60 days recommended.
  • Enable threaded (nested) comments: on, depth 3.
  • Break comments into pages: off unless your posts get hundreds of comments.

Email me whenever

  • Anyone posts a comment: on initially. Disable once you’re getting many.
  • A comment is held for moderation: on.

Before a comment appears

  • Comment must be manually approved: off if you want returning commenters to post freely.
  • Comment author must have a previously approved comment: on. First-time commenters wait, but returning ones don’t.

Avatars

Tip: If you enable avatars, set the default avatar’s rating to “G” in the Discussion settings. It filters out any Gravatar images commenters have marked as containing mature content, which matters more than most bloggers expect once a comment section grows.

Show or hide commenter avatars. Either choice is fine, it mostly comes down to personal preference and how much visual clutter you want in your comment section.

WordPress discussion settings panel with recommended values configured

5. Media settings (Settings → Media)

Image sizes

WordPress generates multiple sizes of every uploaded image. The defaults are usually fine as a starting point.

If your theme uses specific sizes, those get added on top automatically.

Organize uploads into year/month folders

Leave this on. It’s the default, and it keeps your media library organized as your image count grows into the thousands.

6. Permalinks (Settings → Permalinks)

This is the single most important setting on the list. Set it to “Post name.”

We cover why this matters so much, and what happens if you get it wrong, in our permalinks deep dive.

Do this before publishing any posts. Changing it later breaks every URL you’ve already shared or that Google has indexed.

7. Privacy (Settings → Privacy)

WordPress provides a template privacy policy page. Customize it for your specific tools (analytics, email provider, comment system, etc.) and publish it.

You need a privacy policy if you collect any visitor data, and every blog does this in some form, whether through analytics, email signups, or comments.

8. Users → Profile (your own profile)

Display name publicly as

By default, WordPress shows your username as the post author byline. The username is the same value you use to log in, which is a bigger security issue than it sounds.

Change it to:

  • Your real first name and last name.
  • Just your first name.
  • A pen name.

Anything except your login username works. Exposing login usernames publicly helps brute-force attackers, since they only need to guess a password once they know the username.

Biographical info

Fill this in. It often appears in author bio boxes on posts and adds a human touch that readers notice.

Profile picture (Gravatar)

WordPress uses Gravatar, which links avatars to your email address. Set up a Gravatar at gravatar.com with a real photo so your byline doesn’t show a generic placeholder.

9. Users → All Users (the default admin account)

If WordPress installed with “admin” as the username, you have a security weakness. The “admin” username is the most-attacked credential in WordPress, since it removes half the guesswork from a brute-force attack.

To fix it:

  1. Create a new admin user with a different username.
  2. Log out, then log back in as the new user.
  3. Delete the “admin” user, attributing their posts to the new user.

If your install used a different username from the start, skip this step entirely.

10. Search Console verification

Before publishing, set up Google Search Console so you can monitor indexing and search performance from day one.

  1. Visit search.google.com/search-console.
  2. Add a property using the URL prefix option.
  3. Verify ownership. Yoast SEO, Rank Math, or Site Kit can handle this automatically, or you can add a DNS record manually. Google’s own verification guide walks through each method.
  4. Submit your XML sitemap once verification is complete.

11. Initial plugins

Install the essential plugins before publishing anything:

  • SEO plugin (Yoast or Rank Math).
  • Caching (or use your host’s built-in caching).
  • Security (Wordfence or Solid Security).
  • Backup (UpdraftPlus).
  • Akismet (anti-spam).
  • Contact form (Fluent Forms).

Configure each one individually. Don’t activate them all at once, go one at a time, verify it works, then move on to the next.

12. Initial pages

Create these pages before launch:

  • About, covering who you are and what the blog covers.
  • Contact, with a working form.
  • Privacy Policy, generated from Settings → Privacy.
  • Affiliate Disclosure, if you’ll use affiliate links anywhere on the site.

Add each one to your menus, primary or footer, wherever makes sense for your layout.

13. The menu

Head to Appearance → Menus to build your navigation.

Create a primary menu with: Blog, Categories (or a category dropdown), About, and Contact.

Create a footer menu with: Privacy Policy, Affiliate Disclosure, and optionally Contact again.

14. Theme settings

Each theme has its own settings panel, and this is where the site actually starts to look like yours. Configure:

  • Logo and favicon.
  • Header layout.
  • Color scheme.
  • Typography.
  • Footer content.

This step varies wildly by theme. If you’re using Aurora, the theme ships with dozens of prebuilt header, homepage, and footer layouts you can switch between in the Customizer without touching code, and our first steps guide walks through the setup order we’d recommend. Otherwise, skim your theme’s own documentation for the specifics.

15. Test posts

Write one or two test posts in different categories before you publish anything real. Verify that:

  • The post displays correctly.
  • Categories work as expected.
  • Images upload and show properly.
  • The author byline shows your display name, not your username.
  • The URL structure matches what you configured in step 6.

If anything looks wrong, fix it now, before publishing real content that readers and search engines will see.

Fifteen minutes now, fewer regrets later

Defaults aren’t all right. Set permalinks to Post name. Set timezone. Fix discussion defaults. Change default admin username if “admin.” Set your display name. Submit sitemap to Search Console. Install essential plugins. Create About / Contact / Privacy pages. Build menus. Configure your theme. Write test posts. 15-minute checklist that prevents many “I should have set this up earlier” regrets.