A one-click installer is convenient, but it does not always fit the job. You may need to install WordPress manually when migrating a site, deploying to a VPS, troubleshooting an installer failure, or setting up a custom directory structure. The process is straightforward once you understand the files, database, and configuration values WordPress needs.
Manual installation gives you direct control over each part of the deployment. It also makes future tasks, such as restoring a backup or moving from shared hosting to a KVM VPS, much easier to diagnose.
What You Need Before You Start
Before uploading anything, confirm that your hosting account or server meets WordPress requirements. You need a current PHP version supported by WordPress, a MySQL or MariaDB database, and HTTPS enabled with an SSL certificate. Most cPanel shared hosting accounts include these components by default. On an unmanaged Linux VPS, you will need to install and configure the web server, PHP, database service, and required PHP extensions yourself.
Have four database values ready: the database name, database username, database password, and database host. On cPanel hosting, the database host is often `localhost`. On managed database setups or separated application and database servers, it may be a hostname or private IP address supplied by your provider.
You should also decide where the site will live. Installing WordPress in `public_html` usually places it at `yourdomain.com`. Installing it in a folder such as `public_html/blog` places it at `yourdomain.com/blog`. This decision is simple to make before installation and more involved to change later.
Create a Database and Database User
In cPanel, open MySQL Databases or the MySQL Database Wizard. Create a new database, then create a separate database user with a long, unique password. Assign that user to the database and grant all privileges.
Record the final database name and username exactly as shown. cPanel commonly adds your account prefix to both values. For example, a database entered as `wordpress` may become `account_wordpress`. Entering only the short name during setup is a common reason for the WordPress connection error.
On a VPS, you can create the database through the MySQL or MariaDB command line. The database user should only have access to the WordPress database, rather than global administrative permissions. Limiting privileges reduces the impact if site credentials are ever exposed.
Download and Upload WordPress Files
Download the current WordPress package from the official WordPress project source to your local computer. Extract the archive before uploading it. Inside, you will find a `wordpress` folder containing directories such as `wp-admin`, `wp-content`, and `wp-includes`.
For cPanel shared hosting, File Manager is often sufficient for a single site. Upload the ZIP archive to the intended document root, extract it there, then move the contents of the inner `wordpress` folder into the target directory. Do not leave the files one folder too deep unless you want WordPress to load from that subdirectory.
FTP or SFTP is another practical option, especially when your local files already include a theme, plugins, or migration assets. SFTP is preferable when available because it encrypts the login session and file transfer. Confirm that your FTP client is connecting to the correct document root before starting a large upload.
For a Linux VPS, SSH is normally faster and more reliable. You can download and extract the package directly on the server, then place the files in the virtual host directory. This avoids transferring thousands of small files over a local FTP connection.
Set Ownership and File Permissions on a VPS
On shared hosting, the correct file ownership and permissions are generally handled by the platform. On a self-managed VPS, the web server must be able to read WordPress files and write to specific locations such as `wp-content/uploads`.
A typical baseline is directories at `755` and files at `644`, with the WordPress files owned by the web server user or the appropriate site-level user. Avoid setting files or directories to `777`. It may appear to fix a write problem, but it creates an unnecessary security exposure.
The correct ownership varies by stack. Apache with PHP-FPM, Nginx with PHP-FPM, and control-panel-managed servers can all use different users and groups. If uploads fail after installation, inspect ownership before broadening permissions.
Configure wp-config.php
WordPress can create its configuration file through the browser-based installer, but manually creating it gives you a chance to review the important settings. Rename `wp-config-sample.php` to `wp-config.php`, then edit it with a plain-text editor.
Enter the database name, username, password, and host in the matching fields. Keep the quotation marks around each value. If the database host is incorrect, WordPress will return “Error establishing a database connection,” even when the username and password are valid.
Replace the default authentication keys and salts with newly generated unique values. These values secure login cookies and invalidate existing sessions when changed. Never reuse keys from another WordPress installation.
You can also set a custom table prefix instead of the default `wp_`. A nondefault prefix is not a substitute for updates, strong passwords, or a firewall, but it can reduce exposure to simplistic automated attacks targeting known table names.
For production sites, it is also sensible to add the following setting after the site is configured:
`define('DISALLOW_FILE_EDIT', true);`
This disables the built-in theme and plugin file editor in the WordPress dashboard. It prevents an administrator account compromise from immediately becoming code-level access through that editor. Administrators can still update themes and plugins through normal deployment methods.
Run the WordPress Installation
Open the domain or installation path in a browser. If WordPress detects the files and database configuration correctly, it will display the setup screen. Select the site language, then enter the site title, administrator username, password, and email address.
Do not use `admin` as the administrator username. Use a unique username and a password generated by a password manager. The administrator email should be an address you actively monitor because password resets, update notices, and security alerts will be sent there.
After selecting Install WordPress, sign in at `/wp-admin`. At this point, the application is working, but a production site still needs basic hardening and operational checks.
Checks to Make After a Manual WordPress Install
First, go to Settings and confirm that the WordPress Address and Site Address use `https://`. If the site was installed before SSL was active, correct the URLs after the certificate is enabled. Browser warnings and mixed-content errors are easier to prevent at the beginning than repair across a finished site.
Next, open Settings > Permalinks and select the URL structure that fits the project. Saving this screen generates or refreshes rewrite rules. If clean URLs return 404 errors on a VPS, check whether Apache rewrite support is enabled or whether your Nginx configuration includes the standard WordPress fallback rule.
Install only the plugins and themes the site actually requires. Each additional component is code that must be updated, tested, and trusted. Remove inactive themes and plugins you do not plan to use, rather than leaving them installed indefinitely.
Set up backups before adding business-critical content. A useful backup includes both WordPress files and the database, with copies stored away from the same hosting account. Test a restore process occasionally. A backup that has never been restored is an assumption, not a recovery plan.
Finally, apply updates consistently. Core WordPress updates, plugin updates, PHP updates, and server patches all matter. On cPanel hosting, much of the underlying service maintenance is handled for you. On a VPS or dedicated server, you are responsible for monitoring the operating system and web stack unless you have a managed service arrangement.
When Manual Installation Is the Better Choice
A manual installation is not automatically better than Softaculous or another installer. For a new brochure site on cPanel, a one-click deployment is usually faster and perfectly reasonable. Owned-Networks customers using shared hosting can choose that route when speed and simple management matter most.
Manual deployment is the stronger choice when you need a repeatable server process, a specific WordPress version, custom permissions, a nonstandard database location, or a controlled migration path. It is also useful for agencies and resellers that need to understand exactly how each client site is structured.
If the browser installer fails, do not repeatedly retry without checking the basics. Verify DNS points to the intended server, confirm the domain’s document root, test the database credentials independently, and inspect the web server and PHP error logs. Those checks usually identify whether the problem is with WordPress, the database, or the hosting configuration.
A manually installed WordPress site starts with fewer mysteries. Keep a record of its document root, database name, PHP version, backup location, and administrative access method. That small amount of operational discipline pays off when the site grows from a simple launch page into an application your business depends on.