How to set up a website on Bluehost

1. 01

   Identify the exact hosting product

   Identify the active product and domain assignment before using Add Site. Managed/commerce products can present different onboarding and included tools than cPanel-based hosting.

   Exit checks

   • The active product is recorded as: Bluehost Web Hosting or WordPress Hosting.
   • Billing term, renewal date, refund deadline and add-ons are recorded.
   • The account owner—not an agency or former employee—controls recovery and two-factor authentication.
2. 02

   Prepare ownership and a rollback file

   Before changing the live site, inventory the domain registrar, DNS host, current hosting, email provider, analytics, forms and third-party integrations. Export the current DNS zone and take a timestamped website backup. Store credentials in a password manager, not in a shared document.

   Exit checks

   • Domain registrant and account recovery details are correct.
   • Current DNS, files, database and mailbox requirements are documented.
   • A rollback owner and stop condition are named.
3. 03

   Create the hosting destination

   Sign in to Bluehost Account Manager. Follow the product onboarding without attaching the live domain prematurely. Select region, runtime and PHP version where offered; use a temporary hostname or preview URL for testing.

   Exit checks

   • Server region is appropriate for the primary audience.
   • A currently supported PHP version is selected.
   • Temporary site access is private or blocked from indexing.
4. 04

   Connect the domain without breaking email

   For a Bluehost-registered domain, assign it to the site in Account Manager. For an external domain, use the nameservers or destination records Bluehost provides. Export the existing DNS zone first if email is elsewhere.

   Exit checks

   • Root and www have an intentional destination.
   • MX, SPF, DKIM, DMARC and verification records are preserved.
   • Old DNS values and rollback instructions are saved.
5. 05

   Install WordPress correctly

   Use Websites → Add Site → Install WordPress. Select the intended domain and leave the directory blank for a root-domain site. Use a non-obvious administrator username, a generated password and an owner-controlled recovery email. Do not enable a bundle of optional plugins until each is justified.

   Exit checks

   • WordPress is installed at the intended root or subdirectory.
   • Administrator recovery and two-factor authentication are configured.
   • Search engines are discouraged while the site is unfinished.
6. 06

   Configure WordPress foundations

   Set site title, tagline, language, timezone and administrator email. Choose a human-readable permalink structure before publishing. Delete sample content and unused plugins/themes, keep one default theme for recovery, and create least-privilege accounts for editors.

   Exit checks

   • Timezone matches business reporting needs.
   • Permalinks, site URL and admin email are correct.
   • Only maintained, necessary themes and plugins remain.
7. 07

   Issue SSL and move safely to HTTPS

   After the domain points correctly, open the site's Security or SSL area and confirm the included certificate is active. Test root and www before enabling redirects or updating WordPress URLs.

   Exit checks

   • Certificate covers the root domain and every live alias.
   • HTTP redirects once to the canonical HTTPS address.
   • Pages, images, scripts, forms and admin load without mixed content.
8. 08

   Set up reliable website and business email

   Email may be a separate Professional Email or Google Workspace product. Confirm mailbox ownership and MX records rather than assuming web hosting includes cPanel mail.

   Exit checks

   • Business mail receives and sends to external providers.
   • SPF, DKIM and DMARC align with actual senders.
   • Contact forms and password resets use authenticated delivery and are tested.
9. 09

   Build the site without creating lock-in

   Use a maintained theme or block system, build reusable design tokens, and keep content in portable WordPress fields where practical. Add privacy, contact, about and required legal pages. Configure analytics and consent according to the audience's jurisdictions. Compress images before upload and write meaningful alt text.

   Exit checks

   • Mobile navigation and keyboard access work.
   • Ownership, contact and policy pages are published.
   • Analytics, consent and conversion events are verified.
10. 10

    Secure access and maintenance

    Enable two-factor authentication for hosting, registrar and WordPress administrators. Remove unused accounts, restrict administrator roles, schedule core/plugin/theme updates with a rollback process, and confirm malware response scope. Never install nulled themes or plugins.

    Exit checks

    • Every privileged account has a unique password and 2FA.
    • Update responsibility and maintenance window are documented.
    • Security alerts go to a monitored owner address.
11. 11

    Create backups and prove restoration

    Check the exact plan for automated backup entitlement. Before launch, export WordPress files and database or use the supplied backup product, then store a copy outside the Bluehost account and test restore access.

    Exit checks

    • Files and database are both covered.
    • At least one encrypted copy is outside the hosting account.
    • A restore has been tested and recovery time recorded.
12. 12

    Migrate, test and launch

    Use Bluehost's documented migration option where eligible, or migrate WordPress with files/database. Validate wp-config.php, serialized URLs, forms, cron and email before changing nameservers.

    Exit checks

    • Forms, checkout, login, search, scheduled tasks and webhooks pass.
    • 404s, canonical tags, robots.txt and XML sitemap are reviewed.
    • The former host remains available until DNS, email and monitoring are stable.

Accuracy boundary: hosting interfaces, plan inclusions and policies change. Confirm destructive actions, prices, retention and support scope inside the authenticated account before proceeding.