How to set up a website on GoDaddy

1. 01

   Identify the exact hosting product

   These steps target Linux Web Hosting (cPanel). Managed WordPress and Websites + Marketing are different products with different dashboards, backup systems and limitations.

   Exit checks

   • The active product is recorded as: Web Hosting (cPanel).
   • Billing term, renewal date, refund deadline and add-ons are recorded.
   • The account owner—not an agency or former employee—controls recovery and two-factor authentication.
2. 02

   Prepare ownership and a rollback file

   Before changing the live site, inventory the domain registrar, DNS host, current hosting, email provider, analytics, forms and third-party integrations. Export the current DNS zone and take a timestamped website backup. Store credentials in a password manager, not in a shared document.

   Exit checks

   • Domain registrant and account recovery details are correct.
   • Current DNS, files, database and mailbox requirements are documented.
   • A rollback owner and stop condition are named.
3. 03

   Create the hosting destination

   Sign in to GoDaddy My Products and cPanel. Follow the product onboarding without attaching the live domain prematurely. Select region, runtime and PHP version where offered; use a temporary hostname or preview URL for testing.

   Exit checks

   • Server region is appropriate for the primary audience.
   • A currently supported PHP version is selected.
   • Temporary site access is private or blocked from indexing.
4. 04

   Connect the domain without breaking email

   Connect the domain to the hosting account first. If changing nameservers, reproduce non-web records—especially Microsoft 365 or third-party email—before the cutover. An A record change is often safer when DNS should stay elsewhere.

   Exit checks

   • Root and www have an intentional destination.
   • MX, SPF, DKIM, DMARC and verification records are preserved.
   • Old DNS values and rollback instructions are saved.
5. 05

   Install WordPress correctly

   Use My Products → Web Hosting → Manage → cPanel Admin → Installatron/Applications → WordPress. Select the intended domain and leave the directory blank for a root-domain site. Use a non-obvious administrator username, a generated password and an owner-controlled recovery email. Do not enable a bundle of optional plugins until each is justified.

   Exit checks

   • WordPress is installed at the intended root or subdirectory.
   • Administrator recovery and two-factor authentication are configured.
   • Search engines are discouraged while the site is unfinished.
6. 06

   Configure WordPress foundations

   Set site title, tagline, language, timezone and administrator email. Choose a human-readable permalink structure before publishing. Delete sample content and unused plugins/themes, keep one default theme for recovery, and create least-privilege accounts for editors.

   Exit checks

   • Timezone matches business reporting needs.
   • Permalinks, site URL and admin email are correct.
   • Only maintained, necessary themes and plugins remain.
7. 07

   Issue SSL and move safely to HTTPS

   Check whether the purchased plan includes managed SSL. A manual cPanel certificate requires CSR/private-key handling and installation through SSL/TLS. Do not delete a private key or force HTTPS before the certificate is installed.

   Exit checks

   • Certificate covers the root domain and every live alias.
   • HTTP redirects once to the canonical HTTPS address.
   • Pages, images, scripts, forms and admin load without mixed content.
8. 08

   Set up reliable website and business email

   Do not assume cPanel email is active: GoDaddy frequently pairs domains with Microsoft 365. Preserve the active MX, autodiscover, SPF and DKIM records when changing DNS.

   Exit checks

   • Business mail receives and sends to external providers.
   • SPF, DKIM and DMARC align with actual senders.
   • Contact forms and password resets use authenticated delivery and are tested.
9. 09

   Build the site without creating lock-in

   Use a maintained theme or block system, build reusable design tokens, and keep content in portable WordPress fields where practical. Add privacy, contact, about and required legal pages. Configure analytics and consent according to the audience's jurisdictions. Compress images before upload and write meaningful alt text.

   Exit checks

   • Mobile navigation and keyboard access work.
   • Ownership, contact and policy pages are published.
   • Analytics, consent and conversion events are verified.
10. 10

    Secure access and maintenance

    Enable two-factor authentication for hosting, registrar and WordPress administrators. Remove unused accounts, restrict administrator roles, schedule core/plugin/theme updates with a rollback process, and confirm malware response scope. Never install nulled themes or plugins.

    Exit checks

    • Every privileged account has a unique password and 2FA.
    • Update responsibility and maintenance window are documented.
    • Security alerts go to a monitored owner address.
11. 11

    Create backups and prove restoration

    cPanel Backup Wizard can export files or databases manually. GoDaddy states Web Hosting plans have a one-day automatic daily backup, while longer retention may require Website Backup. Download a separate copy before destructive work.

    Exit checks

    • Files and database are both covered.
    • At least one encrypted copy is outside the hosting account.
    • A restore has been tested and recovery time recorded.
12. 12

    Migrate, test and launch

    A cPanel transfer can include website files, databases and cPanel mail, but a nameserver change can disrupt mail. Test the migrated site and inventory every DNS record before switching.

    Exit checks

    • Forms, checkout, login, search, scheduled tasks and webhooks pass.
    • 404s, canonical tags, robots.txt and XML sitemap are reviewed.
    • The former host remains available until DNS, email and monitoring are stable.

Accuracy boundary: hosting interfaces, plan inclusions and policies change. Confirm destructive actions, prices, retention and support scope inside the authenticated account before proceeding.