How to set up a website on iTools

1. 01

   Identify the exact hosting product

   iTools does not publish a stable, complete public onboarding path that Web Host Lens could verify. Use the welcome email and live account as the source of truth; confirm whether the service uses cPanel, DirectAdmin, Plesk or a custom panel before clicking anything.

   Exit checks

   • The active product is recorded as: Regional shared hosting; control panel must be verified.
   • Billing term, renewal date, refund deadline and add-ons are recorded.
   • The account owner—not an agency or former employee—controls recovery and two-factor authentication.
2. 02

   Prepare ownership and a rollback file

   Before changing the live site, inventory the domain registrar, DNS host, current hosting, email provider, analytics, forms and third-party integrations. Export the current DNS zone and take a timestamped website backup. Store credentials in a password manager, not in a shared document.

   Exit checks

   • Domain registrant and account recovery details are correct.
   • Current DNS, files, database and mailbox requirements are documented.
   • A rollback owner and stop condition are named.
3. 03

   Create the hosting destination

   Sign in to iTools client area and hosting panel. Follow the product onboarding without attaching the live domain prematurely. Select region, runtime and PHP version where offered; use a temporary hostname or preview URL for testing.

   Exit checks

   • Server region is appropriate for the primary audience.
   • A currently supported PHP version is selected.
   • Temporary site access is private or blocked from indexing.
4. 04

   Connect the domain without breaking email

   Copy the exact nameservers and server IP from the welcome email or authenticated service page. Export the current DNS zone, retain MX/SPF/DKIM/DMARC and verification records, and ask support whether an A-record-only connection is supported.

   Exit checks

   • Root and www have an intentional destination.
   • MX, SPF, DKIM, DMARC and verification records are preserved.
   • Old DNS values and rollback instructions are saved.
5. 05

   Install WordPress correctly

   Use Client area → active hosting service → control panel → application installer → WordPress. Select the intended domain and leave the directory blank for a root-domain site. Use a non-obvious administrator username, a generated password and an owner-controlled recovery email. Do not enable a bundle of optional plugins until each is justified.

   Exit checks

   • WordPress is installed at the intended root or subdirectory.
   • Administrator recovery and two-factor authentication are configured.
   • Search engines are discouraged while the site is unfinished.
6. 06

   Configure WordPress foundations

   Set site title, tagline, language, timezone and administrator email. Choose a human-readable permalink structure before publishing. Delete sample content and unused plugins/themes, keep one default theme for recovery, and create least-privilege accounts for editors.

   Exit checks

   • Timezone matches business reporting needs.
   • Permalinks, site URL and admin email are correct.
   • Only maintained, necessary themes and plugins remain.
7. 07

   Issue SSL and move safely to HTTPS

   After DNS reaches the new server, look for AutoSSL, Let's Encrypt or SSL/TLS Status in the verified control panel. If absent, ask support whether issuance is automatic or ticket-based. Never upload a private key to an unverified channel.

   Exit checks

   • Certificate covers the root domain and every live alias.
   • HTTP redirects once to the canonical HTTPS address.
   • Pages, images, scripts, forms and admin load without mixed content.
8. 08

   Set up reliable website and business email

   Confirm mailbox count, storage and sending limits. Create the mailbox, publish the exact provider-supplied MX and authentication records, and use authenticated SMTP for website mail.

   Exit checks

   • Business mail receives and sends to external providers.
   • SPF, DKIM and DMARC align with actual senders.
   • Contact forms and password resets use authenticated delivery and are tested.
9. 09

   Build the site without creating lock-in

   Use a maintained theme or block system, build reusable design tokens, and keep content in portable WordPress fields where practical. Add privacy, contact, about and required legal pages. Configure analytics and consent according to the audience's jurisdictions. Compress images before upload and write meaningful alt text.

   Exit checks

   • Mobile navigation and keyboard access work.
   • Ownership, contact and policy pages are published.
   • Analytics, consent and conversion events are verified.
10. 10

    Secure access and maintenance

    Enable two-factor authentication for hosting, registrar and WordPress administrators. Remove unused accounts, restrict administrator roles, schedule core/plugin/theme updates with a rollback process, and confirm malware response scope. Never install nulled themes or plugins.

    Exit checks

    • Every privileged account has a unique password and 2FA.
    • Update responsibility and maintenance window are documented.
    • Security alerts go to a monitored owner address.
11. 11

    Create backups and prove restoration

    Find the backup screen and record frequency, retention, restore scope, restore fee and whether copies survive account suspension. Download files and a database export off-account before launch and test a restore.

    Exit checks

    • Files and database are both covered.
    • At least one encrypted copy is outside the hosting account.
    • A restore has been tested and recovery time recorded.
12. 12

    Migrate, test and launch

    Ask whether migration includes files, database, email, DNS and a final sync. Build/test before DNS cutover, keep the previous host active and document rollback. Do not treat a plan-page ‘free migration’ claim as a complete scope.

    Exit checks

    • Forms, checkout, login, search, scheduled tasks and webhooks pass.
    • 404s, canonical tags, robots.txt and XML sitemap are reviewed.
    • The former host remains available until DNS, email and monitoring are stable.

Accuracy boundary: hosting interfaces, plan inclusions and policies change. Confirm destructive actions, prices, retention and support scope inside the authenticated account before proceeding.