How to set up a website on Namecheap

1. 01

   Identify the exact hosting product

   Separate Shared Hosting from EasyWP: the dashboards, backup tools and migration routes are different. If domain and hosting were purchased together, connection is usually automatic; otherwise obtain the hosting nameservers first.

   Exit checks

   • The active product is recorded as: Shared Hosting with cPanel and Softaculous.
   • Billing term, renewal date, refund deadline and add-ons are recorded.
   • The account owner—not an agency or former employee—controls recovery and two-factor authentication.
2. 02

   Prepare ownership and a rollback file

   Before changing the live site, inventory the domain registrar, DNS host, current hosting, email provider, analytics, forms and third-party integrations. Export the current DNS zone and take a timestamped website backup. Store credentials in a password manager, not in a shared document.

   Exit checks

   • Domain registrant and account recovery details are correct.
   • Current DNS, files, database and mailbox requirements are documented.
   • A rollback owner and stop condition are named.
3. 03

   Create the hosting destination

   Sign in to Namecheap account and cPanel. Follow the product onboarding without attaching the live domain prematurely. Select region, runtime and PHP version where offered; use a temporary hostname or preview URL for testing.

   Exit checks

   • Server region is appropriate for the primary audience.
   • A currently supported PHP version is selected.
   • Temporary site access is private or blocked from indexing.
4. 04

   Connect the domain without breaking email

   Domain List → Manage → Nameservers. Select Namecheap Web Hosting DNS for Namecheap shared hosting, or Custom DNS only when the hosting welcome email supplies different nameservers. Preserve MX, SPF, DKIM and verification records before replacing a third-party DNS zone.

   Exit checks

   • Root and www have an intentional destination.
   • MX, SPF, DKIM, DMARC and verification records are preserved.
   • Old DNS values and rollback instructions are saved.
5. 05

   Install WordPress correctly

   Use Hosting List → Go to cPanel → Softaculous Apps Installer → WordPress. Select the intended domain and leave the directory blank for a root-domain site. Use a non-obvious administrator username, a generated password and an owner-controlled recovery email. Do not enable a bundle of optional plugins until each is justified.

   Exit checks

   • WordPress is installed at the intended root or subdirectory.
   • Administrator recovery and two-factor authentication are configured.
   • Search engines are discouraged while the site is unfinished.
6. 06

   Configure WordPress foundations

   Set site title, tagline, language, timezone and administrator email. Choose a human-readable permalink structure before publishing. Delete sample content and unused plugins/themes, keep one default theme for recovery, and create least-privilege accounts for editors.

   Exit checks

   • Timezone matches business reporting needs.
   • Permalinks, site URL and admin email are correct.
   • Only maintained, necessary themes and plugins remain.
7. 07

   Issue SSL and move safely to HTTPS

   Wait until the domain resolves to the hosting account. Check cPanel → SSL/TLS Status for AutoSSL. A separately purchased certificate requires activation, domain-control validation and installation; only force HTTPS after the certificate covers both root and www.

   Exit checks

   • Certificate covers the root domain and every live alias.
   • HTTP redirects once to the canonical HTTPS address.
   • Pages, images, scripts, forms and admin load without mixed content.
8. 08

   Set up reliable website and business email

   Create mailboxes in cPanel → Email Accounts only if email is included. Publish the exact MX and authentication records shown in cPanel; test inbound, outbound and password recovery before DNS cutover.

   Exit checks

   • Business mail receives and sends to external providers.
   • SPF, DKIM and DMARC align with actual senders.
   • Contact forms and password resets use authenticated delivery and are tested.
9. 09

   Build the site without creating lock-in

   Use a maintained theme or block system, build reusable design tokens, and keep content in portable WordPress fields where practical. Add privacy, contact, about and required legal pages. Configure analytics and consent according to the audience's jurisdictions. Compress images before upload and write meaningful alt text.

   Exit checks

   • Mobile navigation and keyboard access work.
   • Ownership, contact and policy pages are published.
   • Analytics, consent and conversion events are verified.
10. 10

    Secure access and maintenance

    Enable two-factor authentication for hosting, registrar and WordPress administrators. Remove unused accounts, restrict administrator roles, schedule core/plugin/theme updates with a rollback process, and confirm malware response scope. Never install nulled themes or plugins.

    Exit checks

    • Every privileged account has a unique password and 2FA.
    • Update responsibility and maintenance window are documented.
    • Security alerts go to a monitored owner address.
11. 11

    Create backups and prove restoration

    Use cPanel/Softaculous for an immediate pre-change copy and download files plus database off-account. EasyWP instead has a Backups tab that can create, restore and separately download files or database. Confirm which product and retention applies.

    Exit checks

    • Files and database are both covered.
    • At least one encrypted copy is outside the hosting account.
    • A restore has been tested and recovery time recorded.
12. 12

    Migrate, test and launch

    For WordPress, either use an approved migration plugin or transfer files and database. Keep the old host active, lower DNS TTL beforehand, test through a temporary URL or hosts-file mapping, then change DNS once forms and logins pass.

    Exit checks

    • Forms, checkout, login, search, scheduled tasks and webhooks pass.
    • 404s, canonical tags, robots.txt and XML sitemap are reviewed.
    • The former host remains available until DNS, email and monitoring are stable.

Accuracy boundary: hosting interfaces, plan inclusions and policies change. Confirm destructive actions, prices, retention and support scope inside the authenticated account before proceeding.