How to set up a website on SiteGround

1. 01

   Identify the exact hosting product

   Choose whether this is a new site, migration or temporary-domain build. In the New Website flow, select the desired data-centre where available before installation.

   Exit checks

   • The active product is recorded as: SiteGround Web Hosting or Cloud Hosting.
   • Billing term, renewal date, refund deadline and add-ons are recorded.
   • The account owner—not an agency or former employee—controls recovery and two-factor authentication.
2. 02

   Prepare ownership and a rollback file

   Before changing the live site, inventory the domain registrar, DNS host, current hosting, email provider, analytics, forms and third-party integrations. Export the current DNS zone and take a timestamped website backup. Store credentials in a password manager, not in a shared document.

   Exit checks

   • Domain registrant and account recovery details are correct.
   • Current DNS, files, database and mailbox requirements are documented.
   • A rollback owner and stop condition are named.
3. 03

   Create the hosting destination

   Sign in to Client Area and Site Tools. Follow the product onboarding without attaching the live domain prematurely. Select region, runtime and PHP version where offered; use a temporary hostname or preview URL for testing.

   Exit checks

   • Server region is appropriate for the primary audience.
   • A currently supported PHP version is selected.
   • Temporary site access is private or blocked from indexing.
4. 04

   Connect the domain without breaking email

   Add or choose the domain during site creation. Point external DNS using the values shown in Client Area/Site Tools and preserve mail records. Verify both root and www.

   Exit checks

   • Root and www have an intentional destination.
   • MX, SPF, DKIM, DMARC and verification records are preserved.
   • Old DNS values and rollback instructions are saved.
5. 05

   Install WordPress correctly

   Use Websites → New Website or Site Tools → WordPress → Install & Manage. Select the intended domain and leave the directory blank for a root-domain site. Use a non-obvious administrator username, a generated password and an owner-controlled recovery email. Do not enable a bundle of optional plugins until each is justified.

   Exit checks

   • WordPress is installed at the intended root or subdirectory.
   • Administrator recovery and two-factor authentication are configured.
   • Search engines are discouraged while the site is unfinished.
6. 06

   Configure WordPress foundations

   Set site title, tagline, language, timezone and administrator email. Choose a human-readable permalink structure before publishing. Delete sample content and unused plugins/themes, keep one default theme for recovery, and create least-privilege accounts for editors.

   Exit checks

   • Timezone matches business reporting needs.
   • Permalinks, site URL and admin email are correct.
   • Only maintained, necessary themes and plugins remain.
7. 07

   Issue SSL and move safely to HTTPS

   SiteGround normally issues Let's Encrypt after correct DNS. Check Site Tools → Security → SSL Manager, then use HTTPS Enforce only after the certificate exists and resolve mixed content with Search & Replace after a backup.

   Exit checks

   • Certificate covers the root domain and every live alias.
   • HTTP redirects once to the canonical HTTPS address.
   • Pages, images, scripts, forms and admin load without mixed content.
8. 08

   Set up reliable website and business email

   Create mailboxes in Site Tools → Email → Accounts when email hosting is included. Configure authenticated SMTP for WordPress rather than depending on unauthenticated PHP mail.

   Exit checks

   • Business mail receives and sends to external providers.
   • SPF, DKIM and DMARC align with actual senders.
   • Contact forms and password resets use authenticated delivery and are tested.
9. 09

   Build the site without creating lock-in

   Use a maintained theme or block system, build reusable design tokens, and keep content in portable WordPress fields where practical. Add privacy, contact, about and required legal pages. Configure analytics and consent according to the audience's jurisdictions. Compress images before upload and write meaningful alt text.

   Exit checks

   • Mobile navigation and keyboard access work.
   • Ownership, contact and policy pages are published.
   • Analytics, consent and conversion events are verified.
10. 10

    Secure access and maintenance

    Enable two-factor authentication for hosting, registrar and WordPress administrators. Remove unused accounts, restrict administrator roles, schedule core/plugin/theme updates with a rollback process, and confirm malware response scope. Never install nulled themes or plugins.

    Exit checks

    • Every privileged account has a unique password and 2FA.
    • Update responsibility and maintenance window are documented.
    • Security alerts go to a monitored owner address.
11. 11

    Create backups and prove restoration

    Use Site Tools → Security → Backups to inspect restore points and create an on-demand backup if the plan permits. Also retain an off-account copy for provider/account failure.

    Exit checks

    • Files and database are both covered.
    • At least one encrypted copy is outside the hosting account.
    • A restore has been tested and recovery time recorded.
12. 12

    Migrate, test and launch

    Generate a migration token in Site Tools and use the SiteGround Migrator plugin on the source WordPress site, or request professional migration. Test before DNS change.

    Exit checks

    • Forms, checkout, login, search, scheduled tasks and webhooks pass.
    • 404s, canonical tags, robots.txt and XML sitemap are reviewed.
    • The former host remains available until DNS, email and monitoring are stable.

Accuracy boundary: hosting interfaces, plan inclusions and policies change. Confirm destructive actions, prices, retention and support scope inside the authenticated account before proceeding.