Before you start
- wp-admin administrator access.
- A rough idea of required features (shop, forms, SEO, caching).
Start with one lean theme
Prefer official block themes or lightweight classics without multi-megabyte demo importers on small plans.
Keep one default theme installed as a fallback when debugging — delete unused themes after you trust the active one.
Install plugins in layers, not all at once
First wave: backups or staging (if available), security hardening, caching compatible with Nginx, and one SEO plugin.
Avoid duplicate roles — two full-page caches or two SEO suites fight each other and slow the site.
Use Appearance → Themes and Plugins → Add New
Upload ZIP only when you trust the vendor; nulled themes are a common malware vector.
After activation, visit the public homepage and an inner page to catch fatal errors early.
Schedule updates after backups
Dashboard → Updates lists core, plugin, and theme updates.
Apply updates during a low-traffic window; if a WooCommerce store is live, read extension compatibility notes first.
Delete unused plugins and themes
Inactive code still enlarges attack surface and backup size.
Remove demo content packs if you never imported them.