Tutorial

How to install WordPress manually

The five-minute install without an auto-installer, and the wp-config settings that matter on shared hosting.

Ben Johnson · last checked 2026-09-21 · 5 min read

You have a WordPress site to install and the one-click installer failed, or you want full control over every file. This guide walks through a manual install on CWP free hosting, then locks down the things that matter: file permissions, the database prefix, and the file editor.

Before you upload anything

Create the database first. If you upload WordPress and then try to create the database, the installer will fail and you will see the error establishing a database connection. That is the most common mistake.

Follow the steps in how to create a MySQL database. Write down the database name, the username, and the password. You need all three in the next section.

Get WordPress and set up wp-config.php

Download the latest WordPress zip from wordpress.org. Extract it on your computer. You will see a folder called wordpress containing wp-admin, wp-content, wp-includes and a handful of files at the root.

Open wp-config-sample.php in a plain text editor. Save it as wp-config.php in the same folder. Do not skip the rename.

Fill in the four database values:

define( 'DB_NAME', 'cwp_username_databasename' );
define( 'DB_USER', 'cwp_username_dbuser' );
define( 'DB_PASSWORD', 'thepasswordyouchose' );
define( 'DB_HOST', 'localhost' );

The host is always localhost on CWP free hosting.

The salts

Find the long block that looks like random nonsense with keys named AUTH_KEY, SECURE_AUTH_KEY, and so on. Delete the placeholder lines. Visit https://api.wordpress.org/secret-key/1.1/salt/ in your browser. Copy the entire output and paste it where the old salts were. This makes session cookies harder to forge.

The table prefix

Find this line:

$table_prefix = 'wp_';

Change wp_ to something else. A short random string works: x7k_ or m3n_. Do not use wp_. A custom prefix is a small obstacle to automated attacks that assume the default name. It is not real security — prepared queries and keeping WordPress updated are what actually stop SQL injection — but there is no reason to hand attackers the default either.

Upload and run the installer

Use FTP over TLS (CWP requires it) or the web file manager to upload the entire wordpress folder into public_html. If you want WordPress at your main domain, upload the contents of the folder directly into public_html, not the folder itself.

Point your browser at your domain. The WordPress installer should appear. Select your language, enter your site title, create an admin username and a strong password, and provide an email address you can access. Click install.

Disable the file editor

After the install finishes, log into the dashboard. Go to Plugins or Appearance > Theme File Editor. If you can see PHP files and edit them in the browser, the file editor is on.

Turn it off. Add this line to wp-config.php, above the line that says /* That's all, stop editing! */:

define( 'DISALLOW_FILE_EDIT', true );

Now the Plugin and Theme editors disappear from the dashboard. If someone steals an admin password, they cannot edit PHP files through the browser. They would need FTP access, which is a separate credential. This is a simple line that blocks a common attack path.

File permissions on shared hosting

WordPress needs write access to wp-content for uploads and plugins. On CWP free hosting, set folders to 755 and files to 644. Do not use 777 anywhere. If a plugin asks for 777, find a different plugin.

wp-config.php should be 600 or 640. Do not make it world-readable. It contains your database password.

Caching is not optional

CWP free hosting gives you 10 concurrent PHP processes per account. That is not many. A few visitors loading uncached pages can exhaust it and you will see a 508 error page.

Install a caching plugin. W3 Total Cache, WP Super Cache, or WP Rocket (if you bought it elsewhere) all work. Enable page caching. The plugin will generate static HTML files so PHP does not have to run for every visitor.

Without caching, a small spike in traffic will make your site unreachable. With caching, the same traffic is handled by the web server directly.

If something goes wrong

The installer fails at the database step. Double-check the database name, username, and password. Make sure the database exists. If you see the white screen or a connection error, revisit the database connection guide.

You log in and get sent back to the login page with no error. That is usually a site URL mismatch. WordPress stores the site address in the database. If you installed at a different domain or subfolder, the redirect breaks. The WordPress login redirect loop page explains how to fix it.

You cannot see the file editor after adding the constant. That is correct. The editors are gone. To edit a theme file, use FTP or the web file manager.

Manual install checklist

This is the short version for next time.

For a fuller walkthrough of running WordPress on CWP free hosting, including themes, plugins, and common fixes, see the WordPress guide.