# How to install WordPress manually

> The five-minute install without an auto-installer, and the wp-config settings that matter on shared hosting.

Source: https://cwp.sg/tutorials/install-wordpress-manually/  
Author: Ben Johnson  
Last verified: 2026-09-21

**In short:** - Create the MySQL database and user before uploading WordPress to avoid the database connection error. - Edit `wp-config.php` with your database details, unique salts, and a custom table prefix, then upload the files to `public_html`. - Add `define( 'DISALLOW_FILE_EDIT', true );` to `wp-config.php` to block PHP file editing from the dashboard. - Install a caching plugin and set folder permissions to 755 and files to 644, with `wp-config.php` at 600.

You have a WordPress site to install and the one-click installer failed, or you want full control over every file. This guide walks through a manual install on CWP free hosting, then locks down the things that matter: file permissions, the database prefix, and the file editor.

## Before you upload anything

Create the database first. If you upload WordPress and then try to create the database, the installer will fail and you will see the [error establishing a database connection](/errors/error-establishing-a-database-connection/). That is the most common mistake.

Follow the steps in [how to create a MySQL database](/tutorials/create-a-mysql-database/). Write down the database name, the username, and the password. You need all three in the next section.

## Get WordPress and set up wp-config.php

Download the latest WordPress zip from wordpress.org. Extract it on your computer. You will see a folder called `wordpress` containing `wp-admin`, `wp-content`, `wp-includes` and a handful of files at the root.

Open `wp-config-sample.php` in a plain text editor. Save it as `wp-config.php` in the same folder. Do not skip the rename.

Fill in the four database values:

```
define( 'DB_NAME', 'cwp_username_databasename' );
define( 'DB_USER', 'cwp_username_dbuser' );
define( 'DB_PASSWORD', 'thepasswordyouchose' );
define( 'DB_HOST', 'localhost' );
```

The host is always `localhost` on CWP free hosting.

### The salts

Find the long block that looks like random nonsense with keys named `AUTH_KEY`, `SECURE_AUTH_KEY`, and so on. Delete the placeholder lines. Visit https://api.wordpress.org/secret-key/1.1/salt/ in your browser. Copy the entire output and paste it where the old salts were. This makes session cookies harder to forge.

### The table prefix

Find this line:

```
$table_prefix = 'wp_';
```

Change `wp_` to something else. A short random string works: `x7k_` or `m3n_`. Do not use `wp_`. A custom prefix is a small obstacle to automated attacks that assume the default name. It is not real security — prepared queries and keeping WordPress updated are what actually stop SQL injection — but there is no reason to hand attackers the default either.

## Upload and run the installer

Use FTP over TLS (CWP requires it) or the web file manager to upload the entire `wordpress` folder into `public_html`. If you want WordPress at your main domain, upload the contents of the folder directly into `public_html`, not the folder itself.

Point your browser at your domain. The WordPress installer should appear. Select your language, enter your site title, create an admin username and a strong password, and provide an email address you can access. Click install.

## Disable the file editor

After the install finishes, log into the dashboard. Go to Plugins or Appearance > Theme File Editor. If you can see PHP files and edit them in the browser, the file editor is on.

Turn it off. Add this line to `wp-config.php`, above the line that says `/* That's all, stop editing! */`:

```
define( 'DISALLOW_FILE_EDIT', true );
```

Now the Plugin and Theme editors disappear from the dashboard. If someone steals an admin password, they cannot edit PHP files through the browser. They would need FTP access, which is a separate credential. This is a simple line that blocks a common attack path.

## File permissions on shared hosting

WordPress needs write access to `wp-content` for uploads and plugins. On CWP free hosting, set folders to 755 and files to 644. Do not use 777 anywhere. If a plugin asks for 777, find a different plugin.

`wp-config.php` should be 600 or 640. Do not make it world-readable. It contains your database password.

## Caching is not optional

CWP free hosting gives you 10 concurrent PHP processes per account. That is not many. A few visitors loading uncached pages can exhaust it and you will see a 508 error page.

Install a caching plugin. W3 Total Cache, WP Super Cache, or WP Rocket (if you bought it elsewhere) all work. Enable page caching. The plugin will generate static HTML files so PHP does not have to run for every visitor.

Without caching, a small spike in traffic will make your site unreachable. With caching, the same traffic is handled by the web server directly.

## If something goes wrong

The installer fails at the database step. Double-check the database name, username, and password. Make sure the database exists. If you see the white screen or a connection error, revisit the [database connection guide](/tutorials/create-a-mysql-database/).

You log in and get sent back to the login page with no error. That is usually a site URL mismatch. WordPress stores the site address in the database. If you installed at a different domain or subfolder, the redirect breaks. The [WordPress login redirect loop](/errors/wordpress-login-redirect-loop/) page explains how to fix it.

You cannot see the file editor after adding the constant. That is correct. The editors are gone. To edit a theme file, use FTP or the web file manager.

## Manual install checklist

This is the short version for next time.

| Step | What to do |
|------|------------|
| 1 | Create the MySQL database and user |
| 2 | Download WordPress, edit `wp-config.php` with database values, salts, and a custom prefix |
| 3 | Upload files to `public_html` |
| 4 | Run the installer at your domain |
| 5 | Add `DISALLOW_FILE_EDIT` to `wp-config.php` |
| 6 | Install a caching plugin |
| 7 | Set file permissions: folders 755, files 644, `wp-config.php` 600 |

For a fuller walkthrough of running WordPress on CWP free hosting, including themes, plugins, and common fixes, see the [WordPress guide](/guides/how-to-host-a-website/wordpress/).

---

Content Website Platform (cwp.sg) operates the free hosting it writes about; see https://cwp.sg/about/ for the methodology and the commercial disclosure.