I install WordPress on a fresh domain a few times a year, and the first thirty minutes decide whether the site is easy to run or a slow pile of annoyances. These are the seven settings I change before I write a single post, in the order I change them. None of them needs a plugin, and all of them are reversible except permalinks — which is exactly why permalinks go first.

The short version

• Permalinks to /post-name/, set before any content exists.
• Time zone and admin email set to something you actually use.
• The “discourage search engines” box checked, then unchecked — and checked again after every migration.
• Comments closed on old posts, pingbacks and trackbacks off.
• File editor disabled and revisions capped in wp-config.php.

1. Permalinks: decide once, before you publish

Settings → Permalinks → Post name. A fresh install defaults to a date-based structure, which is fine for a diary and bad for everything else: the URL carries the month, the day, and no words anyone would search for.

The reason this is step one is that changing it after publishing is the only item here that breaks things: every old URL returns a 404 unless you redirect it, and every link you posted elsewhere stops pointing at the right page.

If the site is already live, change it deliberately: change the structure, then add a redirect from the old pattern. WordPress does that for slugs, not for a permalink change.

2. General: the time zone and the mailbox nobody reads

Settings → General. Three fields matter and two of them get ignored on nearly every install I look at.

• Timezone. Pick your city, not UTC. If you schedule posts, WordPress converts your publish time to UTC and back; a wrong zone means a 9am post goes out at 5pm, and you spend ten minutes convinced the scheduler is broken.
• Administration Email Address. This is where password resets, new-user notices and critical-error recovery links go. Use a mailbox on the domain that you check, not a personal address you set in 2019 and no longer open.
• Site title and tagline. The tagline is not decoration — most themes print it under the logo, and “Just another WordPress site” tells a visitor you did not finish setting up.

While you are here, set the date and time format to something unambiguous. 03/04/2026 means two different days depending on who is reading.

3. Reading: the checkbox that quietly costs you months

Settings → Reading → Search engine visibility. “Discourage search engines from indexing this site” should stay unchecked on production. On a staging copy or a site you are rebuilding, it should be checked.

The failure mode is always the same: you build on staging, launch, and forget. The site looks perfect from your browser because you are logged in and looking at it directly. Google sees a page that asks politely not to be indexed, and six weeks later you are writing forum posts about having zero impressions.

So I check it twice — once during setup, once after any DNS or host change. It takes ten seconds and it is the single most consequential checkbox in the admin.

4. Discussion: close the doors you are not watching

Settings → Discussion. Comments on a small site attract two kinds of traffic: real readers, and bots that found a 2019 post about nothing. The settings that help:

• Uncheck Allow link notifications from other blogs (pingbacks and trackbacks). They are almost entirely noise on a small site, and they are a known way to get junk anchors onto a page.
• Set Automatically close comments on posts older than 14 days. Old posts are where the spam lands, because nobody is reading the moderation queue for them.
• Tick Comment must be manually approved for first-time commenters, and untick nested comments beyond two levels deep if your theme handles them badly.

If you do not want comments at all, uncheck “Allow people to submit comments on new posts” — but do it in the same sitting, because that checkbox lives on this page and nowhere else.

5. Media: stop generating image sizes nobody will use

Settings → Media. Every upload generates several resized copies before you ever insert it. On a site that publishes screenshots and diagrams, that adds up quietly in disk space and in backup size.

My numbers: thumbnail at 300×300 cropped, medium maxed at 768, large maxed at 1200. Those cover a card, a body image, and a full-width image on the layouts I use. Anything larger I upload deliberately, and WordPress makes a “scaled” copy of very large images anyway.

Two habits that go with it: rename the file before uploading (wordpress-permalinks-settings.png, not screenshot-2026-10-23-at-11.04.12.png), because the filename becomes part of the URL and the default alt text; and compress before upload instead of relying on a plugin.

6. wp-config.php: four constants worth typing by hand

This is the only step that is not a screen in the admin. Edit wp-config.php over SFTP and add these above the line that says That’s all, stop editing:

define('DISALLOW_FILE_EDIT', true);   // no theme/plugin editor in the admin
define('WP_POST_REVISIONS', 10);      // cap revisions instead of unlimited
define('WP_DEBUG', false);            // never true on a live site
define('WP_DEBUG_LOG', false);        // no wp-content/debug.log on production

What each one buys you:

• DISALLOW_FILE_EDIT removes the editor from Appearance and Plugins. It also means a stolen admin session cannot turn into code execution by pasting PHP into a theme file. The trade-off is real: you now need SFTP to change anything in code, which is the point.
• WP_POST_REVISIONS stops WordPress storing a new row for every autosave. A long editing session on a single post can otherwise leave dozens of copies in the database forever.
• WP_DEBUG and WP_DEBUG_LOG off on production, because a debug log records file paths and errors you do not want sitting in a web-readable directory. Turn them on for an hour when chasing a fatal error, then off again — the log is what tells you why the site broke, and which log to open is a separate problem.

7. Users, plugins, and the sample content

The last pass is cleanup, and it is the pass people skip.

• Delete the sample post, the sample page, and the default comment. They are published, indexed, and linked from your menu otherwise.
• Delete Hello Dolly. Delete any plugin you cannot explain in one sentence, including the ones that came bundled with a theme.
• Create one admin account with a real display name and a password from a manager, and do not use admin as the username — it is the first guess in every brute-force script. If more than one person needs access, give them Editor, not Administrator.
• On the Plugins screen, turn on auto-updates for the plugins you trust. Core minor releases and security releases already install themselves; the plugin list is where the forgotten one lives.

If you inherited the site rather than built it, run the checks in how to check if your WordPress site is infected in 5 minutes before you touch settings — there is no point tidying a site that is already serving someone else’s links. And if yours has already been hit, the recovery sequence I wrote up in my WordPress site was hacked and serving Japanese spam covers the order to do things in.

The 15-minute checklist

Do this one now

If you only have two minutes, open Settings → Permalinks and set it to Post name while the site is still empty. Everything else on this list can be fixed later without breaking a link; that one cannot.

Then keep the list somewhere you will find it: the next time you stand up a staging copy, the checkbox in step three is exactly the one that gets left in the wrong position. Settings are cheap to change and expensive to forget.