1 Click WordPress: What the Installer Does, and What It Leaves to You

A 1-click WordPress install creates a database and user, downloads WordPress, writes wp-config.php with fresh salts and runs the setup for you, and that is where it stops: backups, caching, plugin updates and hardening are still your job.

The button is genuinely useful. It replaces twenty minutes of FTP, a manually created database and a copy-pasted config file. But a working site is not the same as a maintained one, and the gap between the two is where hacked and abandoned WordPress installs come from. Here is what actually happens when you click, what it leaves undone, and the order to finish the job.

Table of contents

• What a one-click installer really does
• Why the salts and wp-config matter
• What the button does not do
• Post-install checklist: the first hour
• Post-install checklist: the first week
• One-click versus managed WordPress
• How this fits the rest of the stack
• FAQ

What a one-click installer really does

Whether it is a script library inside a control panel, a marketplace image on a cloud provider or the setup wizard on a WordPress host, a one-click installer automates the same manual steps. Knowing them helps you fix things when the button is not enough.

1. Creates a MySQL or MariaDB database and a dedicated database user with a random password.
2. Downloads the current WordPress core files into the web root.
3. Writes wp-config.php with the database credentials, table prefix and a fresh set of authentication keys and salts.
4. Runs the WordPress installer: site title, admin user, admin password and admin email.
5. Sets the site URL and, on some hosts, requests a TLS certificate and forces HTTPS.

You can do all of it by hand, and it is worth doing once so the magic goes away. With WP-CLI it is four commands: create the database, run wp core download, then wp config create and wp core install. The point is that nothing an installer does is special. It is a script that fills in a form.

wp core download
wp config create --dbname=wp_site --dbuser=wp_user --dbpass='use-a-long-random-one' --dbhost=localhost
wp core install --url=https://example.com --title='My Site' \
  --admin_user=editor_jane --admin_password='another-long-random-one' [email protected]

If you want to see it in a marketplace context, the DigitalOcean WordPress 1-Click App is a good example of a server image that ships with the stack preinstalled, and the one.com walkthrough shows the control-panel version.

Why the salts and wp-config matter

The eight constants in wp-config.php whose names end in KEY and SALT are used to sign and encrypt login cookies. A good installer generates them from a random source. That is one of the quiet benefits of the button: people who copy a sample config from a tutorial end up with placeholder text like put your unique phrase here, which weakens cookie security.

You can regenerate them any time, which logs every user out and invalidates every existing session. That is useful after a suspected compromise, after removing a staff member with admin access, or when you inherit a site and have no idea who has a valid cookie.

wp config shuffle-salts
wp config get --type=constant | grep -E 'SALT|KEY'
wp user list --role=administrator --fields=ID,user_login,user_email

The other thing worth checking in the generated wp-config.php is the table prefix. Most installers leave it at wp_, which is harmless but predictable. A custom prefix will not stop a determined attacker and is not a substitute for patching, but it removes one bit of low-effort guesswork. More valuable are the two constants installers rarely set: DISALLOW_FILE_EDIT, which removes the theme and plugin editor from the dashboard, and a strict file permission policy for wp-config.php.

What the button does not do

This is the part that matters. The installer finishes at first login. Everything after is maintenance, and none of it happens unless you set it up.

• Backups: nothing runs on a schedule, and nothing is stored off the server.
• Updates: WordPress core minor releases update themselves by default, but plugins and themes usually do not.
• Hardening: the admin username is often admin or the site name, login attempts are not limited, and XML-RPC stays open.
• Caching: pages are rebuilt from PHP and MySQL on every request until you add page caching and an object cache.
• Email: password resets and form notifications rely on the server’s mail function, which often lands in spam without an SMTP setup.
• Monitoring: nobody watches for downtime, and nobody renews anything you added by hand.

A fresh WordPress site scores fine on a speed test because it is empty. The picture changes after a theme, a page builder and a dozen plugins. If the site feels slow later, our guide to clearing the WordPress cache helps you tell a caching problem from a hosting one.

Marketplace images have a further catch. They give you a server, and a server is a managed-by-you thing. The image includes WordPress, the web server and the database, but the operating system patches, the firewall and the backups are yours. The button saved you setup time and gave you a maintenance job.

Post-install checklist: the first hour

Do these in order. The first four take ten minutes and remove most of the risk.

1. Change the admin username. If the installer created admin, add a new administrator with a different name, log in as that user and delete the old one.
2. Use a long random password and turn on two-factor authentication for every administrator.
3. Delete the sample content: Hello world, the sample page, and the unused default themes and plugins.
4. Set the permalink structure to post name before you publish anything, since changing it later needs redirects.
5. Confirm the site is served over HTTPS and that HTTP redirects to it.
6. Set the timezone, site language and admin email under Settings.
7. Add DISALLOW_FILE_EDIT to wp-config.php and block direct access to wp-config.php.
8. Install one page cache and one security plugin, not five of each.

// wp-config.php: put above the line that says stop editing
define('DISALLOW_FILE_EDIT', true);
define('WP_AUTO_UPDATE_CORE', 'minor');

The unglamorous truth is that plugin count is a bigger risk than anything on that list. Every plugin is code you did not write, running with full access to your database. Keep the count low, remove anything you have not used in a month, and delete rather than deactivate.

Post-install checklist: the first week

Once the basics are done, set up the recurring things. Backups first. You need a scheduled backup of both the database and the wp-content directory, stored away from the web server, and you need to have restored it once. Our walkthrough on how to back up a WordPress site covers the options.

Then updates. Decide who updates plugins and when. A common pattern is a weekly review: read the changelogs, update on a staging copy for anything that changes checkout or forms, and update the rest directly. You can automate the low-risk ones with WP-CLI in a scheduled job, and turn on automatic updates for plugins that have a good track record.

wp core version && wp plugin list --update=available
wp plugin update --all --dry-run
wp plugin update --all

Finally, email and monitoring. Configure SMTP through a transactional email provider so password resets arrive, and add an external uptime check that alerts you when the home page returns anything other than 200. These two are the difference between finding out about a problem in a minute and finding out from a customer.

One-click versus managed WordPress

The honest way to think about it: a one-click installer is a setup convenience, and managed WordPress is an operating model. If you click the button on a VPS, you own the stack from then on. If you use a managed platform, the stack is somebody else’s job and the button is just the first step.

A managed setup should cover what the installer leaves out: updates to the underlying stack, sensible defaults, backups and a way to get at your files and database without a separate SFTP client and phpMyAdmin install. That is the gap between a site that runs and a site that is looked after. Our post on deploying WordPress in five minutes walks through that flow start to finish, and managed WordPress explains what the term should and should not mean.

If you enjoy running servers or need full control over PHP extensions, use the button on a VPS and follow the checklist above. If you need the site online and maintained, with your time going into content rather than patching, pick the platform that includes the boring parts.

How this fits the rest of the stack

Before you pick a route, put numbers on it. The RunxBuild hosting calculator shows what a WordPress site costs at each size next to the alternatives, including your own time. Managed WordPress on RunxBuild starts at $3 a month on the Starter plan and includes a file manager and a database browser in the dashboard, so you can edit files or run SQL without setting up SFTP or phpMyAdmin. See the WordPress file manager docs and the database browser docs, or create a site from the dashboard.

Useful related references:

• Deploy WordPress in 5 minutes on RunxBuild
• Managed WordPress explained
• How to back up a WordPress site
• Managed WordPress on RunxBuild

FAQ

What does a 1-click WordPress install do?

It creates a database and database user, downloads WordPress core, writes wp-config.php with the credentials and fresh security salts, runs the setup wizard with your admin details, and sets the site URL. It automates the manual install steps and nothing more.

Is a 1-click WordPress install secure?

It is a reasonable starting point, not a finished configuration. Salts are usually generated properly, but the admin username may be predictable, login attempts are not limited and plugin updates are not automated. Apply the post-install hardening checklist immediately after installing.

Does 1-click install include backups?

No. Installers set up the site, not the maintenance. Backups, off-site storage and restore testing are separate. Some hosts add backups as a paid feature, so check what your plan includes and confirm you can restore from it.

How do I regenerate WordPress salts?

Replace the eight KEY and SALT constants in wp-config.php with new values, or run wp config shuffle-salts if you use WP-CLI. This logs out every user and invalidates existing sessions, which is useful after a suspected compromise.

What is the difference between 1-click and managed WordPress?

One-click is an installation shortcut, after which you maintain the server and site. Managed WordPress is an ongoing service where the host runs the stack, updates and backups. The button starts a site; the managed platform keeps it looked after.