How to build a business website on WordPress, step by step

Bizer · 2026-10-01

WordPress ran about 42 percent of all websites as of mid 2026, according to W3Techs, and the current release as of 22 September 2026 is version 7.1.2. That popularity is the main argument for it. Almost any web designer can work on it, thousands of themes and plugins exist, and if you fall out with one developer you can hire another without rebuilding the site.

The main argument against it is that you become responsible for keeping it updated and backed up. Decide whether you want that job before you start.

WordPress.org or WordPress.com: which one?

They are different things with confusingly similar names.

• WordPress.org is the free, open-source software. You install it on hosting you pay for, and you control everything: themes, plugins, code, data.
• WordPress.com is a hosted service run by Automattic that uses the same software. It handles hosting and updates for you, with limits on plugins and customization that depend on the plan you pay for.

This guide covers the WordPress.org route, which is what most people mean by "a WordPress site". If you never want to think about servers, WordPress.com or a hosted builder like Squarespace may suit you better, and that is a fair choice.

Step 1: Choose hosting that meets current requirements

As of September 2026, WordPress.org's requirements page recommends PHP 8.3 or newer, MySQL 8.0 or newer (or MariaDB 10.11 or newer), and HTTPS support. Older versions still technically work, but the page notes they have reached end of life and may expose your site to security holes.

When you compare hosts, ask three questions:

1. Does the plan run PHP 8.3 or newer?
2. Does it include a free SSL certificate for HTTPS?
3. Does it take automatic daily backups, and can you restore one yourself?

Most mainstream hosts offer a one-click WordPress installer. Use it. The famous "five-minute install" from the WordPress documentation still exists for doing it by hand, but there is no reason for a business owner to do that in 2026.

Step 2: Point your domain and turn on HTTPS

If you bought your domain separately, point it at the host using the DNS settings the host gives you. Then make sure the site loads at an address beginning with https. Many hosts do this automatically. If yours does not, do not launch until it is fixed: browsers flag plain http sites as not secure.

Step 3: Pick a theme you will not have to fight

Modern WordPress uses block themes, where you edit headers, footers and page layouts visually in the Site Editor rather than through code. Start with the default theme or a well-reviewed block theme from the official directory at wordpress.org/themes.

Be wary of large commercial "multipurpose" themes that bundle their own page builder. They look impressive in demos, but they often slow the site down and lock your content into that theme's format, which makes switching later painful.

Step 4: Install a short list of plugins

Every plugin is code someone else wrote, running on your site, that needs updating. Install only what solves a real problem:

• A form plugin for your contact page.
• A backup plugin, unless your host's backups are reliable and you can restore them yourself.
• An SEO plugin to manage page titles and your sitemap.
• A security or spam-protection plugin for forms and comments.

Before installing anything, check on its wordpress.org page when it was last updated and how many active installs it has. A plugin not updated in a year is a risk.

Step 5: Build the pages that matter

A home page, one page per service, an about page and a contact page. Write them in the words your customers use when they call you. We list what to verify before going live in what to check before launching a website.

Step 6: Set up updates and backups

Turn on automatic updates for minor WordPress releases (on by default) and for plugins you trust. WordPress has supported plugin and theme auto-updates since version 5.5 in 2020, set from the Plugins screen.

Then set up backups and test a restore once. An untested backup is a hope, not a backup.

What does it really cost to run?

Hosting, the domain, and any premium theme or plugins are the cash costs. The real cost is attention: roughly 30 minutes a month to check that updates went through, the forms still work and the backups ran. If nobody in the business will do that, budget for a developer or a managed WordPress host that does it for you. A neglected WordPress site with outdated plugins is one of the most common ways small business sites get hacked.

Who should not use WordPress?

If you sell mostly products online, Shopify is usually simpler. If you want a five-page site you will rarely touch and never want to hear the word "plugin", a hosted builder is less work. WordPress pays off when you want to own everything, publish regularly, or expect the site to grow into something custom.

What is uncertain

WordPress is changing faster than it used to. Version 7.0 shipped on 20 May 2026 after a delay, and a planned real-time collaboration feature was pulled shortly before release over stability concerns. Big features may keep arriving later than announced. For a small business site, that matters less than it sounds: the basics described here have been stable for years.