What to do every time.
BEFORE INSTALLING
Check PHP version and extension requirements against your plan Check memory and disk requirements Check the project is actively maintained
Decide where it goes: subdirectory, subdomain or addon domain
INSTALLING
Download from the official source only Create a dedicated database and user
Set permissions: 755, 644
Use a non-obvious administrator username and a strong password
IMMEDIATELY AFTER
Delete the install directory Delete sample content and default accounts Set the configuration file to 600 Set the site URL to https Turn debug mode off Run AutoSSL and enable Force HTTPS
CONFIGURING
Set up SMTP for email sending Set up any required cron job Configure backups, stored off the server Protect the admin area
RECORDING
Note what you installed, the version, the database name, and any non-default configuration.
ONGOING
Add it to your update routine.
THE TWO THAT MATTER MOST
Deleting the install directory, and configuring backups. The first prevents an easy compromise; the second means the rest is recoverable.
