WordPress Fundamentals: Complete CMS Notes

What will I learn in this course?

Welcome to the Rishtaara WordPress course. This is a no-fluff, hands-on path from “I have never opened wp-admin” to “I can run, secure, and extend a real WordPress site.”

We start with what WordPress actually is and how to install it, move into daily content work (posts, pages, media, comments, categories), and finish with plugins, security, the block editor, a mini plugin you build yourself, and a WooCommerce overview.

Real-life example: Think of this course like learning to run a small shop. First you learn what a shop even is and set up the space (basics). Then you learn to stock shelves and serve customers (content). Finally you learn security, staff roles, and how to add a new counter like a bakery corner (advanced — plugins, security, WooCommerce).

• Basics (lessons 1–10) — what is WordPress, CMS concept, features, .com vs .org, download, install on Windows/local/Linux, password reset, dashboard tour
• Content (lessons 11–20) — posts, links, media library, pages, comments, categories, tags, themes, widgets & menus
• Advanced (lessons 21–32) — plugins, SEO, users & roles, settings, security & backups, how-to recipes, Gutenberg deep dive, build a plugin, WooCommerce basics, capstone checklist

Why learn WordPress in 2026?

WordPress now powers a very large share of all websites on the internet — commonly estimated at around 40–45% of the web, depending on which survey you check. That is not a small niche; it is the default choice for a huge number of blogs, business sites, and online stores.

It is open source, which means the core software is free, its code is public, and thousands of developers around the world improve it every year. On top of that core, a marketplace of themes and plugins lets you add almost any feature without writing code from scratch.

Real-life example: Learning WordPress is like learning to drive a very common car model. Parts, mechanics, and spare tyres (plugins, themes, tutorials, freelancers) are everywhere, so you are rarely stuck.

• Huge job market — agencies, freelancers, and businesses all need WordPress help
• Fast to launch — a working website in hours, not weeks
• No-code friendly — page builders and blocks work without writing code
• Extendable — when you outgrow no-code, plugins and custom PHP take over

A short, honest history

WordPress was created in 2003 by Matt Mullenweg and Mike Little, as a fork of an older blogging tool called b2/cafelog. It started as a simple blogging platform.

Over two decades it grew into a full content management system (CMS) that runs blogs, business websites, portfolios, news sites, membership platforms, and online stores.

Real-life example: WordPress growing from a blogging tool into a full CMS is like a small tea stall growing into a multi-branch restaurant chain — same core idea (serve customers), far more menu options today.

What is a Content Management System (CMS)?

A CMS is software that lets you create, edit, organize, and publish content on a website without writing raw HTML for every page. You type in a friendly editor; the CMS turns it into a working web page.

Before CMS tools, updating a website meant editing HTML files directly and uploading them by hand. A CMS separates content (words, images) from design (theme) and functionality (plugins), so non-developers can manage a site.

Real-life example: A CMS is like a restaurant order pad connected to the kitchen. The waiter (you) writes an order in plain language; the kitchen (CMS) turns it into a finished dish (web page) without the waiter needing to cook.

What is WordPress, specifically?

WordPress is a free, open-source CMS built with PHP and MySQL (or MariaDB). It stores your content in a database and uses PHP code, themes, and plugins to display and manage that content.

At its core, WordPress gives you an admin dashboard (wp-admin) where you write posts and pages, upload images, manage comments, and control how the site looks and behaves — all through a browser, no code editor required for day-to-day use.

Real-life example: Compare a hand-coded HTML website to a house built brick by brick on-site. WordPress is a prefab housing system — the frame (core), rooms (themes), and furniture (plugins) are pre-made, so you assemble a home faster.

• Written in PHP, a server-side scripting language
• Stores content — posts, pages, settings, comments — in a MySQL/MariaDB database
• Themes control the design; plugins add features; core handles the engine
• Open source — free to use, modify, and redistribute under the GPL license

# A typical WordPress install on a server looks like this:
wp-content/
  themes/       # design files
  plugins/      # feature files
  uploads/      # images, PDFs, media you add
wp-config.php   # database connection details
wp-admin/       # the dashboard code
wp-includes/    # WordPress core engine files

Other CMS options — quick comparison

WordPress is not the only CMS. Joomla and Drupal are older open-source alternatives that are more technical to configure. Shopify and Wix are hosted, closed platforms aimed at simplicity over flexibility.

WordPress sits in a sweet spot: easier than Drupal for beginners, far more flexible than Wix for developers, and backed by the largest plugin and theme ecosystem of any CMS.

Real-life example: Choosing a CMS is like choosing a vehicle. A scooter (Wix) is simple but limited. A truck (Drupal) is powerful but needs a trained driver. WordPress is a reliable hatchback — easy enough for a new driver, capable enough to carry serious cargo when upgraded.

• WordPress — huge ecosystem, beginner-friendly, highly extendable
• Shopify — best if your only goal is a simple online store, less flexible for content
• Wix/Squarespace — easiest drag-and-drop, but locked into their hosting and limited plugins
• Drupal/Joomla — powerful for complex sites, but a steeper learning curve

Ease of use — no coding required to start

You write content in a visual block editor (Gutenberg) that feels like a document editor — type text, add an image block, add a button block. No HTML knowledge needed for basic pages.

Real-life example: The block editor is like arranging LEGO bricks — each block (paragraph, image, button) snaps into place; you do not need to mold the plastic yourself.

• Visual editor for posts and pages — no code needed for basics
• One-click installs for themes and plugins from the dashboard
• Media library to manage images, videos, and documents
• Auto-save and revision history — never lose your draft

Themes — instant redesign without touching code

A theme controls the visual layout of your site — colors, fonts, spacing, header, footer. Thousands of free and premium themes exist for blogs, portfolios, restaurants, and stores.

Switching a theme can transform your entire site's look in minutes while your content stays exactly the same in the database.

Real-life example: A theme is like changing the interior decoration of a shop overnight — same products on the shelves (content), completely new paint, lighting, and layout (theme).

Plugins — add features without hiring a developer

Plugins are small add-on programs that extend WordPress: contact forms, SEO tools, image compression, backups, e-commerce, membership systems, and much more.

There are tens of thousands of free plugins in the official WordPress.org repository, plus many premium ones — most features you can imagine already exist as a plugin.

Real-life example: Plugins are like apps on a smartphone. The phone (WordPress core) does the basics; you install a torch app, a calculator app, a banking app — each adds one feature without rebuilding the phone.

• SEO plugins — Yoast SEO, All in One SEO
• Security plugins — Wordfence, Sucuri
• Performance plugins — caching, image optimization
• E-commerce — WooCommerce turns WordPress into a full store

SEO-friendliness and other built-in strengths

WordPress generates clean, semantic HTML and clean URLs (permalinks) by default — both are important signals for search engines. SEO plugins add further control over titles, meta descriptions, and sitemaps.

Other strengths include multilingual support (with plugins), responsive themes that adapt to mobile screens, built-in comment systems, and a huge global community for support.

Real-life example: WordPress being SEO-friendly out of the box is like a shop being built on a busy street corner by default — visibility is baked in from day one, and you can still add a bigger signboard (SEO plugin) later.

Two very different things share one name

WordPress.com is a hosted service run by a company called Automattic. You sign up, and they handle hosting, updates, and backups for you — similar to Wix or Squarespace, but built on WordPress software.

WordPress.org is the home of the free, open-source WordPress software itself. You download it and install it on your own hosting, giving you full control over themes, plugins, and code.

Real-life example: WordPress.com is like renting a fully furnished flat — convenient, but you cannot knock down a wall (limited plugins) without the landlord's permission. WordPress.org is like buying your own plot and building the house — full freedom, but you handle maintenance.

Feature-by-feature comparison

The biggest practical difference is control: plugin installs, theme uploads, and file access are restricted or unavailable on the free WordPress.com plans, but completely open on WordPress.org.

This Rishtaara course focuses entirely on WordPress.org — the self-hosted version — because that is what freelancers, agencies, and most companies actually use in real jobs.

• Hosting: .com hosts for you; .org needs you to buy hosting (e.g. Hostinger, Bluehost, SiteGround)
• Custom plugins: blocked or limited on free .com plans; unlimited on .org
• Custom themes: limited on .com free plans; unlimited on .org
• Cost: .com has free and paid tiers; .org software is free but hosting/domain cost money
• Monetization: .com restricts ads/affiliate control on lower plans; .org gives full control
• Maintenance: .com handles backups/updates for you; on .org, you (or a plugin) handle it

Getting the official WordPress package

Go to wordpress.org and click the Download WordPress button. This gives you a .zip file containing the full WordPress core software — the same files every self-hosted WordPress site runs on.

Always download from the official wordpress.org site, never from an unknown third-party mirror. Modified copies can contain hidden malware.

Real-life example: Downloading WordPress from wordpress.org is like buying medicine from a licensed pharmacy instead of a roadside stall — the source matters for safety.

# On a Linux/Mac server or local machine with curl installed
curl -O https://wordpress.org/latest.zip
unzip latest.zip
# This creates a folder named "wordpress" with all core files

What is inside the zip file?

Once extracted, you get a folder named wordpress containing wp-admin, wp-includes, wp-content, and a handful of root PHP files like wp-config-sample.php and index.php.

You will rename wp-config-sample.php to wp-config.php later and fill in your database details — we do that step by step in the next lessons.

• wp-admin/ — dashboard interface code (do not edit directly)
• wp-includes/ — core engine files (do not edit directly)
• wp-content/ — your themes, plugins, and uploads (this is where you'll work)
• wp-config-sample.php — template for your database connection settings

Where to put these files next

If you are practicing locally, you will place this folder inside your local server's web root (e.g. htdocs for XAMPP). If you are deploying to a live host, you will upload it via FTP or your host's file manager.

Real-life example: Downloading WordPress is like buying flat-pack furniture — you still need a room (server), an empty shelf area (database), and the instruction manual (the 5-minute install) before it looks finished.

Why you need XAMPP or WAMP on Windows

WordPress needs PHP and MySQL to run. Windows does not include either by default, so tools like XAMPP or WAMP bundle Apache (web server), MySQL/MariaDB, and PHP into one easy installer.

Once installed, your Windows machine can run WordPress locally — perfect for learning, testing plugins, or building a site before moving it to a live server.

Real-life example: XAMPP is like a portable generator, water tank, and workshop all bundled into one box — everything WordPress needs to “power on” at home, without connecting to the internet.

Step-by-step: install XAMPP and start services

Download XAMPP from apachefriends.org, run the installer, and accept the default components (Apache, MySQL, PHP, phpMyAdmin). Once installed, open the XAMPP Control Panel.

Click Start next to both Apache and MySQL. Green “Running” status on both means your local server is live.

• Install XAMPP with Apache + MySQL + PHP + phpMyAdmin selected
• Start Apache and MySQL from the Control Panel
• Extract WordPress into C:\xampp\htdocs\mywpsite
• Open http://localhost/phpmyadmin to create your database

C:\xampp\htdocs\
  mywpsite\        <-- extract WordPress zip contents here
    wp-admin\
    wp-includes\
    wp-content\
    wp-config-sample.php

Create the database and run the install

In phpMyAdmin, click Databases, type a name like mywpsite_db, choose utf8mb4_unicode_ci collation, and click Create.

Now visit http://localhost/mywpsite in your browser. WordPress detects there is no wp-config.php and walks you through the famous 5-minute install: enter the database name, username (root), password (usually blank on XAMPP by default), and host (localhost).

Real-life example: Creating the database first is like preparing an empty notebook before you start writing — WordPress needs somewhere to save every post and setting you create.

The general local-install recipe

Regardless of whether you use XAMPP, WAMP, MAMP, or Local by Flywheel, every local WordPress install follows the same five steps: download WordPress, create a database, edit wp-config.php, run the installer, then log in.

Real-life example: Installing WordPress locally is like setting up a fish tank before adding fish — fill the tank (database), set the temperature (config), then release the fish (run the installer) only once conditions are ready.

Step 1–2: database and wp-config.php

Create an empty MySQL database (e.g. via phpMyAdmin) and note its name, along with a database username and password that has access to it.

Rename wp-config-sample.php to wp-config.php and fill in the four key constants: DB_NAME, DB_USER, DB_PASSWORD, DB_HOST.

<?php
define( 'DB_NAME', 'mywpsite_db' );
define( 'DB_USER', 'root' );
define( 'DB_PASSWORD', '' );      // often blank on local XAMPP setups
define( 'DB_HOST', 'localhost' );

// Below this, keep the unique keys and salts WordPress generates for you.
// You can fetch fresh ones from https://api.wordpress.org/secret-key/1.1/salt/

Step 3: the famous 5-minute install

Visit your local site URL in a browser (e.g. http://localhost/mywpsite). WordPress detects a valid wp-config.php and shows a setup screen asking for your site title, admin username, admin password, and admin email.

Click Install WordPress. Within seconds you get a success screen with a Log In button — this is why it is nicknamed the “famous 5-minute install.”

• Site title — can be changed later in Settings
• Admin username — avoid using “admin”, pick something less guessable
• Admin password — use a strong, unique password (WordPress will suggest one)
• Admin email — used for password resets and notifications

Step 4: log in and confirm it works

Go to http://localhost/mywpsite/wp-admin, enter your new admin username and password, and you should land on the WordPress dashboard.

Real-life example: Logging in for the first time is like turning the key on a car you just assembled — a smooth start confirms every part (database, config, files) was connected correctly.

What is a LAMP stack?

LAMP stands for Linux, Apache, MySQL, and PHP — the classic open-source combination used to host WordPress on real servers (Ubuntu is the most common Linux distribution for this).

Real-life example: LAMP is like the four legs of a table — Linux is the floor it stands on, Apache serves the pages, MySQL stores the data, and PHP does the cooking (logic) in between.

Install Apache, MySQL, and PHP on Ubuntu

On a fresh Ubuntu server (a VPS, for example), update your package list, then install each piece of the stack one at a time.

sudo apt update && sudo apt upgrade -y

# Apache web server
sudo apt install apache2 -y
sudo systemctl enable apache2
sudo systemctl start apache2

# MySQL database
sudo apt install mysql-server -y
sudo mysql_secure_installation

# PHP + common modules WordPress needs
sudo apt install php php-mysql php-curl php-gd php-mbstring php-xml php-zip -y
sudo systemctl restart apache2

Create the database and deploy WordPress

Log in to MySQL as root, create a dedicated database and user for WordPress (never use the root MySQL account inside wp-config.php), then download and extract WordPress into Apache's web root.

• Create a dedicated DB user — never point wp-config.php at the root MySQL account
• www-data ownership lets Apache read/write uploads and updates safely
• Visit your server's IP or domain to run the same 5-minute install as local setups

sudo mysql -u root -p

# Inside the MySQL prompt:
CREATE DATABASE wordpress_db;
CREATE USER 'wp_user'@'localhost' IDENTIFIED BY 'Str0ngP@ssword!';
GRANT ALL PRIVILEGES ON wordpress_db.* TO 'wp_user'@'localhost';
FLUSH PRIVILEGES;
EXIT;

cd /tmp
curl -O https://wordpress.org/latest.tar.gz
tar -xzvf latest.tar.gz
sudo cp -a wordpress/. /var/www/html/
sudo chown -R www-data:www-data /var/www/html/
sudo chmod -R 755 /var/www/html/

The easy way — Lost your password? link

On the wp-login.php screen, click “Lost your password?”, enter your username or email, and WordPress emails a password reset link. This works as long as your site can send email and you still have access to that inbox.

Real-life example: This is like using “forgot PIN” on a banking app — a verified channel (email) proves it is really you before granting access.

When email is not working — reset via phpMyAdmin

On local installs, outgoing email often does not work by default. In that case, reset the password directly in the database using phpMyAdmin.

Open phpMyAdmin, select your WordPress database, open the wp_users table, find your row, and edit the user_pass field. Paste a new password, then set the Function dropdown next to that field to MD5 before saving.

UPDATE wp_users
SET user_pass = MD5('MyNewStrongPassword123!')
WHERE user_login = 'admin';

Locked out completely — the wp-config.php trick

If you cannot reach phpMyAdmin either, you can add a temporary line to wp-config.php that forces a password reset email on the next login attempt, then remove that line once you are back in.

As a last resort with server access, you can also create a brand-new administrator account by inserting a row directly into wp_users and wp_usermeta tables — useful for recovering a client site with no working admin account.

• Always keep at least one recovery email that actually works
• Consider a password manager so this situation rarely happens
• For client sites, document admin credentials somewhere secure before handover

First look at wp-admin

After logging in at yoursite.com/wp-admin, you land on the Dashboard — a summary screen showing site activity, quick draft options, and WordPress news.

The left sidebar is your main control panel: Posts, Media, Pages, Comments, Appearance, Plugins, Users, Tools, and Settings. Every major task in this course happens through one of these menu items.

Real-life example: The dashboard sidebar is like the control panel of a washing machine — each button (menu item) triggers a specific job; you do not need to understand the internal wiring to use it well.

• Posts — write and manage blog-style content
• Media — your uploaded images, videos, and files
• Pages — static content like About or Contact
• Comments — moderate reader discussion
• Appearance — themes, widgets, menus, Customizer
• Plugins — install and manage add-on features
• Users — manage accounts and roles
• Settings — site title, permalinks, reading/writing preferences

The admin toolbar and quick actions

At the very top of every wp-admin screen (and even on the live site, if you are logged in) sits the admin toolbar — quick links to add new posts, check comments, and visit your live site.

Hovering over your site name on the top-left toolbar and clicking Visit Site is the fastest way to preview changes without leaving the admin area in a new tab every time.

yoursite.com/wp-admin              # dashboard home
yoursite.com/wp-admin/post-new.php # write a new post
yoursite.com/wp-admin/edit.php     # all posts list
yoursite.com/wp-admin/upload.php   # media library
yoursite.com/wp-admin/plugins.php  # installed plugins

Screen Options and Help — hidden but useful

Most admin screens have a Screen Options tab in the top-right corner. It lets you show or hide columns, adjust how many items appear per page, and simplify a cluttered list view.

Next to it, the Help tab gives quick context-sensitive documentation for whatever screen you are viewing — handy when a setting's purpose is not obvious.

Real-life example: Screen Options is like adjusting your car seat and mirrors before driving — a small setup step that makes every future trip more comfortable.

Posts vs pages — pick the right content type first

Posts are date-based, chronological content — blog articles, news updates, tutorials. They show up in your blog feed, RSS feed, and can carry categories and tags.

Pages are for static, standalone content that does not depend on time — About Us, Contact, Privacy Policy. We cover pages in detail in lesson 15.

Real-life example: Posts are like diary entries with dates — newest on top. Pages are like signboards outside a shop — About, Contact — that do not need a date because they rarely change.

Writing your first post

Go to Posts → Add New. Type a title at the top, then start writing in the block editor below it. Each paragraph, image, or list is its own “block” that you can move, style, or delete independently.

Add a Featured Image from the right sidebar (Post → Featured Image) — this image often appears in blog listings, social shares, and search results.

Real-life example: Writing in blocks is like building with stacking storage boxes — you can reorder, remove, or duplicate one box (block) without disturbing the others.

<!-- Conceptually, a good post looks like this -->
<h1>Clear, keyword-aware title</h1>
<p>A short intro paragraph that states what the reader will learn.</p>
<h2>First subheading</h2>
<p>Body content with a real-life example where useful.</p>
<h2>Second subheading</h2>
<ul>
  <li>Bullet points for scannability</li>
</ul>

Publish, schedule, or save as draft

The Publish panel on the right sidebar has three key states: Save Draft (keeps it private and unfinished), Preview (opens the post exactly as visitors will see it), and Publish (makes it live immediately).

You can also click the Publish date field to schedule a post for the future — useful for planning a content calendar in advance.

Finding and editing an existing post

Go to Posts → All Posts to see every post you have written, along with its status (Published, Draft, Scheduled), author, categories, and date.

Hover over a post title to reveal quick actions: Edit, Quick Edit, Trash, View, and sometimes Duplicate (if a plugin adds it). Quick Edit lets you change the title, slug, categories, or status without opening the full editor.

Real-life example: Quick Edit is like correcting a typo on a printed label with a pen, instead of reprinting the whole label — fast for small fixes.

• Edit — opens the full block editor for major changes
• Quick Edit — inline form for fast metadata tweaks
• Trash — soft delete, recoverable for a while
• View — opens the live published version

Revisions — your safety net

WordPress automatically saves revisions as you edit a post. In the editor's sidebar, click Revisions to see a history slider and compare or restore an older version.

This is especially useful if a client accidentally deletes a paragraph or you want to see what an older draft looked like.

Real-life example: Revisions are like a document's version history in cloud editors — a rewind button for your writing mistakes.

Deleting posts safely

Clicking Trash does not permanently delete a post — it moves it to the Trash folder, recoverable for about 30 days by default. Only Empty Trash or clicking Delete Permanently removes it for good.

Before permanently deleting a post that has been live for a while, consider whether other posts or pages link to it — broken internal links hurt both users and SEO.

Adding a link inside the block editor

Select the text you want to turn into a link, click the link icon (or press Cmd/Ctrl+K), and either paste a URL or start typing to search your own posts and pages.

You can choose to open a link in the same tab (default, better for internal links) or a new tab (common for external links, so visitors do not fully leave your site).

Real-life example: A link is a signpost pointing to another shop. Internal links point to your own aisle (keep it in the same tab); external links point across town (often opened in a new tab).

Editing and removing links

Click inside an existing linked text, and a small toolbar pops up showing the link's target URL with an Edit (pencil) icon and an Unlink icon.

Unlinking removes the hyperlink but keeps the text — useful when a URL is outdated but the phrase is still relevant.

<a href="/blog/wordpress-basics" target="_blank" rel="noopener noreferrer">
  Read our WordPress basics guide
</a>

Interlinking — why it matters for SEO and users

Interlinking means linking related posts and pages to each other inside your own site. It helps visitors discover more content and helps search engines understand which pages matter most.

A simple habit: whenever you write a new post, add 2–3 links back to older, related posts, and update those older posts to link forward to the new one.

Real-life example: Interlinking is like a library's card catalog cross-references — a reader following one topic naturally finds three more relevant books nearby.

• Link new posts to relevant older posts
• Use descriptive link text, not just “click here”
• Check for broken links periodically (a link-checker plugin helps)
• Do not overdo it — 3–6 contextual links per post is usually plenty

Uploading and browsing media

Go to Media → Library to see every image, video, and document ever uploaded to your site. You can drag-and-drop files directly onto this screen, or upload while writing a post via the Image block.

The library shows file type, upload date, and which post (if any) each file is attached to — helpful for cleaning up unused files later.

Real-life example: The Media Library is a shared photo album for your whole website — once a picture is uploaded, any post or page can reuse it without re-uploading.

Inserting and editing media in content

While editing a post, add an Image block, click Upload/Media Library/Insert from URL, then pick or upload your file. After inserting, click the image to access alignment, size, and a basic crop/rotate editor.

Always fill in the Alt Text field for every image — it describes the image for screen readers and helps search engines understand your content.

<!-- Poor: -->
<img src="img1234.jpg" alt="image" />

<!-- Good: describes the actual content -->
<img src="wordpress-dashboard-screenshot.jpg"
     alt="WordPress dashboard showing the Posts menu highlighted" />

Deleting media and managing settings

Deleting a file from the Media Library permanently removes it from your server — WordPress will warn you if it is currently used inside a post or page.

Under Settings → Media, you control the pixel dimensions WordPress automatically generates for Thumbnail, Medium, and Large image sizes whenever you upload a photo.

• Media settings control auto-generated image sizes (thumbnail, medium, large)
• Deleting an in-use image can leave a broken image icon on your site — check first
• Organize media with descriptive filenames before upload (not IMG_2031.jpg)

When to use a page instead of a post

Pages hold content that does not need a publish date and is not meant to appear in a chronological blog feed — About Us, Services, Contact, Privacy Policy, a Landing Page.

Unlike posts, pages can have Page Attributes: a Parent page (to build a hierarchy like Services → Web Design) and a Template (a different layout defined by your theme).

Real-life example: Pages are the fixed rooms of a building — reception (Home), the manager's office (About), the help desk (Contact). Posts are the notice board that changes daily.

Adding, editing, and structuring pages

Go to Pages → Add New. The editor works the same as posts — blocks, featured image, preview — but the sidebar shows Page Attributes instead of Categories/Tags.

Use the Parent dropdown to nest related pages. For example, make “Web Design” and “SEO Services” children of a parent page called “Services” — many themes then auto-generate a dropdown submenu.

Home (front page)
About
Services            <- parent
  Web Design        <- child of Services
  SEO Services       <- child of Services
Contact

Preview, publish, and delete pages

Just like posts, pages support Preview before publishing and can be moved to Trash before permanent deletion. The same “check for links pointing here” caution applies before deleting a live page.

One extra step for pages: check Settings → Reading to confirm which page (if any) is set as your Homepage or Posts page, since deleting or renaming that page can break your site's front page.

Real-life example: Deleting a page that is set as your homepage is like removing the main entrance of a building without building a new door first — visitors will not know where to walk in.

How the comment system works by default

By default, WordPress lets visitors leave comments on posts. New comments from first-time commenters usually sit in a Pending state until you approve them, based on your discussion settings.

Go to Comments in the sidebar to see all comments across your site, filterable by Pending, Approved, Spam, and Trash.

Real-life example: Comment moderation is like a suggestion box at a restaurant — the manager reads notes before pinning the good ones on the public board.

• Approve — makes the comment visible to all visitors
• Reply — respond directly from the admin screen
• Spam — flags it as unwanted, trains the spam filter
• Trash — removes it from public view, recoverable

Fighting spam comments

Akismet, which comes pre-installed with most WordPress sites, automatically filters obvious spam comments into a Spam folder using a shared database of known spam patterns.

For heavily spammed sites, adding a CAPTCHA plugin or requiring users to be registered/logged-in to comment cuts down spam significantly.

Settings → Discussion:
  [x] Comment author must fill out name and email
  [x] Comment must be manually approved
  [x] Comment author must have a previously approved comment
  Hold a comment in queue if it contains: 2  (or more) links

Disabling comments entirely

Many business sites (portfolios, service pages) turn comments off completely. Under Settings → Discussion, uncheck “Allow people to submit comments on new posts.”

This only applies going forward — to disable comments on existing posts in bulk, select all posts in Posts → All Posts, choose Edit from the Bulk actions dropdown, and set Comments to Do not allow.

• New sites: disable at Settings → Discussion before publishing anything
• Existing sites: use Bulk Edit to turn off comments on old posts too
• Pages rarely need comments enabled by default in WordPress

What categories are for

Categories are broad topic buckets for your posts — think of them as the table of contents of your blog. Every post belongs to at least one category (Uncategorized by default if you skip choosing one).

Real-life example: Categories are like sections in a bookstore — Fiction, Cooking, Technology. A book (post) sits on one main shelf even if it could loosely fit elsewhere.

Adding, editing, and organizing categories

Go to Posts → Categories. Add a new one by typing a Name (the slug auto-generates), optionally choosing a Parent category to create a hierarchy, and writing a short Description some themes display.

Editing renames a category everywhere it is used automatically — you do not need to update each post individually. Deleting a category does not delete its posts; they just fall back to Uncategorized (or another chosen category) unless reassigned.

WordPress            <- parent category
  Themes             <- child
  Plugins            <- child
Web Development
SEO Tips

How many categories is “too many”?

A common beginner mistake is creating a new category for almost every post. Keep your top-level category count small (5–10 for most blogs) and use tags (next lesson) for more granular labeling.

Real-life example: If a bookstore had 200 tiny sections, customers would get lost. A handful of clear sections plus a good search function (tags) works far better.

Tags vs categories — the key difference

Tags are specific, granular keywords describing a post's details, while categories are broad topic buckets. A post can have zero, one, or many tags, but should usually have exactly one main category.

Real-life example: If categories are bookstore sections, tags are the sticky notes a librarian adds — “beginner-friendly”, “2026 update”, “free tools” — cutting across multiple sections.

• Category: WordPress (broad section)
• Tags: plugins, security, beginners, 2026-guide (specific labels, can span categories)

Adding and managing tags

While writing a post, add tags directly in the sidebar's Tags panel — type a word and press Enter, or pick from existing tags as you type.

To manage tags globally (rename, merge duplicates, delete), go to Posts → Tags. This is useful for cleaning up near-duplicate tags like “seo-tips” and “SEO Tips” that accumulated over time.

Category: WordPress
Tags: beginners, dashboard, tutorial, 2026

Deleting tags safely

Deleting a tag removes the label from every post that used it, but does not delete the posts themselves. If you rename a tag by mistake, note that its URL slug may change too, which can affect any bookmarked tag archive links.

Installing and activating a theme

Go to Appearance → Themes → Add New to search the official theme directory. Click Install, then Activate, and your site's design changes immediately — your content stays exactly the same.

You can also upload a theme .zip file downloaded from a premium marketplace using the Upload Theme button on the same screen.

Real-life example: Activating a new theme is like changing the wallpaper and furniture layout of a room while keeping all your belongings (posts, pages, media) exactly where they were.

The Customizer and Full Site Editing

Classic themes use Appearance → Customize, a live-preview panel where you adjust site identity (logo, title), colors, menus, and widgets, seeing changes before publishing them.

Modern block-based themes instead show Appearance → Editor (the Site Editor), letting you edit the header, footer, and templates visually using the same block system as posts and pages.

• Customizer — for classic (non-block) themes: live-preview panel, Publish when ready
• Site Editor — for block themes: edit templates and template parts with blocks
• Both let you change logo, colors, and typography without code

Child themes — customizing safely

If you need to edit a theme's code directly, never edit the parent theme's files — an update will erase your changes. Instead, create a child theme that inherits the parent's styles and functionality.

Real-life example: A child theme is like writing sticky notes on top of a rented textbook instead of highlighting directly in ink — your notes (customizations) survive even if the textbook (parent theme) gets replaced with a newer edition (update).

/* style.css */
/*
 Theme Name: My Child Theme
 Template: parent-theme-folder-name
*/

/* functions.php */
<?php
add_action( 'wp_enqueue_scripts', function () {
    wp_enqueue_style( 'parent-style', get_template_directory_uri() . '/style.css' );
});

Widgets — small content blocks for sidebars and footers

Widgets are reusable content blocks — a search box, a recent posts list, a text block — that you drag into designated areas like a sidebar or footer, defined by your theme.

Manage them at Appearance → Widgets (block themes may fold this into the Site Editor instead). Each widget area is independent — a widget added to the sidebar does not automatically appear in the footer.

Real-life example: Widgets are like magnets on a fridge — small, movable, and placed wherever there is a designated magnetic surface (widget area) on your theme.

• Search — a search box widget
• Recent Posts — links to your latest content
• Custom HTML — for embedding third-party scripts or custom markup
• Navigation Menu — displays a menu you built (see below)

Creating and assigning navigation menus

Go to Appearance → Menus, click Create a new menu, name it, and drag Pages, Posts, Categories, or Custom Links into it from the left panel.

Under Menu Settings, assign the menu to a Display location defined by your theme — commonly “Primary Menu” for the header and “Footer Menu” for the footer.

Primary Menu:
  Home
  About
  Services         <- can have Web Design, SEO as sub-items
  Blog
  Contact

Background image and site identity

Some classic themes support Appearance → Background or Header, letting you set a custom background image or color for the whole site through the Customizer.

Site identity settings — the site title, tagline, and site icon (favicon) — are usually the first thing to configure after activating a new theme, since they appear in browser tabs and search results.

Real-life example: Setting the site title and favicon early is like hanging your shop's signboard before opening day — small, but it is the first thing every visitor notices.

Installing plugins from the dashboard

Go to Plugins → Add New, search for a plugin by name or feature, click Install Now, then Activate. Most plugins add a new settings page under Settings, or their own top-level menu item in the sidebar.

Real-life example: Installing a plugin is like plugging a new appliance into a wall socket — the socket (WordPress core) already supports it, you just need to switch it on (activate).

wp plugin install wordfence --activate
wp plugin list
wp plugin deactivate hello-dolly
wp plugin delete hello-dolly

Installing a plugin from GitHub or a zip file

Not every plugin is listed on WordPress.org. Developers often share plugins as a GitHub repository. Download the repository as a .zip (Code → Download ZIP on GitHub), then go to Plugins → Add New → Upload Plugin in wp-admin and select that file.

You can also upload the zip via FTP by extracting it directly into wp-content/plugins/ on your server, then activating it from the Plugins screen.

# After downloading and extracting a plugin folder named "my-plugin"
scp -r my-plugin user@yourserver:/var/www/html/wp-content/plugins/
# Then activate it from Plugins → Installed Plugins in wp-admin

Managing installed plugins

Keep the plugin count lean — every active plugin adds some load time and a potential security surface. Regularly review Plugins → Installed Plugins and remove anything unused (deactivate, then delete).

Check for update notices often. Outdated plugins are one of the most common ways WordPress sites get hacked.

• Deactivate before delete — WordPress requires this two-step process
• Check plugin ratings, last-updated date, and active installs before choosing one
• Too many plugins doing similar jobs (e.g. two SEO plugins) can conflict

Why an SEO plugin matters

WordPress generates clean URLs by default, but an SEO plugin like Yoast SEO or All in One SEO (AIOSEO) adds structured control: per-page titles, meta descriptions, XML sitemaps, and readability checks.

Real-life example: WordPress core builds the shop; an SEO plugin is the signboard writer who makes sure every aisle (page) has a clear, search-friendly label.

Setting up Yoast SEO (or AIOSEO) step by step

After activating either plugin, run its setup wizard: choose your site type (blog, business, e-commerce), connect Google Search Console, and confirm your preferred social media accounts for Open Graph tags.

On every post and page, scroll to the SEO meta box below the editor. Fill in a Focus Keyphrase, an SEO Title, and a Meta Description — both plugins give a red/orange/green traffic-light score as feedback.

<!-- Weak: -->
<meta name="description" content="This is our blog post about WordPress." />

<!-- Good: specific, includes a reason to click, right length (~150-160 chars) -->
<meta name="description"
      content="Learn how to install WordPress locally in 10 minutes with XAMPP — step-by-step for absolute beginners, no coding needed." />

XML sitemaps and Search Console

Both plugins auto-generate an XML sitemap (usually at yoursite.com/sitemap_index.xml or similar) listing every public post and page for search engines to crawl efficiently.

Submit this sitemap URL inside Google Search Console so Google discovers new and updated content faster, instead of waiting to find it by chance.

• Sitemap — a map of your content for search engine crawlers
• Search Console — Google's free tool to monitor indexing and search performance
• Focus keyphrase — the main search term you want a page to rank for

Image optimization plugins

Plugins like Smush, ShortPixel, or Imagify automatically compress images on upload, and can also convert them to modern formats like WebP for faster loading without a visible quality drop.

Real-life example: Image compression plugins are like vacuum-sealing clothes before a trip — same content, far less space taken, which means faster page loads for visitors on slow connections.

• Compress on upload — shrinks new images automatically
• Bulk optimize — cleans up your existing Media Library
• Lazy loading — images load only as visitors scroll to them (WordPress core also does this natively now)

BlogVault — backups and staging

BlogVault is a backup plugin/service that takes scheduled, off-server copies of your entire site (files + database), so you can restore quickly if something breaks or gets hacked.

It also offers a staging environment — a private copy of your live site where you can test a risky plugin update or design change before applying it to the real site.

Real-life example: A staging site is a dress rehearsal before opening night — you catch mistakes on a practice stage instead of in front of the real audience (your visitors).

MonsterInsights — analytics inside wp-admin

MonsterInsights connects your site to Google Analytics and shows key stats — top posts, traffic sources, device breakdown — directly inside your WordPress dashboard, without needing to log into a separate Analytics account for quick checks.

This is useful for content decisions: seeing which posts actually get read helps you decide what topics to write about next.

• Connects Google Analytics without editing theme code manually
• Dashboard widget shows quick traffic summaries
• Useful reports: top posts/pages, referral sources, search terms

The five default user roles

WordPress ships with five built-in roles, each with a different level of access: Administrator (full control), Editor (manage all content), Author (write/publish own posts), Contributor (write but not publish), and Subscriber (manage own profile only, common on membership sites).

Real-life example: Roles are like staff badges in an office — the manager (Administrator) has a master key, the editor reviews everyone's reports, an intern (Contributor) can draft a report but needs sign-off before it is filed.

• Administrator — install plugins/themes, manage users, edit everything
• Editor — publish and manage all posts/pages, including other users' content
• Author — publish and manage only their own posts
• Contributor — write posts but cannot publish them (needs review)
• Subscriber — read-only access plus a personal profile, common for comments/membership

Adding users and assigning roles

Go to Users → Add New, fill in username, email, and choose a role from the dropdown. WordPress can auto-generate a strong password and email login details.

Assign the least privilege needed for the job — a guest blogger should usually be a Contributor or Author, not an Administrator.

wp user create janedoe jane@example.com --role=author --send-email

Profile photo and personal profile settings

WordPress uses Gravatar (Globally Recognized Avatar) by default — a profile photo tied to a user's email address across any Gravatar-enabled site. Create a free Gravatar account with the same email as your WordPress account to have your photo appear automatically.

Each user edits their own bio, display name, and contact info at Users → Profile, without needing Administrator access — useful for author bio boxes on posts.

General and Writing settings

Settings → General controls your Site Title, Tagline, WordPress Address (URL), Site Address (URL), timezone, and default date/time formats — usually the very first screen to check after install.

Settings → Writing controls the default post category, default post format, and options for posting via email (a legacy feature rarely used today).

Reading and Discussion settings

Settings → Reading decides whether your homepage shows Your latest posts (blog-style) or A static page (business-style, pointing to a specific page you choose). It also controls how many posts show per page and whether search engines are allowed to index your site.

Settings → Discussion controls comment behavior globally — whether comments are allowed by default, moderation rules, and avatar display (covered more in lesson 16).

Settings → Reading:
  Your homepage displays: A static page
    Homepage: "Home"
    Posts page: "Blog"
  Search engine visibility: (leave unchecked once site is ready to launch)

Media and Permalinks settings

Settings → Media sets the pixel dimensions for auto-generated Thumbnail, Medium, and Large image sizes (see lesson 14 for more on media handling).

Settings → Permalinks controls your URL structure. Post name (e.g. /sample-post/) is the most SEO-friendly and readable option — the default Plain structure (?p=123) should almost never be used for a real site.

Settings → Permalinks:
  ( ) Plain               /?p=123
  ( ) Day and name        /2026/07/28/sample-post/
  (x) Post name           /sample-post/    <- recommended
  ( ) Custom structure

The basics: updates, passwords, and login limits

Most WordPress hacks exploit outdated software — an old plugin, theme, or WordPress core version with a known vulnerability. Enable auto-updates where possible, and check Dashboard → Updates regularly.

Use strong, unique passwords for every account, and install a login-limiting plugin (or your host's built-in protection) to block repeated failed login attempts, which stops brute-force attacks.

Real-life example: An outdated plugin is like leaving a spare key under the doormat that everyone in the neighborhood already knows about — updates change the lock before someone finds it.

Hardening checklist

Beyond updates and passwords, a handful of extra steps meaningfully reduce risk without needing deep technical skill.

• Rename the default “admin” username if you still use it
• Enable two-factor authentication (2FA) for all Administrator accounts
• Install an SSL certificate (https) — many hosts offer this free
• Use a security plugin (Wordfence, Sucuri) for firewall and malware scanning
• Hide your WordPress version number from public view
• Restrict file editing from the dashboard (Appearance/Plugin editor) on production sites

<?php
// Prevents editing theme/plugin files directly from wp-admin
define( 'DISALLOW_FILE_EDIT', true );

Database and file backups

A backup should cover two things: your database (posts, settings, comments — stored in MySQL) and your files (themes, plugins, uploads, in wp-content/). Losing either one means an incomplete restore.

Use a backup plugin (UpdraftPlus, BlogVault) to schedule automatic backups to an external location like Google Drive, Dropbox, or Amazon S3 — never rely only on backups stored on the same server.

# Export (backup) the database
mysqldump -u wp_user -p wordpress_db > backup-2026-07-28.sql

# Restore from a backup file
mysql -u wp_user -p wordpress_db < backup-2026-07-28.sql

Login page, static front page, and footer

The default login page lives at yoursite.com/wp-login.php. You can customize its logo and styling with a plugin, or replace the URL for security using a login-URL-changer plugin.

To set a static front page (instead of a blog feed), create two pages (e.g. “Home” and “Blog”), then go to Settings → Reading and assign them as covered in lesson 25.

Footer content — copyright text, quick links, social icons — is usually edited through Appearance → Widgets (classic themes) or the Site Editor's footer template part (block themes).

1. Open the page you want to duplicate
2. Select all content blocks (Cmd/Ctrl + A) and copy
3. Create a new page, paste the content
4. Rename the title and adjust as needed
# For frequent duplication, a plugin like "Duplicate Page" automates this in one click

Embedding video, adding a favicon, and a contact form

To embed a YouTube or Vimeo video, simply paste the video URL on its own line inside the block editor — WordPress automatically converts it into an embedded player (no HTML needed).

Set your favicon (the small icon in browser tabs) at Appearance → Customize → Site Identity → Site Icon, using a square image at least 512×512px.

For a contact form, install a plugin like WPForms or Contact Form 7, build the form visually or with simple shortcodes, then paste that shortcode into any page.

<!-- After creating a form in Contact Form 7, it gives you a shortcode -->
[contact-form-7 id="123" title="Contact form 1"]

<!-- Paste this shortcode into any Page's content to display the form -->

Google Analytics and renaming your blog

Connect Google Analytics either through a plugin like MonsterInsights (recommended for beginners, no code) or by manually pasting the tracking snippet into your theme's header via a “header/footer scripts” plugin.

To rename your blog/site, simply update the Site Title under Settings → General — this does not change your domain name or URLs, just the displayed name.

Adding a subdomain and changing the logo URL

A subdomain like blog.yoursite.com or shop.yoursite.com is created through your hosting/domain provider's DNS settings, then pointed at either the same WordPress install (multisite) or a completely separate one.

The site logo, set at Appearance → Customize → Site Identity, links to the homepage by default. To point it elsewhere (rare, but sometimes needed), a small snippet in your child theme's functions.php can override the default logo link filter.

<?php
add_filter( 'get_custom_logo', function ( $html ) {
    return str_replace( home_url( '/' ), 'https://yoursite.com/special-landing/', $html );
});

Making a multilingual site

The most common approach is a plugin like WPML or Polylang, which lets you write each post/page in multiple languages and shows a language switcher to visitors.

Real-life example: A multilingual plugin is like a restaurant menu printed in two languages back-to-back — same dishes (content), readable by more guests.

• Polylang — free, good for straightforward multilingual sites
• WPML — premium, more advanced features and support
• Always assign a language to every post/page — untranslated content shows gaps

Clearing cache and enabling maintenance mode

If you use a caching plugin (WP Super Cache, W3 Total Cache, or your host's built-in cache), clear/purge the cache after major changes — otherwise visitors might see an old, stale version of your page.

Before big changes (a theme switch, major plugin update, or redesign), enable Maintenance Mode with a plugin like WP Maintenance Mode, showing visitors a friendly “back soon” page instead of a half-broken site.

wp cache flush

Archiving old posts and managing rights/roles

To archive outdated content without deleting it, either move it to Draft status, or use a plugin like PublishPress Future to auto-unpublish posts on a schedule.

Review Users → All Users periodically and remove or downgrade accounts that no longer need Administrator or Editor access — this is basic digital hygiene, similar to revoking a former employee's office keys.

Why Gutenberg replaced the old classic editor

Before 2018, WordPress used a single large text box (the Classic Editor) with formatting buttons, similar to an old-school word processor. Gutenberg, introduced in WordPress 5.0, broke content into individual blocks — paragraphs, images, columns, buttons, embeds — each independently editable and stylable.

This block model is not just a visual editor upgrade — it is the foundation for Full Site Editing, where even your header, footer, and page templates become editable blocks, not just post content.

Real-life example: The Classic Editor is one long scroll of paper. Gutenberg is a set of labeled index cards you can rearrange, resize, and restyle individually — much easier to build a varied, magazine-style layout.

Core blocks worth mastering

A handful of blocks cover 90% of real content needs: Paragraph and Heading for text, Image and Gallery for visuals, Columns for side-by-side layouts, Button for calls to action, and Group for wrapping several blocks together with shared background or spacing.

The / (forward slash) shortcut is the fastest way to insert any block — type / followed by a block name inside the editor to search and insert without touching the mouse.

• Group — wraps blocks together for shared spacing/background
• Columns — side-by-side layout, great for feature comparisons
• Cover — full-width image or color block with overlaid text
• Query Loop — pulls in a dynamic list of your latest posts (advanced but powerful)

<!-- wp:heading -->
<h2 class="wp-block-heading">Why choose Rishtaara?</h2>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>We teach practical, real-life examples — not just theory.</p>
<!-- /wp:paragraph -->

Reusable blocks and patterns — the productivity unlock

A Reusable Block (now called a “Synced Pattern”) lets you build something once — like a call-to-action box or a course promo banner — and reuse it across many posts. Editing the original updates every place it is used.

Block Patterns, by contrast, are just starting-point layouts you can insert and then freely customize per page, without staying synced to the original.

Real-life example: A Synced Pattern is a rubber stamp — change the stamp design once, and every future stamp (and even past ones, since it's synced) updates. A regular Pattern is a photocopy — you can scribble on your copy without affecting the original.

• Synced pattern — one edit updates everywhere it's used (great for a shared banner)
• Unsynced pattern — a reusable starting layout you can customize freely per use
• Use synced patterns for site-wide elements like a newsletter signup box

Why build your own plugin?

You do not need to be a professional developer to write a small custom plugin. A plugin is simply a PHP file with a special comment header, placed inside wp-content/plugins/, that WordPress detects and lets you activate.

Writing your own tiny plugin — instead of copy-pasting snippets into your theme's functions.php — is the safer, more portable way to add custom code, since it survives even if you switch themes.

Real-life example: Putting custom code in a plugin instead of your theme is like keeping your personal documents in your own folder instead of a shared office drawer — moving offices (changing themes) will not lose your files.

Step 1: the plugin file and header

Create a new folder inside wp-content/plugins/, for example rishtaara-hello, and inside it a PHP file with the same name, rishtaara-hello.php. The comment block at the top is what WordPress reads to register the plugin.

<?php
/**
 * Plugin Name: Rishtaara Hello Widget
 * Description: A tiny example plugin that adds a friendly message to every post.
 * Version: 1.0
 * Author: Your Name
 */

// Always guard against direct file access
if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

Step 2: hook into WordPress with actions and filters

WordPress runs on hooks — actions (do something at a certain point) and filters (modify a piece of data before it is used). Our example plugin will use the_content filter to append a message to the end of every post.

• add_action() — run custom code when something happens (e.g. wp_head, save_post)
• add_filter() — modify data as it passes through WordPress (e.g. the_content, the_title)
• is_single() — checks we are on a single post page, not an archive or homepage

<?php
function rishtaara_append_message( $content ) {
    if ( is_single() && in_the_loop() && is_main_query() ) {
        $content .= '<p><em>Thanks for reading — more at Rishtaara!</em></p>';
    }
    return $content;
}
add_filter( 'the_content', 'rishtaara_append_message' );

Step 3: activate, test, and add a settings page (optional)

Go to Plugins → Installed Plugins in wp-admin, find “Rishtaara Hello Widget,” and click Activate. Visit any single post to see your custom message appear at the end.

For a real plugin, you would typically also register a settings page (using add_options_page) so users can customize the message text without editing PHP — a natural next step once you are comfortable with hooks.

<?php
add_action( 'admin_menu', function () {
    add_options_page(
        'Rishtaara Hello Settings',
        'Rishtaara Hello',
        'manage_options',
        'rishtaara-hello',
        function () {
            echo '<h1>Rishtaara Hello Settings</h1><p>Settings form goes here.</p>';
        }
    );
});

What WooCommerce adds to WordPress

WooCommerce is a free plugin that turns a regular WordPress site into a full online store — product catalog, shopping cart, checkout, order management, and payment gateway integration.

It is by far the most widely used e-commerce plugin for WordPress, and one of the most popular e-commerce platforms overall, precisely because it builds on the WordPress content skills you already have.

Real-life example: Adding WooCommerce to WordPress is like adding a cash register and shelving system to a space you have already decorated (your existing WordPress site) — the walls and rooms (content) stay, commerce gets bolted on.

Installing WooCommerce and the setup wizard

Install WooCommerce like any plugin (Plugins → Add New → search “WooCommerce” → Install → Activate). Activating it launches a setup wizard asking for your store's location, currency, industry, and preferred payment methods.

The wizard automatically creates essential pages for you — Shop, Cart, Checkout, and My Account — using shortcodes/blocks that render dynamically.

wp plugin install woocommerce --activate

Adding your first product

Go to Products → Add New. Enter a title, description, and set the Product Data panel below — Simple product (one price/variant) or Variable product (e.g. sizes and colors, each with its own price/stock).

Fill in the Regular Price, optional Sale Price, a Product Image, and manage stock quantity under the Inventory tab if you want WooCommerce to track how many are left.

• Simple product — one price, one SKU, no variants
• Variable product — multiple variants (size/color), each with its own price and stock
• Product categories/tags work almost exactly like blog categories/tags

How cart and checkout work behind the scenes

When a visitor clicks Add to Cart, WooCommerce stores that selection in a session (a cookie-based memory tied to their browser) until they either check out or the session expires.

At Checkout, WooCommerce collects shipping/billing details, calculates tax and shipping if configured, and hands off payment to your chosen gateway before creating an Order record you can manage under WooCommerce → Orders.

Real-life example: The cart is like a shopping basket you carry around a physical store — nothing is charged until you reach the checkout counter (Checkout page) and pay.

Pre-launch checklist for a real WordPress site

Before handing a site to a client or making it public, run through a consistent checklist. This catches the most common beginner mistakes in one pass.

Real-life example: This checklist is like a pilot's pre-flight checklist — boring to repeat every time, but it is exactly what catches the one mistake that would otherwise cause a problem mid-flight.

• Uncheck “Discourage search engines” under Settings → Reading
• Set a Post name permalink structure before real traffic arrives
• Confirm SSL (https) is active and forced site-wide
• Set up automatic off-server backups (files + database)
• Install and configure an SEO plugin with a submitted sitemap
• Rename any default “admin” username and enable 2FA
• Test the contact form and confirm you actually receive submissions
• Check mobile responsiveness and page-load speed

Choosing WordPress.com vs WordPress.org — final guidance

If a project needs custom plugins, a specific theme, a WooCommerce store, or any real growth ambition, choose WordPress.org self-hosted — the flexibility pays off quickly.

If someone truly wants a simple personal blog with zero maintenance and does not mind platform limits, WordPress.com's paid plans can be reasonable — but for freelance and business work, self-hosted .org is almost always the right recommendation.

Frequently asked questions

A few questions come up again and again from students finishing this course — here are direct answers.

• Do I need to know PHP to use WordPress? — No, for day-to-day content work. PHP helps once you build custom plugins or themes (lesson 30).
• Is WordPress secure? — WordPress core is well-maintained, but sites get hacked mostly through outdated plugins, weak passwords, and poor hosting — the checklist above addresses this directly.
• Can I move a WordPress site to a different host later? — Yes, using a migration plugin (like Duplicator) or manual file + database export/import.
• What is the difference between a theme and a page builder? — A theme defines the base design; page builders (Elementor, Divi) add drag-and-drop layout tools on top of, or instead of, the Customizer/Site Editor.
• How many plugins is too many? — There is no fixed number; the real question is whether each plugin is actively used, updated, and not duplicating another plugin's job.