How I set up, extend and run WordPress sites: local setup, child themes, plugins and hooks, WooCommerce, speed, SEO, security and headless builds.
New web tools appear all the time, but WordPress still runs more than 43% of websites. I build on Shopify and Webflow too, and the thing I value most in WordPress is its flexibility. The same platform handles a simple blog or a complex store, and I can add features without starting from scratch each time. This guide covers how I set up, extend, optimize and secure WordPress sites, plus a few more advanced techniques.
WordPress started in 2003 as a basic blogging tool by Matt Mullenweg and Mike Little. It has stayed around because it's accessible and driven by a large community. Today it handles responsive design, SEO and even headless setups, and recent releases such as 6.6 have made full-site editing much easier to use. Having moved many client projects between platforms, I see WordPress as a middle ground: easier than writing everything in code, but without the limits of a closed system.
Setting up your environment
Start with a good local environment. I use Local by Flywheel, which creates a working WordPress install in a few clicks, complete with PHP, MySQL and an SSL certificate, so there's no server to configure. Once the site is running, put it under Git. Version control lets you track changes, work with others and roll back mistakes easily.
For the live site, choose hosting built for WordPress. Providers like SiteGround or Kinsta include caching for speed and automatic backups. Installing WordPress is simple: download the latest version from the official site, upload it by FTP, create a database and run the five-minute installer.
After installing, I always set up permalinks for clean URLs, configure user roles and install a starter theme like Twenty Twenty-Five to get familiar with the block editor. These steps take a few minutes and prevent performance and security problems later.
Themes and child themes
A theme is the set of files that controls how your content looks. That includes style.css for styling and template files like header.php and footer.php. With full-site editing, much of this can now be changed from the dashboard, which feels closer to a visual tool like Webflow than to traditional theme coding.
For custom design work, use a child theme. It overrides specific parts of the parent theme, and your changes survive when the parent updates. Create a style.css that references the parent theme, then enqueue the stylesheet in the child theme's functions.php. This has saved me and my clients a lot of revision time.
Plugins and custom code
The official repository has over 60,000 plugins, from Contact Form 7 for forms to Yoast for SEO. You search, install, activate and configure them from the dashboard. Still, I'd advise against relying on them too much. Each plugin adds weight, can slow the site and increases the security risk. I try to stick to a small set, for example WP Rocket for caching, Advanced Custom Fields for custom data and Wordfence for security, and keep an eye on them.
When a plugin doesn't fit, write custom code. WordPress is built around "the Loop", which fetches and displays posts. Whether you're building a blog archive or a portfolio page, you wrap your output in an if ( have_posts() ) loop.
Hooks extend this. Actions let you run code at a specific point, such as adding a script to the header. Filters let you change output, such as shortening an excerpt or adding a disclaimer to posts. You can add both in functions.php or in a custom plugin. Registering a custom post type for testimonials, with thumbnail and editor support, only takes a few lines of PHP hooked to init. That level of control is something I miss on platforms like Shopify, which rely more on APIs.
Running a store with WooCommerce
WooCommerce is a free plugin that turns WordPress into a full online store with products, cart and payments. Setup is guided by a wizard: enter your store details, connect a gateway like Stripe and add products.
What I like most is how far it can be extended. Hooks let you build a custom checkout flow, and you can connect email services for abandoned cart recovery. On projects where I've combined WooCommerce with a blog, readers moved naturally from articles to product pages and conversions rose noticeably. Compared with dedicated e-commerce platforms, WooCommerce handles content better, which suits brands that sell through storytelling.
Speed and SEO
A WordPress site needs to be fast and easy to find. For speed, I focus on four things:
- Caching: plugins like WP Super Cache serve static HTML pages and reduce server load.
- Images: convert to WebP and turn on lazy loading. This alone can save seconds.
- Database: clear out old revisions and transients regularly so queries stay quick.
- CDN: a service like Cloudflare serves files from locations near your visitors, so international users get fast pages too.
On client sites where I've applied all of these, Core Web Vitals scores improved significantly and bounce rates went down.
WordPress gives you a head start on SEO with clean permalinks and XML sitemaps. Yoast helps with meta titles, descriptions and readability. Beyond that:
- Use a tool like Ahrefs to find long-tail keywords and work them into your content where they fit naturally.
- Add schema markup so search results can show richer snippets.
- Link related pages together to show search engines how your content connects.
- Show experience and expertise (E-E-A-T) with author bios and case studies.
Done well, this brings organic traffic that grows over time and turns one-time visitors into returning readers.
Security basics
Security tends to be ignored until something goes wrong. Most of it comes down to habits:
- Update WordPress core, themes and plugins promptly, since vulnerabilities are patched quickly.
- Use strong passwords and two-factor authentication, and limit login attempts with a plugin like iThemes Security.
- Harden wp-config.php by disabling file editing and defining salts.
- Scan regularly for malware with Wordfence or MalCare.
- Automate backups to off-site storage so recovery is quick.
In my audits, around 80% of breaches come from easily fixed mistakes, such as keeping the default "admin" username. Fixing those upfront is far easier than cleaning up afterward.
Headless builds and integrations
Headless WordPress separates the content from the front end. WordPress serves content through the REST API or GraphQL, and a framework like React or Next.js builds the site visitors see. This Jamstack approach scales well for high-traffic sites and works with static hosts such as Vercel. I've built a few of these. Editors keep the familiar admin, while visitors get a fast, modern front end.
Integrations add a lot without much effort. Zapier can send form submissions to your CRM, Google Analytics shows how people use the site and the Mailchimp plugin lets you nurture leads directly from it. AI tools for block patterns and content suggestions are appearing too, and the block system makes them easier to add as plugins.
Keeping your skills current
WordPress keeps adapting, with growing support for progressive web apps and experiments like Web3 features. Sites like WP Tavern help you follow what's changing, and companies like Automattic keep investing in the platform.
The best way to stay sharp is to keep building. Test ideas on a local server, contribute to open-source projects and try other tools alongside WordPress. Working across WordPress, Shopify and Webflow has made me a better developer, and WordPress is still the most versatile of the three. If you're stuck on a WordPress problem, leave a comment and I'll try to help.
If you want a hand with your own site, see my WordPress development services.
Category: WordPress
