10 WordPress Settings You Should Change Immediately

WordPress ships with defaults that are intentionally permissive. "Site Title: My WordPress Website." Default "admin" username. Pingbacks enabled. File editing accessible. Search engines discouragement buried where you won't find it.

These defaults aren't mistakes. They're designed to work for anyone. They don't work for anyone in particular. Which means they don't work for you.

These 10 settings changes take 15 minutes and prevent 90% of common WordPress problems (hacks, slow performance, poor SEO, spam).

Setting #1: Permalink Structure (Do This FIRST)

Why it matters: Default WordPress permalinks look like yoursite.com/?p=123. Search engines hate these. They're not readable. They don't contain keywords. They don't help SEO.

The default: Plain

What to change it to: Post name

How to change it:

  1. Go to Settings > Permalinks
  2. Select "Post name"
  3. Click Save Changes

Result: Posts now have URLs like yoursite.com/how-to-optimize-wordpress/ instead of yoursite.com/?p=432. The URL now shows the keyword, helps SEO, and is readable for humans.

āš ļø CRITICAL WARNING: Do this BEFORE publishing any posts. Changing permalinks after you've published creates broken URLs and requires redirects. If you're fixing an existing site, use a plugin like Redirect all Old Post URLs or Better Search Replace to fix them.

Expected impact: Better SEO (keywords in URL), cleaner-looking links, higher CTR from search results.

Setting #2: Uncheck "Discourage Search Engines From Indexing This Site"

Why it matters: WordPress has a checkbox called "Discourage search engines from indexing this site." It's enabled by default during installation. If you leave it on, Google won't index your site.

This is the #1 reason new WordPress sites never get search traffic. The site is live, content is published, but Google refuses to index it because of this one checkbox.

Where it is: Settings > Reading

How to fix it:

  1. Go to Settings > Reading
  2. Look for "Search Engine Visibility"
  3. Make sure the checkbox "Discourage search engines from indexing this site" is UNCHECKED
  4. Click Save Changes

When to leave it checked: Only during development or staging. Uncheck it when your site goes live.

Expected impact: Without this, your site ranks for nothing. With it unchecked, Google can index your content and you can actually get search traffic.

Setting #3: Change the Admin Username (Delete "admin")

Why it matters: The default WordPress admin username is "admin". Hackers know this. They run automated attacks targeting the "admin" account. Changing the username eliminates 99% of brute-force login attacks.

The fix (5 minutes):

  1. Go to Users > Add New
  2. Create a new user with a unique, non-guessable username (e.g., "james_admin" not "admin")
  3. Set role to Administrator
  4. Set a strong password (16+ characters, mix of upper/lower/numbers/symbols)
  5. Uncheck "Send this user a confirmation email" (optional)
  6. Click Add New User
  7. Log out
  8. Log back in with your NEW username
  9. Go to Users > All Users
  10. Click on the "admin" user
  11. At the bottom, change "Delete" and select "Attribute all posts and links to: [your new username]"
  12. Click Delete

Result: The "admin" account no longer exists. Attacks targeting "admin" fail immediately. Your account is now secure.

Expected impact: Failed login attempts drop by 99%. You stop seeing brute-force attack logs.

Setting #4: Set Timezone Correctly

Why it matters: WordPress defaults to UTC (Coordinated Universal Time). This breaks scheduled posts, scheduled emails, and your analytics dashboards which show wrong times.

Example: You schedule a post for 9 AM. WordPress thinks it's UTC (UTC-4 hours from US Eastern). So the post publishes at 1 PM instead of 9 AM. Your audience misses it.

The fix:

  1. Go to Settings > General
  2. Scroll to "Timezone"
  3. Select your timezone (e.g., "America/New_York", "Europe/London", "Asia/Tokyo")
  4. Click Save Changes

Expected impact: Scheduled posts publish at the correct time. Analytics timestamps match your local time. No more confusion.

Setting #5: Disable Pingbacks and Trackbacks

Why it matters: Pingbacks and trackbacks are old WordPress features (pre-2010) that let other sites notify you when they link to yours. Sounds nice. But 99% of pingbacks/trackbacks are spam, and they cause performance problems.

The fix:

  1. Go to Settings > Discussion
  2. UNCHECK: "Allow link notifications from other blogs" (pingbacks)
  3. Scroll down and UNCHECK: "Allow Trackbacks and Pingbacks"
  4. Click Save Changes

Result: Spam pingbacks stop. Your site doesn't send out notifications that nobody wants. Performance improves slightly (fewer database hits).

Expected impact: 80% reduction in comment spam. Faster page loads.

Setting #6: Disable File Editing (Prevent Accidental Damage)

Why it matters: WordPress allows editing theme and plugin files directly in the dashboard (Appearance > Theme File Editor). This is dangerous because:

  • One wrong character breaks your entire site
  • Hackers can use this to inject malicious code
  • You can't see what changed or undo it easily

The fix (1 line of code):

  1. Connect via FTP or File Manager
  2. Open wp-config.php (in WordPress root)
  3. Add this line (somewhere above "That's all, stop editing!"):
define( 'DISALLOW_FILE_EDIT', true );
  1. Save and upload

Result: The Theme/Plugin File Editor disappears from the dashboard. You can only edit files via code editor or FTP (which is safer because you can version control it).

Expected impact: Prevents accidental file damage. Closes a security hole.

Setting #7: Disable XML-RPC (Close a Security Hole)

Why it matters: XML-RPC is a protocol that lets external apps (like mobile apps, scheduled posting tools) communicate with WordPress. It's rarely used today. But hackers abuse it to brute-force your login and cause performance problems.

The fix (1 line of code):

  1. Connect via FTP or File Manager
  2. Open wp-config.php
  3. Add this line (somewhere above "That's all, stop editing!"):
define( 'XMLRPC_REQUEST', false );
  1. Save and upload

Alternative (easier): Install the free plugin Disable XML-RPC. Activate it. Done. The plugin adds the line for you.

Result: XML-RPC attacks stop. Your site doesn't respond to XML-RPC requests anymore.

Expected impact: Blocks 20-30% of automated attacks. Slightly improves performance.

Setting #8: Set Site Admin Email (Should Be Unique)

Why it matters: WordPress sends administrative emails (password resets, plugin updates, new user registrations) to the admin email. If it's wrong or you're not checking it, you miss critical security alerts.

The fix:

  1. Go to Settings > General
  2. Find "Administration Email Address"
  3. Change it to your real email (should be unique, not a shared inbox)
  4. Click Save Changes

Best practice: Use a dedicated admin email (e.g., admin@yourcompany.com) that's monitored by the person managing WordPress security.

Expected impact: You get notified when someone tries to reset your password, when plugins need updates, when suspicious activity occurs.

Setting #9: Change Site Title and Tagline (From Defaults)

Why it matters: Default site title is "My WordPress Website" or "Just Another WordPress Blog." Attackers see this and know you haven't secured your site. It's a signal that your site is abandoned or neglected.

The fix:

  1. Go to Settings > General
  2. Change "Site Title" to your real site name/brand
  3. Change "Tagline" to your tagline or leave it blank
  4. Click Save Changes

Example:

  • āŒ Before: "My WordPress Website" + "Just another WordPress site"
  • āœ… After: "TechBlog Hub" + "WordPress Tips & Tutorials"

Why this matters for SEO: The site title shows up in browser tabs and search results. A descriptive title is better for SEO and user click-through.

Expected impact: Higher CTR from search results (good title). Looks professional instead of abandoned.

Setting #10: Disable Default User Registration (Unless You Need It)

Why it matters: WordPress has a checkbox "Anyone can register" under Settings > General. If enabled, spammers create accounts and post spam. Unless you run a community site or membership, disable this.

The fix:

  1. Go to Settings > General
  2. UNCHECK: "Anyone can register"
  3. Click Save Changes

If you DO need user registration:

  1. CHECK "Anyone can register"
  2. Set "New User Default Role" to "Subscriber" (NOT Administrator or Editor)
  3. Use a plugin like Gravity Forms or Formidable Forms to moderate registrations

Expected impact: Zero spam user registrations. Eliminates automated account creation attacks.

Bonus Settings (Not Critical But Good)

Disable Comments (If You Don't Use Them)

Why: Comments attract spam. If you don't actively moderate, they become a liability.

The fix: Settings > Discussion > UNCHECK "Allow people to post comments on new articles"

Keep existing comments: You can disable new comments but keep old ones visible.

Hide WordPress Version

Why: Knowing you run WordPress 6.4.2 tells hackers what vulnerabilities you might have.

The fix (1 line of code in functions.php):

remove_action( 'wp_head', 'wp_generator' );

Change Database Prefix (Advanced)

Why: Default database prefix is wp_. Hackers know this and target wp_users, wp_options. Changing it to something random (e.g., abc123_) prevents automated SQL injection attacks.

How: This requires editing wp-config.php and database directly. Only do this during initial setup before publishing any content. If you're new to WordPress, skip this.

The Order Matters

Do these in this order:

  1. āœ… Permalinks FIRST (before publishing anything)
  2. āœ… Disable search engine discouragement (so Google can index)
  3. āœ… Delete "admin" user (security)
  4. āœ… Set timezone (scheduled posts work correctly)
  5. āœ… Disable pingbacks (reduce spam)
  6. āœ… Disable file editing (security)
  7. āœ… Disable XML-RPC (security)
  8. āœ… Set admin email (notifications work)
  9. āœ… Change title/tagline (professionalism + SEO)
  10. āœ… Disable user registration (unless you need it)

Time required: 15 minutes total (most are single clicks)

Common Mistakes

āŒ Changing permalinks AFTER publishing posts: Creates broken URLs and SEO damage. Do it first.

āŒ Leaving "Discourage search engines" checked: Your site won't rank. This is the #1 silent SEO killer.

āŒ Ignoring timezone: Scheduled posts publish at wrong times. Emails send at 4 AM instead of 9 AM.

āŒ Forgetting to delete the "admin" user: You fixed it in users panel, but forgot to actually delete it. That account still exists.

āŒ Enabling "Anyone can register" without moderation: Spam accounts flood in within a week.

Verification Checklist

After changing these settings, verify they stuck:

āœ… Visit a post and check the URL (should be /post-name/, not /?p=123)
āœ… Search Google for your site name (should appear in results within days)
āœ… Check Users page (admin user gone, your new username visible)
āœ… Verify scheduled post publishes at correct local time
āœ… Make sure new comments don't appear (if you disabled them)
āœ… Check Settings > Discussion (pingbacks and trackbacks unchecked)
āœ… Try to access Appearance > Theme File Editor (should not appear)
āœ… Verify admin email is correct (check Settings > General)

The Real Talk

These aren't fancy optimizations. They're basic configuration. But 80% of WordPress sites skip them. Then they wonder why they get hacked, don't rank in Google, or lose scheduled posts.

Take 15 minutes. Change these 10 settings. Your site will be more secure, more visible, and more professional. It's the difference between a neglected WordPress install and one that's actually managed.

Everything else (plugins, themes, content) is built on this foundation. Get the foundation right.