WordPress Setup Checklist for New Zealand Businesses

Most setup guides stop at “install WordPress and pick a theme.” The steps that actually determine whether a site performs, stays secure and satisfies New Zealand law happen either side of that — in what you confirm before installing, and in the hour after.

This is that checklist. It assumes you’re launching a real business site rather than a hobby blog, and it covers the local requirements a generic guide won’t.

Before you install: confirm the hosting specification

Get these in writing before you pay, because changing host later is a migration.

Software versions. WordPress.org recommends PHP 8.3 or greater, MariaDB 10.11 or greater (or MySQL 8.0 or greater), and HTTPS. Note the specificity — “PHP 8.x” isn’t good enough, because PHP 8.1 reached end of life in December 2025 and 8.2 is security-only through 2026.

PHP workers. The number of uncached requests your plan can process simultaneously. Most shared hosts don’t publish it, and for anything with logins or a cart it’s the specification that determines whether a traffic spike works. Ask explicitly.

Object caching. Redis or Memcached. Page caching can’t help logged-in users; object caching can.

NVMe storage rather than SATA SSD, since WordPress is database-heavy.

Backups. Daily, off-site, including the database — and confirm you can test a restore rather than just trusting the setting.

Uptime. A 99.9% guarantee allows about 8 hours 45 minutes of downtime a year; 99.99% allows roughly 53 minutes. SLA remedies are almost always service credits, not compensation for lost revenue.

Our guide to choosing web hosting in New Zealand covers how to weigh those against price, and registering a .nz domain covers the domain side.

The first hour after installation

These take minutes now and are irritating to fix later.

Create a unique administrator username. Not “admin”, not your business name. Brute-force attempts overwhelmingly target predictable usernames.

Set permalinks immediately. Settings → Permalinks → Post name. Changing this after pages have earned links means redirects.

Force HTTPS. Confirm the certificate is issued and that HTTP requests redirect rather than serving both.

Delete the defaults. The Hello World post, the sample page, the default comment, and any unused themes and plugins — inactive plugins still need patching.

Disable file editing. Add define('DISALLOW_FILE_EDIT', true); to wp-config.php. If an admin account is compromised, this removes the easiest route to injecting code.

Set the PHP memory limit to 256MB or more if your host allows it.

Set the site’s timezone to Pacific/Auckland so scheduled posts and logs make sense.

Security baseline

Two-factor authentication on every administrator account. Not optional. Compromised logins are the most common way WordPress sites are breached.

A web application firewall — server-level if your host offers one, otherwise a reputable plugin. Blocking automated traffic before it reaches PHP is a performance benefit as well as a security one.

Least-privilege roles. Editors don’t need administrator access. Contributors don’t need to publish.

Activity logging from day one. Turning it on after an incident tells you nothing about the incident.

A patching rhythm. Core, themes and plugins updated promptly, with automatic minor-release updates enabled. Most successful WordPress attacks exploit a vulnerability that was patched months earlier.

Performance: what actually moves the numbers

Google’s thresholds, measured from real visits at the 75th percentile: Largest Contentful Paint 2.5 seconds or less, Interaction to Next Paint 200 milliseconds or less, Cumulative Layout Shift 0.1 or less. Time to First Byte is treated as good at 800 milliseconds or less — not the 200ms figure that circulates in hosting marketing.

Three caching layers do different jobs, and conflating them is the most common setup mistake:

Page caching stores the finished HTML. Handles most anonymous traffic. Bypassed entirely for logged-in users.

Object caching (Redis/Memcached) stores database query results. This is the layer that helps logged-in users and carts.

A CDN serves static assets from locations closer to the visitor. Useful, but dynamic requests still travel to your origin server — so a CDN doesn’t substitute for hosting near your audience.

Then the site-level work: WebP or AVIF images with dimensions declared and lazy loading below the fold, and plugin discipline — every active plugin adds queries and attack surface.

Our guide to what makes WordPress fast goes deeper on diagnosing where time is actually going.

The New Zealand compliance layer

This is where generic checklists leave the biggest gaps.

Privacy Act 2020. If you collect personal information — contact forms count — you need a privacy statement that reflects what you actually collect and why, and a plan for notifying the Privacy Commissioner and affected individuals if there’s a notifiable breach.

One correction worth making, because it’s widely repeated: there is no local data residency requirement in the Privacy Act. Under IPP12, sending personal information to an overseas provider purely for storage or processing — where that provider doesn’t use it for its own purposes — isn’t treated as a disclosure at all. Hosting in New Zealand genuinely reduces latency, which is a real benefit worth paying for. It does not by itself make you compliant, and offshore hosting is not by itself a breach.

Fair Trading Act. Any claim on the site needs reasonable grounds behind it. Prices must include or be clear about the 15% GST, and surcharges must be declared before purchase, not at checkout.

Consumer Guarantees Act, if you sell. It can’t be contracted out of — a “no refunds” policy has no legal effect, and attempting to contract out is itself an offence under the Fair Trading Act. Whatever terms template your theme ships with needs checking against this.

Accessibility. WCAG 2.2 Level AA is the standard worth building to. The Government’s Web Accessibility Standard 1.2 has required it since 17 March 2025, though it directs public agencies rather than private businesses — but it comes up in government procurement, and the Human Rights Act 1993’s disability discrimination provisions apply to everyone.

If you’re selling: the WooCommerce additions

Register for GST once taxable turnover exceeds $60,000 in any rolling 12-month period, within 21 days of crossing it. Registering late can mean IRD backdating the registration and assessing GST on sales where you never collected it.

Set currency to NZD and configure the 15% rate for domestic supply.

Real-time freight rates via NZ Post or Aramex, so rural delivery surcharges are calculated rather than absorbed. Make sure your address fields accept RAPID numbers.

Payment gateways — Windcave alongside international options, plus buy-now-pay-later if your category expects it.

Test the full checkout in staging with a sandbox gateway before going live.

Our ecommerce development guide covers the consumer law and logistics in more depth.

Pre-launch and after

Before launch: submit every form and confirm where the data lands; check the site on a phone on mobile data, not just office wi-fi; validate internal and outbound links; set a custom 404; and remove every trace of placeholder text and stock imagery.

After launch: connect Search Console and submit the sitemap, set up uptime monitoring, and check Core Web Vitals against field data rather than lab scores — the numbers that matter come from real visitors.

This article is provided for factual and informational purposes only. It does not constitute legal, tax, security or purchasing advice. Software versions, hosting specifications and legal obligations change, and your requirements depend on your circumstances — seek advice from a qualified lawyer on consumer and privacy law, and from a chartered accountant on GST, before relying on the material here. Verify current requirements with the Office of the Privacy Commissioner, the Commerce Commission and Inland Revenue.

Frequently asked questions

What PHP version should my host be running?

WordPress.org recommends PHP 8.3 or greater, alongside MariaDB 10.11 or greater or MySQL 8.0 or greater, and HTTPS. “PHP 8.x” isn’t specific enough — 8.1 reached end of life in December 2025 and 8.2 is security-only through 2026.

Does hosting in New Zealand make me Privacy Act compliant?

No, and there’s no data residency requirement in the Act. Under IPP12, personal information sent to an overseas provider purely for storage or processing isn’t treated as a disclosure. Compliance turns on what you collect, how you secure it, and your breach response. Local hosting does genuinely reduce latency, which is a separate and real benefit.

What’s the single most important hosting specification?

PHP workers, if your site has logins, a cart or a forum — those requests bypass page caching entirely, so worker count determines how many you can serve at once. Most hosts don’t publish it, so ask before signing.

What should Time to First Byte be?

800 milliseconds or less is Google’s threshold for good; over 1.8 seconds is poor. The sub-200ms figure that appears in a lot of hosting marketing isn’t Google’s guidance.

Do I need a CDN if my server is in New Zealand?

It still helps for static assets, DDoS protection and international visitors. But dynamic requests — cart updates, logged-in pages — go to your origin server regardless, so a CDN doesn’t replace hosting near your audience.

When do I need to register for GST?

Once taxable turnover exceeds $60,000 in any rolling 12-month period, looking back or reasonably projected forward, within 21 days of crossing it. Late registration can mean backdating, GST assessed on sales where you never collected it, plus penalties and interest.

Can I write my own returns policy?

Only in addition to the Consumer Guarantees Act, never instead of it. The CGA can’t be contracted out of, so “no refunds” wording has no effect, and attempting to contract out is an offence under the Fair Trading Act. You can offer more than the CGA requires — not less.