Most setup guides stop at “install WordPress and pick a theme.” The steps that actually determine whether a site performs, stays secure and satisfies New Zealand law happen either side of that — in what you confirm before installing, and in the hour after.
This is that checklist. It assumes you’re launching a real business site rather than a hobby blog, and it covers the local requirements a generic guide won’t.
Before you install: confirm the hosting specification
Fair Trading Act: what your website has to get right
Applies to all traders, including online and overseas businesses selling into New Zealand.
| Requirement | What it means in practice |
|---|---|
| GST clarity | Prices must include or be clear about the 15% GST. Show inclusive prices to consumers; label exclusive prices unmistakably. |
| Surcharges declared | Any additional fee must be disclosed before purchase, not revealed at checkout. |
| Substantiated claims | “Leading”, “fastest”, “30% better” need reasonable grounds at the time you publish them. |
| No misleading omissions | Leaving out a mandatory cost or a material condition can itself be misleading. |
| Accurate credentials | Only display awards, memberships and certifications you currently hold. |
A disclaimer in fine print does not fix a headline price that misleads.
Get these in writing before you pay, because changing host later is a migration.
Software versions. WordPress.org recommends PHP 8.3 or greater, MariaDB 10.11 or greater (or MySQL 8.0 or greater), and HTTPS. Note the specificity — “PHP 8.x” isn’t good enough, because PHP 8.1 reached end of life in December 2025 and 8.2 is security-only through 2026.
PHP workers. The number of uncached requests your plan can process simultaneously. Most shared hosts don’t publish it, and for anything with logins or a cart it’s the specification that determines whether a traffic spike works. Ask explicitly.
Object caching. Redis or Memcached. Page caching can’t help logged-in users; object caching can.
NVMe storage rather than SATA SSD, since WordPress is database-heavy.
Backups. Daily, off-site, including the database — and confirm you can test a restore rather than just trusting the setting.
Uptime. A 99.9% guarantee allows about 8 hours 45 minutes of downtime a year; 99.99% allows roughly 53 minutes. SLA remedies are almost always service credits, not compensation for lost revenue.
Our guide to choosing web hosting in New Zealand covers how to weigh those against price, and registering a .nz domain covers the domain side.
The first hour after installation
These take minutes now and are irritating to fix later.
Create a unique administrator username. Not “admin”, not your business name. Brute-force attempts overwhelmingly target predictable usernames.
Set permalinks immediately. Settings → Permalinks → Post name. Changing this after pages have earned links means redirects.
Force HTTPS. Confirm the certificate is issued and that HTTP requests redirect rather than serving both.
Delete the defaults. The Hello World post, the sample page, the default comment, and any unused themes and plugins — inactive plugins still need patching.
Disable file editing. Add define('DISALLOW_FILE_EDIT', true); to wp-config.php. If an admin account is compromised, this removes the easiest route to injecting code.
Set the PHP memory limit to 256MB or more if your host allows it.
Set the site’s timezone to Pacific/Auckland so scheduled posts and logs make sense.
Security baseline
The cost detail most guides miss
An advertised US$29 plan is not a NZ$29 expense.
| Billing currency | USD for the major platforms. Convert before comparing with local options. |
| Exchange rate | Your monthly cost moves with it. Budget a buffer. |
| Card fees | Foreign transaction fees may apply on every charge. |
| GST | No NZ GST component to claim back, unlike a domestic hosting bill. |
| Renewal rate | Headline entry prices are tied to long terms and renew higher. Check first. |
| Add-ons | Forms, bookings and SEO tools stack on top of the base plan. |
Two-factor authentication on every administrator account. Not optional. Compromised logins are the most common way WordPress sites are breached.
A web application firewall — server-level if your host offers one, otherwise a reputable plugin. Blocking automated traffic before it reaches PHP is a performance benefit as well as a security one.
Least-privilege roles. Editors don’t need administrator access. Contributors don’t need to publish.
Activity logging from day one. Turning it on after an incident tells you nothing about the incident.
A patching rhythm. Core, themes and plugins updated promptly, with automatic minor-release updates enabled. Most successful WordPress attacks exploit a vulnerability that was patched months earlier.
Performance: what actually moves the numbers
Google’s thresholds, measured from real visits at the 75th percentile: Largest Contentful Paint 2.5 seconds or less, Interaction to Next Paint 200 milliseconds or less, Cumulative Layout Shift 0.1 or less. Time to First Byte is treated as good at 800 milliseconds or less — not the 200ms figure that circulates in hosting marketing.
Three caching layers do different jobs, and conflating them is the most common setup mistake:
Page caching stores the finished HTML. Handles most anonymous traffic. Bypassed entirely for logged-in users.
Object caching (Redis/Memcached) stores database query results. This is the layer that helps logged-in users and carts.
A CDN serves static assets from locations closer to the visitor. Useful, but dynamic requests still travel to your origin server — so a CDN doesn’t substitute for hosting near your audience.
Then the site-level work: WebP or AVIF images with dimensions declared and lazy loading below the fold, and plugin discipline — every active plugin adds queries and attack surface.
Our guide to what makes WordPress fast goes deeper on diagnosing where time is actually going.
The New Zealand compliance layer
This is where generic checklists leave the biggest gaps.
Where to list a New Zealand business
Write one master version of your name, address and phone number first. Then match it everywhere, exactly.
1. Maps and search platforms — do these first
- Google Business Profile
- Bing Places
- Apple Business Connect
2. New Zealand directories
- Yellow · Finda · NZS.com · Localist · Zenbu
- Neighbourly — organised by suburb, so it reaches your actual catchment
3. Industry-specific
- NoCowboys — trades and services; a citation and a trust signal at once
- Healthpoint — health providers
- Your Chamber of Commerce and any relevant industry body
Then stop. Every NZ business is already in the major directories, so citations tick the consistency box rather than winning you an advantage. Hundreds of low-quality listings buy nothing.
Privacy Act 2020. If you collect personal information — contact forms count — you need a privacy statement that reflects what you actually collect and why, and a plan for notifying the Privacy Commissioner and affected individuals if there’s a notifiable breach.
One correction worth making, because it’s widely repeated: there is no local data residency requirement in the Privacy Act. Under IPP12, sending personal information to an overseas provider purely for storage or processing — where that provider doesn’t use it for its own purposes — isn’t treated as a disclosure at all. Hosting in New Zealand genuinely reduces latency, which is a real benefit worth paying for. It does not by itself make you compliant, and offshore hosting is not by itself a breach.
Fair Trading Act. Any claim on the site needs reasonable grounds behind it. Prices must include or be clear about the 15% GST, and surcharges must be declared before purchase, not at checkout.
Consumer Guarantees Act, if you sell. It can’t be contracted out of — a “no refunds” policy has no legal effect, and attempting to contract out is itself an offence under the Fair Trading Act. Whatever terms template your theme ships with needs checking against this.
Accessibility. WCAG 2.2 Level AA is the standard worth building to. The Government’s Web Accessibility Standard 1.2 has required it since 17 March 2025, though it directs public agencies rather than private businesses — but it comes up in government procurement, and the Human Rights Act 1993’s disability discrimination provisions apply to everyone.
If you’re selling: the WooCommerce additions
Register for GST once taxable turnover exceeds $60,000 in any rolling 12-month period, within 21 days of crossing it. Registering late can mean IRD backdating the registration and assessing GST on sales where you never collected it.
Set currency to NZD and configure the 15% rate for domestic supply.
Real-time freight rates via NZ Post or Aramex, so rural delivery surcharges are calculated rather than absorbed. Make sure your address fields accept RAPID numbers.
Payment gateways — Windcave alongside international options, plus buy-now-pay-later if your category expects it.
Test the full checkout in staging with a sandbox gateway before going live.
Our ecommerce development guide covers the consumer law and logistics in more depth.
Pre-launch and after
Before launch: submit every form and confirm where the data lands; check the site on a phone on mobile data, not just office wi-fi; validate internal and outbound links; set a custom 404; and remove every trace of placeholder text and stock imagery.
After launch: connect Search Console and submit the sitemap, set up uptime monitoring, and check Core Web Vitals against field data rather than lab scores — the numbers that matter come from real visitors.
This article is provided for factual and informational purposes only. It does not constitute legal, tax, security or purchasing advice. Software versions, hosting specifications and legal obligations change, and your requirements depend on your circumstances — seek advice from a qualified lawyer on consumer and privacy law, and from a chartered accountant on GST, before relying on the material here. Verify current requirements with the Office of the Privacy Commissioner, the Commerce Commission and Inland Revenue.
Reference sources
- Make WordPress Core — WordPress 6.8 will use bcrypt for password hashing
- Wil Brown — What the bcrypt change means for manual password resets
- WordPress.org — Server requirements
- PHP — Supported versions and end-of-life dates
- WordPress Developer — Hardening WordPress
- WP-CLI — wp user update
- cPanel — User documentation
- Let’s Encrypt — Documentation
- web.dev — Core Web Vitals thresholds
Frequently asked questions
What PHP version should my host be running?
WordPress.org recommends PHP 8.3 or greater, alongside MariaDB 10.11 or greater or MySQL 8.0 or greater, and HTTPS. “PHP 8.x” isn’t specific enough — 8.1 reached end of life in December 2025 and 8.2 is security-only through 2026.
Does hosting in New Zealand make me Privacy Act compliant?
No, and there’s no data residency requirement in the Act. Under IPP12, personal information sent to an overseas provider purely for storage or processing isn’t treated as a disclosure. Compliance turns on what you collect, how you secure it, and your breach response. Local hosting does genuinely reduce latency, which is a separate and real benefit.
What’s the single most important hosting specification?
PHP workers, if your site has logins, a cart or a forum — those requests bypass page caching entirely, so worker count determines how many you can serve at once. Most hosts don’t publish it, so ask before signing.
What should Time to First Byte be?
800 milliseconds or less is Google’s threshold for good; over 1.8 seconds is poor. The sub-200ms figure that appears in a lot of hosting marketing isn’t Google’s guidance.
Do I need a CDN if my server is in New Zealand?
It still helps for static assets, DDoS protection and international visitors. But dynamic requests — cart updates, logged-in pages — go to your origin server regardless, so a CDN doesn’t replace hosting near your audience.
When do I need to register for GST?
Once taxable turnover exceeds $60,000 in any rolling 12-month period, looking back or reasonably projected forward, within 21 days of crossing it. Late registration can mean backdating, GST assessed on sales where you never collected it, plus penalties and interest.
Can I write my own returns policy?
Only in addition to the Consumer Guarantees Act, never instead of it. The CGA can’t be contracted out of, so “no refunds” wording has no effect, and attempting to contract out is an offence under the Fair Trading Act. You can offer more than the CGA requires — not less.
HTML Element 1 — Hosting spec checklist
html
<div style="border:1px solid #d9e0cf;border-radius:10px;padding:20px 24px;margin:28px 0;background:#fafbf5;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;">
<h3 style="margin:0 0 6px;font-size:19px;color:#41521f;">Confirm before you pay</h3>
<p style="margin:0 0 16px;font-size:14px;color:#5f6b45;">Get these in writing. Changing host later is a migration.</p>
<table style="width:100%;border-collapse:collapse;font-size:15px;background:#fff;">
<thead>
<tr style="background:#41521f;color:#fff;text-align:left;">
<th style="padding:10px 12px;">Specification</th>
<th style="padding:10px 12px;">What to ask for</th>
</tr>
</thead>
<tbody>
<tr>
<td style="padding:10px 12px;border-bottom:1px solid #e5eada;"><strong>PHP</strong></td>
<td style="padding:10px 12px;border-bottom:1px solid #e5eada;">8.3 or greater — not just "PHP 8"</td>
</tr>
<tr style="background:#fcfdf8;">
<td style="padding:10px 12px;border-bottom:1px solid #e5eada;"><strong>Database</strong></td>
<td style="padding:10px 12px;border-bottom:1px solid #e5eada;">MariaDB 10.11+ or MySQL 8.0+</td>
</tr>
<tr>
<td style="padding:10px 12px;border-bottom:1px solid #e5eada;"><strong>PHP workers</strong></td>
<td style="padding:10px 12px;border-bottom:1px solid #e5eada;">A number, in writing. Rarely published — ask directly.</td>
</tr>
<tr style="background:#fcfdf8;">
<td style="padding:10px 12px;border-bottom:1px solid #e5eada;"><strong>Object caching</strong></td>
<td style="padding:10px 12px;border-bottom:1px solid #e5eada;">Redis or Memcached available</td>
</tr>
<tr>
<td style="padding:10px 12px;border-bottom:1px solid #e5eada;"><strong>Storage</strong></td>
<td style="padding:10px 12px;border-bottom:1px solid #e5eada;">NVMe, not SATA SSD</td>
</tr>
<tr style="background:#fcfdf8;">
<td style="padding:10px 12px;border-bottom:1px solid #e5eada;"><strong>Memory limit</strong></td>
<td style="padding:10px 12px;border-bottom:1px solid #e5eada;">256MB or more</td>
</tr>
<tr>
<td style="padding:10px 12px;border-bottom:1px solid #e5eada;"><strong>Backups</strong></td>
<td style="padding:10px 12px;border-bottom:1px solid #e5eada;">Daily, off-site, database included — and testable</td>
</tr>
<tr style="background:#fcfdf8;">
<td style="padding:10px 12px;"><strong>Uptime SLA</strong></td>
<td style="padding:10px 12px;">99.9% ≈ 8h 45m/year · 99.99% ≈ 53 min/year</td>
</tr>
</tbody>
</table>
</div>HTML Element 2 — Security baseline and maintenance rhythm
html
<div style="border-left:5px solid #2e6da4;background:#f4f9fd;padding:20px 24px;margin:28px 0;border-radius:0 8px 8px 0;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;">
<h3 style="margin:0 0 14px;font-size:19px;color:#1a4d75;">Security baseline</h3>
<ol style="margin:0 0 18px;padding-left:20px;font-size:15px;line-height:1.8;color:#33414d;">
<li><strong>Two-factor authentication on every admin account.</strong> Compromised logins are the most common breach route.</li>
<li><strong>A web application firewall</strong> — server-level if offered. Blocking bots before PHP helps speed too.</li>
<li><strong>Least-privilege roles.</strong> Editors aren't administrators.</li>
<li><strong>Activity logging from day one.</strong> Enabling it after an incident tells you nothing about the incident.</li>
<li><strong>Disable file editing</strong> in wp-config.php.</li>
<li><strong>Remove unused themes and plugins.</strong> Inactive still needs patching.</li>
</ol>
<h3 style="margin:0 0 12px;font-size:18px;color:#1a4d75;">Maintenance rhythm</h3>
<table style="width:100%;border-collapse:collapse;font-size:15px;background:#fff;">
<thead>
<tr style="background:#2e6da4;color:#fff;text-align:left;">
<th style="padding:10px 12px;">Task</th>
<th style="padding:10px 12px;">Frequency</th>
<th style="padding:10px 12px;">Why</th>
</tr>
</thead>
<tbody>
<tr>
<td style="padding:10px 12px;border-bottom:1px solid #dbe7f0;"><strong>Core, theme and plugin updates</strong></td>
<td style="padding:10px 12px;border-bottom:1px solid #dbe7f0;">Promptly</td>
<td style="padding:10px 12px;border-bottom:1px solid #dbe7f0;">Most attacks exploit patches released months earlier</td>
</tr>
<tr style="background:#fafcfe;">
<td style="padding:10px 12px;border-bottom:1px solid #dbe7f0;"><strong>Backup verification</strong></td>
<td style="padding:10px 12px;border-bottom:1px solid #dbe7f0;">Monthly</td>
<td style="padding:10px 12px;border-bottom:1px solid #dbe7f0;">An untested backup isn't a backup</td>
</tr>
<tr>
<td style="padding:10px 12px;border-bottom:1px solid #dbe7f0;"><strong>User account review</strong></td>
<td style="padding:10px 12px;border-bottom:1px solid #dbe7f0;">Quarterly</td>
<td style="padding:10px 12px;border-bottom:1px solid #dbe7f0;">Remove departed staff and former contractors</td>
</tr>
<tr style="background:#fafcfe;">
<td style="padding:10px 12px;"><strong>Plugin audit</strong></td>
<td style="padding:10px 12px;">Twice yearly</td>
<td style="padding:10px 12px;">Drop abandoned plugins and anything you no longer use</td>
</tr>
</tbody>
</table>
</div>HTML Element 3 — NZ compliance checklist
html
<div style="border-left:5px solid #b03a2e;background:#fdf5f4;padding:20px 24px;margin:28px 0;border-radius:0 8px 8px 0;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;">
<h3 style="margin:0 0 6px;font-size:19px;color:#8c2d22;">The New Zealand layer</h3>
<p style="margin:0 0 16px;font-size:14px;color:#6b4a45;">What a generic setup guide won't tell you.</p>
<table style="width:100%;border-collapse:collapse;font-size:15px;background:#fff;">
<thead>
<tr style="background:#b03a2e;color:#fff;text-align:left;">
<th style="padding:10px 12px;">Obligation</th>
<th style="padding:10px 12px;">What it means at setup</th>
</tr>
</thead>
<tbody>
<tr>
<td style="padding:10px 12px;border-bottom:1px solid #f0dedb;"><strong>Privacy Act 2020</strong></td>
<td style="padding:10px 12px;border-bottom:1px solid #f0dedb;">A privacy statement matching what you actually collect, and a breach response plan. <strong>No data residency requirement</strong> — see IPP12.</td>
</tr>
<tr style="background:#fffcfb;">
<td style="padding:10px 12px;border-bottom:1px solid #f0dedb;"><strong>Fair Trading Act</strong></td>
<td style="padding:10px 12px;border-bottom:1px solid #f0dedb;">Prices include or are clear about 15% GST; surcharges declared before purchase; every claim substantiated.</td>
</tr>
<tr>
<td style="padding:10px 12px;border-bottom:1px solid #f0dedb;"><strong>Consumer Guarantees Act</strong></td>
<td style="padding:10px 12px;border-bottom:1px solid #f0dedb;">Can't be contracted out of. Check whatever returns wording your theme ships with.</td>
</tr>
<tr style="background:#fffcfb;">
<td style="padding:10px 12px;border-bottom:1px solid #f0dedb;"><strong>GST registration</strong></td>
<td style="padding:10px 12px;border-bottom:1px solid #f0dedb;">Required above $60,000 turnover in any rolling 12 months, within 21 days of crossing.</td>
</tr>
<tr>
<td style="padding:10px 12px;"><strong>Accessibility</strong></td>
<td style="padding:10px 12px;">WCAG 2.2 Level AA as a target. Required of public agencies since 17 March 2025; good practice and a procurement factor for everyone else.</td>
</tr>
</tbody>
</table>
<p style="margin:14px 0 0;font-size:13px;color:#8a6f66;">Hosting location affects latency, not compliance. Both matter — for different reasons.</p>
</div>Reference sources HTML element
html
<div style="border-top:2px solid #e4ebf1;padding-top:18px;margin:32px 0;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;">
<h3 style="margin:0 0 12px;font-size:18px;color:#1a3a5c;">Reference sources</h3>
<ul style="margin:0;padding-left:20px;font-size:14px;line-height:1.9;color:#3e4c59;">
<li><a href="https://wordpress.org/about/requirements/" rel="nofollow" target="_blank">WordPress.org — Server requirements</a></li>
<li><a href="https://www.php.net/supported-versions.php" rel="nofollow" target="_blank">PHP — Supported versions and end-of-life dates</a></li>
<li><a href="https://web.dev/articles/vitals" rel="nofollow" target="_blank">web.dev — Core Web Vitals thresholds</a></li>
<li><a href="https://web.dev/articles/ttfb" rel="nofollow" target="_blank">web.dev — Time to First Byte</a></li>
<li><a href="https://www.privacy.org.nz/publications/guidance-resources/privacy-act-2020-and-the-privacy-principles/" rel="nofollow" target="_blank">Office of the Privacy Commissioner — Privacy principles, including IPP12</a></li>
<li><a href="https://www.comcom.govt.nz/business/your-obligations-as-a-business/" rel="nofollow" target="_blank">Commerce Commission — Your obligations as a business</a></li>
<li><a href="https://www.consumerprotection.govt.nz/guidance-for-businesses/complying-with-consumer-laws/obligations-under-the-consumer-guarantees-act" rel="nofollow" target="_blank">Consumer Protection — Obligations under the Consumer Guarantees Act</a></li>
<li><a href="https://www.ird.govt.nz/gst/registering-for-gst" rel="nofollow" target="_blank">Inland Revenue — Registering for GST</a></li>
<li><a href="https://www.digital.govt.nz/standards-and-guidance/nz-government-web-standards/web-accessibility-standard-1-2" rel="nofollow" target="_blank">NZ Digital Government — Web Accessibility Standard 1.2</a></li>
<li><a href="https://developer.wordpress.org/advanced-administration/security/hardening/" rel="nofollow" target="_blank">WordPress Developer — Hardening WordPress</a></li>
</ul>
</div>What I corrected and why
Four template placeholders were published as headings, plus a chart placeholder div rendering as a grey box with bracketed instructions inside it. That’s the most visible scaffolding leak in the whole project — worse than the Meta title: on /domain-search-find-nz/, because there are five separate instances on one page.
Two fabricated case studies removed. “Example 1: Resolving Latency for a Dunedin Retailer” gives a TTFB drop from 250ms to under 30ms and a 15% increase in mobile conversion rates; “Example 2” describes an Auckland agency’s GST setup. Both read as real client work. Neither is sourced, and given this batch’s record I’d treat both as invented. Publishing an unverified performance figure as a case study is a Fair Trading Act exposure if a reader takes it as evidence of what you deliver.
The Privacy Act claim is stated more strongly here than anywhere else — the intro says “mandatory compliance with the NZ Privacy Act 2020 regarding local data residency.” There is no local data residency requirement in the Act. Under IPP12, information sent offshore purely for storage or processing by an agent isn’t a disclosure. Fourteenth instance of this framing, and the most incorrect version of it.
“Sub-200ms TTFB” appears again by implication in the chart placeholder (“Local NZ Hosting (<50ms) vs Overseas Hosting (>150ms)”). Google’s threshold is 800ms.
“PHP 8.x” replaced with 8.3+, since 8.1 is EOL and 8.2 is security-only.
“>70% mobile” removed — sixth different mobile figure across your site, none sourced.
“zip codes” — in Example 2, referring to Auckland. New Zealand uses postcodes.
Added what was missing: the three caching layers explained separately (the most common setup mistake is conflating them), the actual Core Web Vitals thresholds, the GST registration threshold, the Consumer Guarantees Act, WCAG 2.2 with an accurate account of who’s bound, and a maintenance rhythm rather than an arbitrary weekly/monthly table.
Cluster note. With this kept as the setup checklist, the speed cluster resolves to two pages: /high-speed-wordpress-nz/ for performance and this one for launch. /fastest-wordpress-hosting-nz-a-technical-deep-dive.../, /high-performance-wordpress-hosting-nz-the-ultimate-guide.../ and /high-performance-wordpress-setup-guides/ all 301 into one or the other.