Little Guy Branding Web Setup Checklist

NOTE: Normally this isn't necessary when developing on a final domain, because there is no existing site.

But sometimes a client is switching to a new domain and does have an existing website. In this case, redirects are required.

Check Monday.com

Check Monday.com

Deactivate WF before migrating to final url.

When you deactivate, it will ask if you want to delete everything. Yes, you do.

It will then interrupt itself and say extended protection is enabled and give you an option to disable it. Disable it.

Then try to delete everything again. And confirm that, yes, you really want to do that.

If another security plugin is being used, be sure to deactivate firewall and the plugin itself as much like the instructions for WordFence.

Deactivate and delete Rocket Cache or other caching plugins.

• Go to SiteGround and click "New Website".


• Select Server 3 Hosting Plan


• Choose "Temporary Domain"

If we're making an Avada Site:

• Select "Migrate Website" and choose the automatic option


• Copy the migration code
  
• Click finish (do not add SG Site Scanner)


• Go to https://matts162.sg-host.com/wp-admin (template site) and paste migration code into SG Migrator. Follow instructions to migrate site.

If we're making a site on another pagebuilder or theme (Elementor, Divi):

• Select "Migrate Website" and choose the automatic option


• Copy the migration code
  
• Click finish (do not add SG Site Scanner)


• Go to old site and paste migration code into SG Migrator. Follow instructions to migrate site.

NOTE: If SSL is already set up, still make sure to do the SG Optimizer steps below

Go to SG
Website List
Click "Site Tools"
Go to "Security > SSL Manager"
Choose "Let's Encrypt"
Login to WP Backend.
Go to "SG Optimizer> Environment"
Turn on "HTTPS Enforce"
Log back in.
Turn on "Fix Insecure Content"

Check on licenses here:
https://my.avada.com/licenses/?domain=sg-host.com

(Use login from Matt)

Grab an unused one. If no available licenses, check with Matt.

If there's none available, try at this link
Google Drive

Delete the license from this folder once you've used it.

If none of those work, ask Matt for help.

If importing from a WordPress site:
At the old site, go to Tools>Export>Export All Content (or a subset).

At the new site go to Tools>Import . Install the WordPress import. Then upload the export and import. Choose options to create users and download and import media files.

Best to just google Import from x to WordPress.

Squarespace lets you export content. There are WordPress plugins for most other CMSs.

Check if Wordfence firewall is set up after migrating matt162.

If not, enable it. Make sure ManageWP is allowed under firewall settings.

If there is an existing site

Deactivate WF before migrating to final url.

When you deactivate, it will ask if you want to delete everything. Yes, you do.

It will then interrupt itself and say extended protection is enabled and give you an option to disable it. Disable it.

Then try to delete everything again. And confirm that, yes, you really want to do that.

If we don't currently host the site on the final url. :

• Make sure client has bought the URL and we have the DNS login information (should be in Monday.com)


• Go to SiteGround and click "New Website".


• Select a Hosting Plan


• Choose "Existing Domain" and enter url


• Select "Migrate Website" and choose the automatic option


• Copy the migration code and add that to the temp website


• Click finish (do not add SG Site Scanner)


• Point DNS in the next steps.

Note: the client's website will be down while this step is taking place, so be sure to do it at a non-critical time.
If we currently host the site on the final domain:

• 
  Backup the current site to a temporary domain (create new temp site, then migrate the current site to it via migrator).


• Remove WordPress from the final domain by deleting the current web application. Go to Websites>SiteTools for the final website>
  WordPress>Install and Manage>3 Dots>Delete Application.


• Check if there are any php files remaining in the public_html folder and delete them.


• Then get the migration code at the final url site at Sitetools>WordPress>Migrate. Then follow the instructions before for automatic migrations.
/ul>

We want to use SG nameservers to make use of the SG CDN.

• 
  Sign into the client's domain registrar and find their DNS settings.


• Make a copy of their DNS settings


• Go to SG>Websites>Site Tools>Domain>DNS Zone Editor. Make a copy of the default SG DNS settings


• Note any duplicate entries already on SG. For example, there is TXT spf record in SG. We can only have one spf record.


• Delete duplicate records from SG.


• Add all entries from the client's DNS


• Don't transfer settings that are only related to the previous website host. Look for GoDaddy specific DNS, for example (when in doubt, Google it or check with SG support)


• After all settings are updated, point the domain to the SG Nameservers, which are currently the ones below, but check by going to SG>Websites>All Site Options>3 dots>Server Details.


NS1.SITEGROUND.NET

NS2.SITEGROUND.NET

Check DNS at What's My DNS.
If you wait 24 hours and there are a few hold outs, go ahead and click Done and see if you can do the rest of the setup without issue.

From the WordPress admin Dashboard
Access your WordPress Dashboard (e.g. http://yourdomain.com/wp-admin) > Settings > General.

Under the WordPress address (URL) and the Site address (URL) fields enter the domain that you wish your application to work with and save the changes.

The same modification is valid if you want to add “www” to your domain.

NOTE: If SSL is already set up, still make sure to do the SG Optimizer steps below

Go to SG
Website List
Click "Site Tools"
Go to "Security > SSL Manager"
Choose "Let's Encrypt"
Login to WP Backend.
Go to "SG Optimizer> Environment"
Turn on "HTTPS Enforce"
Log back in.
Turn on "Fix Insecure Content"

Add Coming Soon by SeedProd plugin and create a coming soon page while the site is under development.

Go to SG
Website List
Click "Site Tools"
Go to "Security > SSL Manager"
Choose "Let's Encrypt"
Login to WP Backend.
Go to "SG Optimizer> Environment"
Turn on "HTTPS Enforce"

Make sure we're using our Nameservers for everything, If we aren't using our NS, check with Kevin.

Sitetools > Speed > CDN

Choose the FREE version. Follow whatever steps appear.

Refresh the page to make sure it takes.

After adding and activating WordFence, click to get a new license, choose free and use support@lgxbranding.com as the email.

Rate Limiting 120 per minute for most. 60 for 404-related. Set to block for 1 hour for now (update this if we get visitor complaints). Find settings under Firewall here: https://www.mccordclaims.com/wp-admin/admin.php?page=WordfenceWAF&subpage=waf_options

Change email preferences: Wordfence>All Options>Email alert (only need:
Email with deactivated,
Email if firewall is turned off,
Email if threat is high or worse and
Email if large increase in attacks

Also, Wordfence>All Options>Activity Report -- turn summary and report off

If developed on a temp site, copy license from temp site, unregister temp site at url below, then reregister on the new site and refresh at the link below.

Check on licenses here:
https://my.avada.com/licenses/?domain=sg-host.com

(Use login from Matt)

Grab an unused one. If no available licenses, check with Matt.

If there's none available, try at this link
Google Drive

Delete the license from this folder once you've used it.

If none of those work, ask Matt for help.

Go to Settings>General.

lgx>Options>Colors:

Put in the company / organization colors (replace default colors). Be sure to use a descriptive name for each color.

lgx>Options>Logo>Logo

lgx>Options>Logo>Favicon

lgx>Options>Typography>Body Typography

lgx>Options>Typography>Headings Typography

Upload available assets

Go to: https://orion.managewp.com/ (get login from Matt or Kevin)

"ADD WEBSITE" with + icon in the top left corner

Type in URL, Click ADD WEBSITE, choose USE CONNECTION KEY INSTEAD

In WORDPRESS > PLUGINS - find ManageWP in the list and click to "Connection Management" to get a connection key

Paste connection key into ManageWP and make sure it connects

Make sure ManageWP is allowed in Wordfence Firewall under Advanced Firewall Options.

Once connected, go to ManageWP and try to sign into the WP backend from there to make sure the users are set up correctly. (If not, choose a new user for logging in from the Settings section).

Go to Backups and toggle the switch to start automatic backups. Then choose the paid option (it's prepaid so the actual cost will be zero).

uptimerobot.com
matt@littleguydesign.com + Standard PW
Add New Monitor

Choose HTTPS monitor, Add NAME, Add URL, 5 minutes checking frequency, Check mark SUPPORT email (NOT MATT) & SLACK downtime notifications - CREATE MONITOR

In Gravity Forms, go to Settings > ReCaptcha and enable Universal

Go to Google ReCaptcha Manage

(login)

Under RecCaptcha keys click "+ Create Key"

Fill in name and domain and click to continue.

Next page, click "Continue with instructions"

Back on site in Gravity Forms, select Recaptcha-2025 as project ID. Then select the name you just created at Google's site.

Choose 0.8 as the threshold.

Save settings.

Back at Google click "continue to next step," then ignore the instructions and click until you get to the Review section where it says to trigger an event on the site.

Fill out test form on site.

Back at Google, click Go to Key Overview.

It may take a few minutes for it to register.

Confirm recaptcha is working by looking for a recaptcha score in the form entries list. Also at Google in the list of Keys it should say "Key Status" Protected.

Once we've confirmed that email notifications are working, remove lgxbranding emails from form notifications, especially support@lgxbranding.com. Leave notifications for Wordfence (but be sure email settings are the same as matt162)

Settings > Reading

Make sure "Discourage search engines from indexing this site" is UNCHECKED

Also enable comments under Settings > Discussion if client wants comments on posts

BE SURE TO GET RID OF SG SECURITY, WHICH IS AUTOMATICALLY ADDED WHEN YOU MIGRATE A SITE. Some plugins are loaded on the template site that you don't need for a particular build. Deactivate and remove the ones you didn't need.
This includes deactivating and deleting Seedprod, the the coming soon page, once the site is live. We've have issues with the

lgx>performance

Click the "Find Recommendations" button to identify elements that aren't being uses and so can be disabled.

LEAVE LAZY LOADING OFF (We use SG Optimizer for this)
LEAVE CSS COMPILING DISABLED (Again, use SG Optimizer for this, if used)
LEAVE JS optimization (except for legacy) disabled

lgx > Options > Advanced > Theme Features > Save Changes

If that doesn't work, try:

lgx > Options > Performance

Turn off CSS Compiling and JS Compiler and Save Changes

Reset Avada Caches

Reable CSS and JS compiling

Force HTTPS from within SG Optimizer > Environment Optimization

Under lgx Branding > WP Admin > Hide Admin Menus, hide the following:

Dashboard

Plugins

Settings

Comments (unless they need it)

Users (unless they need it)

Tools

NEEDS to be done AFTER Sitekit is setup so we can exclude that from JS minify etc.

Sometimes the following settings break the site, depending on factors such as which plugins are enabled, and what works can change with updates. So try and test.

Under "Frontend"
Minify JS, HTML

Do not minify CSS

Combine CSS

Combine JS, but set it to exclude, reCaptcha, jquery, and Wordfence.

Defer render blocking JS, but set it to exclude, jquery and Wordfence, recaptcha.

Under "Environment" you can schedule database cleanup, but leave "Delete all page and post revisions" unchecked. We need those revisions.

Under Media, use WebP.

Lazy Load images

Okay, so this is in flux because email providers are making things difficult.

Possible solutions:

Find out what email service the client is using.

If it's Microsoft, try having the client set up Send Grid and enable that in WP Forms SMTP plugin.

If they can't use the free service, try Fluent SMTP's Outlook service and set up an API in Microsoft Azure.

If it's not Microsoft, try googling SMTP settings for that service.

Get name and password for an email address that the client wants to send emails from.

Use WP Forms SMTP plugin and choose "other SMTP.

Enable consent mode in Google Site Kit and follow instructions (except use avada instead of another plugin for consent bar)

Go to Options> Privacy&Consent

Enable Privacy Consent Tools and add Google types under Privacy Consent Types and Privacy Selected Consent Types

Pre-select everything that you set to require approval.

Turn on "Save Pre-Selected" so it acts as giving permission.

When adding gtag code in the Avada Code Fields, under "Loading behavior," select Block until consent. Turn pre-checked "On".