Softaculous installs applications in a few clicks: WordPress, forums, wikis, shop platforms. It writes the files, creates the database, and hands you a working login.
The install is the easy part and it is not the reason to use it. The reason is that it keeps a record of what it installed, which is what makes updates, backups and clones one-click operations later.
Installing something
In cPanel, open Softaculous Apps Installer and pick the application.
Four fields decide whether you regret this later.
Protocol. Choose https:// if the certificate is already in place, and match the www form you intend to use. Getting this wrong is the site-address problem, and it is easier to set correctly now than to change afterwards. For the repair, see changing the WordPress site URL.
Directory. Leave it empty for a site at the domain root. The field is pre-filled with something like wp, and leaving it produces a site at example.com/wp, which is the single most common Softaculous mistake.
Admin username. Not admin. Automated attacks try that name first and constantly.
Admin email. An address you actually read, because password resets go there.
The options worth changing
Table prefix. Softaculous randomises it, and that is fine. Note it down. You need it when working in the database directly.
Automated backups. Available in the advanced section. Enable it and set a rotation, otherwise backups accumulate until they fill the account.
Auto-upgrade. Covered below, and it deserves thought rather than a reflex.
Do not install the plugin bundle
The installer offers to add a set of plugins and sometimes a theme. Skip it.
They are chosen by commercial arrangement rather than by fit, and every one you accept is code you did not choose running on your site, with its own update obligation and its own attack surface.
Install a clean application and add what you actually need.
Auto-upgrade: a real trade-off
Softaculous can update the application automatically when a new version appears.
For. Most sites are compromised through outdated software, and an unattended site is safer with updates than without.
Against. An update can break a theme or plugin, and it happens while nobody is watching.
The sensible split: enable it for minor and security releases, leave major versions manual. If you enable full automatic updates, enable the backup that runs before them too: that is what turns a broken update into a restore in place of an incident.
WordPress has its own update mechanism as well, and running both is not harmful but does make it unclear which one acted. Enabling automatic updates in WordPress deals with choosing one.
Staging and cloning
This is the feature people overlook and the one worth the most.
Clone copies an installation to another domain or directory, useful for setting up a second site from a configured one.
Staging creates a copy for testing, then pushes changes back to live when you are satisfied.
Push carefully. Pushing back can overwrite the live database, and any order or comment that arrived while you were testing is then gone. Push files instead of the database unless you know the database has not changed on live.
Backups from Softaculous
The installer backs up the application and its database, and stores the archive in your account.
Two limits to hold in mind. It backs up only what it installed, so files elsewhere in the account are not included. And a backup on the same server is not protection against server-level loss.
Treat it as a fast rollback for a bad update, not as your backup strategy. Backing up and restoring your website walks through the wider picture.
Removing an installation properly
Use Softaculous's own uninstall rather than deleting files.
Deleting the directory leaves the database, the database user and the installer's record of it behind. The record matters: Softaculous keeps offering updates for something that no longer exists, and the orphaned database counts against your account.
Uninstall removes all of it in one operation. Uninstalling WordPress safely deals with what to check first.
When it loses track of an installation
If you moved or reinstalled the application by hand, Softaculous no longer recognises it and its update and backup features stop applying.
The import function points it back at an existing installation and restores the connection. Do that rather than reinstalling over the top, which would overwrite a working site.
When to install manually instead
Softaculous is a convenience, not a requirement, and a manual install gives you control over the layout and the database naming.
For a single straightforward site, the installer wins on time and on the tooling it brings with it. For anything with an unusual arrangement (a shared database, a non-standard directory structure) installing by hand is cleaner than fighting the form. Installing WordPress manually picks it up from there.
Know what the installer chose for you
A one click installation makes several decisions, and the defaults are not always what you would have picked.
wp config get table_prefix 2>/dev/null wp user list --role=administrator --fields=user_login,user_email 2>/dev/null wp config get DB_NAME 2>/dev/null
Read the administrator name, the database name and the table prefix after any automatic installation. A predictable administrator name is the single most useful piece of information for anybody guessing passwords.
The database name and prefix matter later rather than now. A restore, a migration or a second installation on the same account is considerably easier when those were chosen deliberately.
Decide about automatic updates per site
The installer offers to keep everything current, and that is right for some sites and wrong for others.
A simple site with no custom code benefits, since the alternative is an installation nobody updates. A site with custom work or a shop benefits from testing first, because an update applied automatically at three in the morning is discovered by a customer.
wp plugin list --fields=name,auto_update 2>/dev/null | head wp option get auto_update_core_major 2>/dev/null
Whichever you choose, know which it is. The failure is a site nobody updates because everybody believes something else is doing it. Enabling automatic updates covers the settings.
Remove an installation completely
Deleting the files leaves the database, and deleting through the installer sometimes leaves both.
ls -la ~/public_html/oldsite/ 2>/dev/null mysql -e "SHOW DATABASES" 2>/dev/null | grep -i old du -sh ~/public_html/* 2>/dev/null | sort -h | tail -5
An abandoned installation is an unpatched application on a live account, reachable by anybody who finds the path. It is one of the more common ways an account is compromised without anybody using the site.
Remove the files, the database and its user together, and confirm the address returns an error afterwards rather than a page.