The one-click installer in cPanel creates the database, uploads WordPress, writes the configuration file and runs the setup for you. It takes about two minutes and removes the two mistakes that cause most failed manual installs: a mistyped database credential, and a database user that was created but never granted access. For a normal site on a normal domain, this is the right way to install WordPress.
What follows covers the install itself, the settings on that form that are worth thinking about rather than accepting, and the handful of things worth doing straight afterwards.
Where to find it
Log in to cPanel and look for the WordPress icon in the applications or software section. The exact label depends on which installer your account uses, but the flow is the same: pick the application, choose Install, and fill in one form.
If you cannot find it, use the cPanel search box at the top and type WordPress. That is faster than scanning the sections, which are laid out differently across themes.
The form, field by field
Protocol. Choose the https:// option. Ahosting includes a free SSL certificate, so there is no reason to install on plain HTTP and convert later, converting means changing stored URLs and hunting mixed-content warnings, all of which you avoid by starting correctly.
Domain. Pick the domain or subdomain from the list. If you have several, read this twice; installing over the wrong domain is the one mistake here that is genuinely painful.
Directory. This is the field to get right. Leave it empty for the site to live at the domain root, which is what you want in most cases. If the field is pre-filled with wp and you leave it, your site ends up at example.com/wp and moving it later means updating stored URLs. Only enter a directory if you deliberately want the site in a subfolder, such as a blog alongside an existing site.
Site name and description. Both are cosmetic and changeable at any time from Settings. Do not stall here.
Admin username. Change it from the default. admin is the first username tried by every automated login attempt on the internet; picking anything else costs nothing and removes most of the value of those attacks.
Admin password. Use the generator, and save the result in a password manager before you submit. This is the single credential that can install code on your server.
Admin email. Password resets and critical security notices go here. Use an address you actually read, and not one hosted on the site you are about to install: if the site goes down, so does that mailbox.
Language, plugins and themes. Some installers offer to add plugins or a theme during setup. Decline. Install what you need afterwards, deliberately, so you know what is on the site and why.
Submit and wait
The install takes a minute or so. When it finishes you get two links: the site itself, and its admin area at /wp-admin. Log in once now to confirm the credentials work while you still have them in front of you.
If the installer reports that the directory is not empty, something already exists there. Do not force it. Check what is in that directory first: forcing an install over an existing site overwrites files.
Four things to do straight away
Set permalinks. Settings then Permalinks, choose Post name. Doing it now avoids changing URLs after search engines have indexed them.
Confirm HTTPS is actually in force. Load the site and check the address bar. If you installed over https:// this is already done; if not, fix it now rather than after publishing content. Setting up an SSL certificate in WordPress explains it.
Turn on automatic updates for plugins, themes and minor core releases. Outdated plugins are the leading cause of compromised WordPress sites, and this is a thirty-second job on a fresh install. See enabling automatic updates.
Delete what you are not using. A fresh install usually ships with two or three themes and a sample plugin. Keep one spare theme for troubleshooting and remove the rest. Unused code still sits on disk and still needs patching.
Installing a second site on the same account
Run the installer again and choose the other domain. Each installation gets its own database and its own files, and they do not interfere with each other.
Two things are worth knowing. They share the account's resources, so a plugin misbehaving on one site can slow the others. And each is updated separately. A forgotten second site running an outdated plugin is a common way an account gets compromised through the door nobody was watching.
When the auto-installer is the wrong tool
Use a manual install when you are recovering a site whose files exist but whose installation is broken, when you need a specific older release, or when you want to place files in a layout the installer will not produce. Installing WordPress manually walks through the same four operations by hand.
And if the site already exists somewhere else, do not install a fresh copy and paste content across. Migrating properly keeps URLs, IDs and media intact, see moving an existing WordPress site to Ahosting.
For finding the login page and getting in the first time, How to Log in to the WordPress Admin Dashboard goes into it.