WordPress Staging Site
A WordPress staging site is a private copy of your live site, with its own URL and database, for testing plugin, theme or PHP changes before visitors see them. Create it with your host's staging tool or a cPanel subdomain copy, replace the URLs, password-protect it, and push only changed files back so live orders are not lost.
For WordPress and WooCommerce owners who want to test updates safely before they touch the live site.
knowledge
- Read time
- 3 min
- Sections
- 7
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026.
What is a WordPress staging site?
A WordPress staging site is a private copy of your live site, with its own URL and database, where you test plugin, theme or PHP changes before visitors see them. The live site keeps running untouched until you decide a change is safe.
It is not a second public website. Search engines should not reach it, it must not share the live database, and it should never send emails to real customers. Most WordPress breakages come from updates, so a staging copy is the cheapest insurance a busy site can have.
Which ways can you create a WordPress staging site?
There are three routes: a one-click staging tool in your hosting plan, a manual copy on a subdomain through cPanel, or a staging plugin run from wp-admin. Choose the host tool when you have it; it handles the copy and URLs for you.
| Decision | Host staging tool | Manual copy in cPanel | Staging plugin |
|---|---|---|---|
| Where you start | Hosting panel | Subdomain, File Manager, MySQL Databases | Plugins screen in wp-admin |
| What is created | Separate folder and database | Folder and database you create | Subdirectory or subdomain with copied tables |
| URL handling | Automatic | You run the search and replace | Usually automatic |
| Usual failure | Push overwrites live data | Copy still points at the live domain | Push replaces a shop's live database |
WebJi® WordPress Unlimited plans include a staging tool; plan details are on WordPress hosting, and managed WordPress adds done-for-you updates.
How do you create a WordPress staging site in cPanel?
Create a subdomain, copy the WordPress files into it, copy the database into a new database, point the copy's wp-config.php at that database and replace the URLs.
- Create
staging.example.inunder Domains and confirm it has its own folder. - Copy the live files into that folder, or use Softaculous' clone tool if your account has it.
- Create a new database and user, and import a copy of the live database into it.
- Edit the staging wp-config.php: new DB_NAME, DB_USER and DB_PASSWORD, never the live ones.
- Replace the live URL with the staging URL, as in the search and replace guide.
- Password-protect the folder with cPanel's Directory Privacy so only you can open it.
With SSH and WP-CLI, the database part takes four commands (export runs on the live site, the rest on staging):
wp db export live.sql
wp db import live.sql
wp search-replace 'https://example.in' 'https://staging.example.in' --skip-columns=guid
wp option update blog_public 0Why must the staging copy have its own site URL and home URL?
Because if either address still says the live domain, every click sends you back to production and you may edit the wrong site. Under Settings › General, the WordPress Address is where the files live and the Site Address is where visitors are sent; on staging both must be the staging host.
If a redirect loop stops you logging in, set them in the staging wp-config.php, along with the environment type that WordPress has supported since version 5.5:
define( 'WP_HOME', 'https://staging.example.in' );
define( 'WP_SITEURL', 'https://staging.example.in' );
define( 'WP_ENVIRONMENT_TYPE', 'staging' );Plugins can read wp_get_environment_type() to switch off live-only behaviour on a copy.
What must you switch off on a WordPress staging site?
Switch off anything that reaches the outside world: customer emails, live payment keys, scheduled jobs that call external services, and search indexing. A staging copy of a shop still holds real customer addresses.
- Email: use a mail-blocking or mail-logging plugin so test orders do not email real customers.
- Payments: put Razorpay, PayU or other gateways into test mode with test keys.
- Webhooks and cron: disable sync jobs to couriers, ERPs or marketplaces.
- Indexing: "Discourage search engines" is only a request; a password on the folder is what actually keeps the copy private.
- Certificate: give the staging hostname its own SSL so the browser does not block your test.
How do you set up WordPress staging on a VPS or CloudPanel?
Create a second site on a staging hostname, copy the files, import a database dump into a new database, point that copy's wp-config.php at it and run the URL replace. Never point staging at the live database, or a form test writes into production.
On a VPS you can also use HTTP basic authentication in the staging vhost, so only people with the password reach the copy, and give it its own certificate with Certbot.
How do you push staging changes live without losing orders?
Back up the live site, then copy only the changed files and settings to production; never overwrite a shop's live database with the staging one. Orders, customers and comments kept arriving on the live site while you tested.
- Take a fresh live backup you can restore.
- Repeat the tested plugin, theme or PHP change on live, or copy the changed files.
- Do not copy the staging wp-config.php or database over the live ones.
- Check that "Discourage search engines" is unticked on production.
- Delete or keep password-protecting the staging copy once the test is over.
Host tools with a one-click "push" can replace the whole live database; on a store, use a files-only push or apply the change by hand.
Frequently asked questions
Can I build a staging site on shared hosting?
Yes. A subdomain plus a copied database is enough on cPanel, and Softaculous can clone WordPress where it is installed. Check your plan's disk space first, because the copy roughly doubles the site's files and database.
Will a staging site cause duplicate content in Google?
Only if Google can reach it. Password-protect the staging folder and set it to discourage search engines; if a copy was indexed by mistake, add the protection and remove the URLs with Search Console's Removals tool.
Should every plugin update be tested on staging first?
Test major updates, page builders, WooCommerce and anything touching checkout or forms. Small, well-maintained plugins on a brochure site can update directly, provided a recent backup exists.
How often should I refresh the staging copy?
Refresh it from live before each round of testing. An old copy hides problems caused by content, settings or plugin versions that have changed since, so a test on stale staging proves less than it seems.
Last editorial update: 15 November 2026.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.