What Is a Staging Environment? Setting One Up for Your Website

Ways to set up staging

Setting up staging on web hosting

1. Create a subdomain. In your control panel, create a subdomain such as staging.yourdomain.com; the panel prepares a separate folder for its files. The steps are in our What is a subdomain? article.
2. Copy the files. Compress the live site's files with the file manager, copy them to the staging folder and extract them there.
3. Create a separate database. Export the live database from phpMyAdmin, then create a new database and user and import it. The staging site must never connect to the live database.
4. Update the configuration. Enter the new database details in the staging copy's configuration file (wp-config.php in WordPress).
5. Change the site address. WordPress stores the site address in the database. Update the addresses in the staging database to staging.yourdomain.com; use a search-and-replace plugin or wp search-replace with WP-CLI for this. Don't run a plain find-and-replace directly in the database; serialized data can break.

These steps are almost the same as moving a site; the details are in our How to migrate a website guide.

Staging on your own server

On your own server, staging is set up as a separate site:

• Use a separate folder, a separate database and a separate .env file for staging (APP_ENV=staging).
• In Nginx, create a separate server block for the staging subdomain.
• If you use Git, feed the staging server from a separate branch (for example develop or staging); changes merged into the main branch go live, and the staging branch is deployed to staging. We cover automated deployment in our How to deploy with Git guide.

Protect the staging site

A staging site shouldn't be open to everyone:

Password protection. Put a password on the staging folder with Directory Privacy in your control panel or a similar feature. If you use Nginx:

location / {
    auth_basic "Staging";
    auth_basic_user_file /etc/nginx/.htpasswd-staging;
}

You can create the password file with the htpasswd tool (the apache2-utils package on Ubuntu).

Hiding it from search engines. A staging site showing up on Google can lead to duplicate content problems. Password protection largely prevents this; in addition, add a noindex header to every page:

add_header X-Robots-Tag "noindex, nofollow" always;

In WordPress, you can also tick the option to discourage search engines on the Settings → Reading page. Be careful not to carry this setting over to live.

Turn off email and payments

The staging copy contains your live site's user and customer list. If you don't take precautions:

• A test on staging can send order or newsletter emails to real customers.
• Scheduled tasks can run the same jobs as the live site a second time.

To prevent this, turn off email sending on staging or redirect all emails to a test address; switch payment gateways to test (sandbox) mode and remove the live API keys from staging. If possible, anonymize personal data in the staging copy.

Moving changes to live

1. Back up the live site first.
2. Move code and settings. Put theme, plugin and code changes live with Git or a file transfer.
3. Be careful with the database. Uploading the staging database to live as it is deletes the orders, comments and users created on live after the staging copy was made. In most cases only code and settings are moved; you make content changes on live, or apply database changes with migrations.
4. Check on live. Try important pages, forms and payment steps again.
5. Refresh staging regularly. The staging copy drifts away from live over time; take a fresh copy from live before major changes.

We cover backup habits in our Server backups guide.

Staging with Nodesty

On Nodesty web hosting plans, you can set up your staging site on the same account by creating a subdomain and a separate database through cPanel or DirectAdmin; the number of subdomains and databases you can create depends on the plan limits, and free SSL is available for every subdomain. With JetBackup, you can reach your live site's backups from the control panel. If you want to set up a separate staging server for your application, our AMD Ryzen 9 9950X VPS plans offer full root access.