A staging site is a full copy of your site where updates can break things and nobody notices but you. If you’ve ever hit “Update” on live and held your breath, this lesson replaces the breath-holding. (Whether you need one at all is its own question — short version: if the site earns money, yes.) You’ll need hosting-panel access, and a restorable backup of the live site before you copy anything.

Check whether your host will do this for you

Managed WordPress hosts — WP Engine, Kinsta, SiteGround, Flywheel, and plenty of others — have a one-click staging button that creates the copy, rewrites the URLs, and blocks search engines for you. Look in your hosting panel for “Staging” before building anything by hand. If it’s there, click it, skip to the last step, and pocket the hour. The rest of this lesson is for everyone on plain cPanel or a VPS.

Create the staging subdomain

In your panel, add a subdomain — staging.yoursite.com — with its own document root, and let the host issue an SSL certificate for it. A subdomain on the same server is the sweet spot: same PHP version, same database engine, so staging actually predicts what live will do.

Copy the site into it

Files first, then database, then the URL rewrite:

rsync -a ~/public_html/ ~/staging/
wp db export live.sql --path=~/public_html

Create a new, separate database in your panel, point the staging copy’s wp-config.php at it, then import and rewrite:

wp db import live.sql --path=~/staging
wp search-replace 'https://yoursite.com' 'https://staging.yoursite.com' --all-tables-with-prefix --path=~/staging

Never point staging at the live database — that’s just live with extra steps.

Keep staging out of Google

A staging site that gets indexed competes with your real site in search results, and Google is not gentle about duplicates:

wp option update blog_public 0 --path=~/staging

That’s the “Discourage search engines” setting. Better yet, add a password at the server level (cPanel calls it “Directory Privacy”) so only you can see staging at all.

Stop staging from emailing real people

Your copy includes every plugin that sends mail — order notifications, form receipts, renewal reminders. On staging those become confusing messages to real customers. Install the Disable Emails plugin, which does exactly one thing and has no settings:

wp plugin install disable-emails --activate --path=~/staging

While you’re at it: if the site takes payments, switch the gateway to test mode on staging so a test order never charges a real card.

Verify the copy, then put it to work

Load https://staging.yoursite.com. Log in with your normal credentials — same database copy, same users. Click the front page, a post, and the media library, and confirm every URL in the address bar says staging. throughout. Submit a contact form and confirm no email arrives. If all that holds, you have a faithful copy — and from now on, every update runs here first, and live only ever gets changes that staging already survived. Refresh the copy from live before each round of testing so you’re rehearsing on this week’s site, not last month’s.