Before installing WordPress
Prepare the domain, HTTPS binding, compatible PHP version and database. After installation through the software store or your existing deployment, check that the panel detects the correct site. Administrator, reseller and customer actions remain subject to site ownership.
Application code and the uploads directory have different access needs. Limit update permissions to the relevant application identity. Determine which operation writes to which directory instead of granting broad server-wide write access.
What does each tool do?
| Tool | Purpose | Verification |
|---|---|---|
| Administrator login link | Short-lived, single-use access | Correct site and account |
| Maintenance mode | Limit visitor access during work | Is the site open again afterwards? |
| Security measures | Apply supported hardening settings | Do plugins and administration still work? |
| Cloning / staging | Test on a separate site | Are hostname, data and side effects isolated? |
A practical update sequence
- Back up files and the database together, and identify a restore point.
- Test the update on a staging copy and check PHP/plugin compatibility.
- Prevent staging from causing real payments, customer emails or production background jobs.
- Test login, forms, uploads and any checkout flow after theme, plugin and core changes.
- Plan the live maintenance window around operations that write data.
- Check caches and pages after deployment, then leave maintenance mode.
Copying staging back to production
Staging does not imply automatic safe merging of live data. A file/database copy can overwrite newer orders, comments or uploads on the destination. Confirm source and target, decide what data must survive, and plan how writes are paused during the transition.
Protect a test site with access control. A noindex instruction alone does not make private data confidential. Review test URLs and mail settings before copying them into production.
If something breaks after updating
Record the time, changed components and application error log. Distinguish PHP compatibility, plugin conflicts, rewrite rules and file permissions. For rollback, keep file and database versions compatible: changing a plugin folder alone does not reverse every schema change.
Frequently asked questions
Can a staging site email real customers?
Yes, if production settings are copied. Restrict mail, payment and scheduled-job side effects explicitly in the test environment.
Which parts belong in a WordPress backup?
Protect application, theme, plugin and upload files together with the database they use.