Skip to content
Register

WordPress staging that actually works on cheap hosts?

Web Hosting by tallinnying 12 replies 944 views
tallinnying

Member OP

Night Shift

#1

So its 3am and im trying to push a wp site from live to staging on some ancient Hostinger reseller account anyway

Softaculous has this staging button right but it clones the whole db including a 4GB logging table from a plugin I disabled in 2019
Idk why I do this

Wpvivid is better but the free tier chokes on anything over 2GB
And the cheap hosts throttle the zip extraction so hard it times out

Has anyone actually solved this without paying for a migration plugin that costs more than the hosting

builds at 3AM, sleeps at noon
FR

Member

#2

Softaculous staging is broken by design. It copies everything blindly. WPvivid free has a 2GB hard limit. Both are wrong tools for this job.

Use rsync. Make a subdomain. Exclude wp-content/uploads if static assets are shared.

Done.

salavi

Member

Threat Modeler

#3

Threat model this first

Assume compromise on your production wp instance
Your staging environment inherits that blast radius if you clone db verbatim
Attack surface expands when you mirror plugins with known cves to a subdomain

  • Softaculous does not sanitize during clone
  • Wpvivid free does not rotate credentials between environments

Your bash script must isolate staging db credentials or you are zero trust in name only

Carl3

Member

Keyboard Defender

#4

Kiddo listen up

I have been doing this since before you were born

Shitf key stuck again but who cares

rsync is the only way that works on these garbage tier hosts

I have a bash script that does the whole thing in 45 seconds

Want it or not kiddo

lol3

Member

#5

Yikes softaculous is for noobs anyway gg

Heres my box script been running it on RackNerd for like 2 years pwn

rsync -avz --exclude 'wp-config.php' --exclude 'uploads' ./ staging.example.com:/var/www/staging/
Wp db export | sed 's/live_db/staging_db/g' | mysql staging_db
Gg done in 30 seconds no plugin needed

Half this thread gonna copy it now lol

hankels

Member

52 VPS and counting

#6

Lol3's sed swap doesnt rotate db credentials tho

seedbox, NAS, tape, and three offsite
salavi

Member

Threat Modeler

#7
lol3 said:
Wp db export | sed 's/live_db/staging_db/g' | mysql staging_db

This is not credential rotation. This is string replacement. Your staging db still uses the same password hash, same salts, same user privileges. If production is popped, attacker pivots to staging with identical creds.

Also RackNerd does not have a Manila datacenter. Your 30 second script is running across Pacific undersea cables with no compression. Add -z to rsync at minimum.

lol3

Member

#8
salavi said:
Also RackNerd does not have a Manila datacenter

Lol who cares about the dc location my ping is fine

The script works. Been using it. You want me to add openssl rand base64 for salts or something? Fine. Overkill for a staging site but fine.

hankels said:
Lol3's sed swap doesnt rotate db credentials tho

Neither does Softaculous. Neither does WPvivid free. At least my way is fast.

glasgow_tom

Member

9 #9
frank59 said:
Exclude wp-content/uploads if static assets are shared.

This is the bit that actually matters on these hosts. I did the full clone dance on a Hostinger shared plan in London and hit the inode limit before the db even finished. 200k files in uploads from a decade of client sites.

Now I keep uploads on a separate subdomain pointing at the same directory. Staging just symlinks it. Hostinger support had no idea what I was asking when I tried to raise the limit.

rsync with --exclude is the only practical path.

hankels

Member

52 VPS and counting

9 #10
lol3 said:
Neither does Softaculous. Neither does WPvivid free.

This is called "two wrongs make a right" and it's how you end up on Virdot's daily breach list.

I run 52 VPS. Staging gets its own user, own db user, random 32 char password, and the salts are regenerated from wordpress.org secret-key service every deploy. Ansible playbook. Takes 90 seconds including coffee sip.

If you're doing this by hand on 12 dollar a year RackNerd boxes I get it. But don't pretend it's secure.

seedbox, NAS, tape, and three offsite

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft