Testing before production.
THE OPTIONS
A subdomain on the same server, with its own document root, database and user A separate smaller VPS, which isolates it properly A local environment on your own machine
THE SAME SERVER
Simplest and cheapest. Create staging.yourdomain.com as its own virtual host with its own database.
Be aware it shares resources with production. A heavy test affects the live site.
KEEPING IT PRIVATE
Restrict access by IP address, or with HTTP authentication Configure the application to discourage search engine indexing
Do not rely on an obscure subdomain name; certificates publish it.
KEEPING IT REALISTIC
Staging is only useful if it matches production: the same PHP version, the same extensions, the same web server configuration.
A staging environment that differs from production finds different bugs from the ones you have.
DATA
Copy production data periodically so tests are meaningful. Consider anonymising personal data if the staging environment is less protected.
PROMOTING CHANGES
Deploy to staging, test, then deploy the same code to production.
