October DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsClean PCRecommendedOne scan can reveal what keeps slowing WindowsLook for cleanup and repair opportunities.Run ScanOctober DealsAmazon USDeal season is back - check today's better picksAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
VGSources
Blog

How to Set Up Version Control for WordPress

A practical WordPress Git setup: choose the right repository scope, initialize and secure it, manage database migrations and uploads separately, deploy through staging, automate with WP-CLI, and prepare a tested rollback.
Length12 min Posted Quest giverVGSources Team
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Use Git to version the WordPress code you own, not the entire live site by default. Keep a custom theme, plugin, selected wp-content directories, build files, and deployment scripts in a repository; keep the database, uploads, secrets, and host-managed WordPress core in separate operational workflows. A reliable setup is local development → Git repository → staging → production, with database migrations and backups handled deliberately at each release.

This guide explains how to choose the repository boundary, initialize Git, protect sensitive files, move database changes, deploy with or without managed hosting, automate repeatable tasks with WP-CLI, and recover when a release fails.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What Git should control in a WordPress site

WordPress has two different kinds of state. PHP, JavaScript, CSS, templates, block metadata, configuration, and deployment scripts are files that can be reviewed and merged. Posts, pages, menus, widget settings, plugin options, users, and other records live in the database. Media uploaded through the dashboard normally lives in wp-content/uploads. Treating both categories as if they were ordinary source files causes noisy commits, leaked credentials, and incomplete rollbacks.

The practical boundary is ownership. Version the custom code and configuration your team maintains. Treat WordPress core and third-party packages as managed inputs that are installed or rebuilt at deployment time. A full-site repository can still be useful, but it should be a deliberately scoped repository under wp-content, not an automatic copy of every file in the WordPress installation.

#1 Best Overall
Sale
Gaoye Blue Light Blocking Glasses
  • BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
  • EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
  • COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
  • LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
  • WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
  • Good Git candidates: custom themes, child themes, custom plugins, must-use plugins, build configuration, dependency manifests and lock files, deployment scripts, and project documentation.
  • Usually separate from source commits: database content, user uploads, secrets, logs, caches, generated dependency directories, and host-managed core files.
  • Exception: include an item only when the hosting provider documents a workflow that requires it and the team understands how it is restored.

Choose the repository scope before running Git

Repository scope determines who can change a file, how often it changes, and how safely it can be deployed. Start with the smallest boundary that gives the team useful history.

One custom theme

Initialize the repository in wp-content/themes/acme-theme when the theme is the main asset you develop. This keeps commits focused and allows the theme to be tested and deployed independently. A child theme belongs in its own directory and can have its own repository if it has a separate release cycle.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

One custom plugin

Use wp-content/plugins/acme-tools for a plugin that your team owns. Include its source, tests, build instructions, and dependency manifests. Do not place unrelated plugins in the same repository merely because they happen to be installed on the site.

A selected wp-content repository

A broader repository is appropriate when a site has several coordinated custom components, must-use plugins, shared build tooling, or deployment configuration that must change together. Track selected directories rather than every installed package. WordPress.com’s GitHub guidance recommends a repository for each theme, plugin, or full-site project and, for a full site, tracking the contents of wp-content instead of automatically tracking the entire WordPress installation.

Approach What is tracked Best fit Main trade-off
Theme repository One custom or child theme Theme teams and independent releases Site-wide plugin and deployment changes are elsewhere
Plugin repository One custom plugin Reusable functionality with its own release cycle Theme and infrastructure history is separate
Selected wp-content Several owned themes, plugins, build files, and scripts Coordinated site projects Requires stricter boundaries and a more careful deployment process
Entire WordPress installation Core plus all content and installed files Only when a host explicitly requires it Large, noisy history and a higher risk of tracking secrets or generated data

Prepare a local development environment

Work on a local WordPress installation before changing the repository. The WordPress Theme Handbook treats a local development environment, a capable editor, and version-control integration as foundational tooling. Match the production PHP version, database engine, enabled extensions, WordPress version, and relevant plugin versions as closely as practical.

  1. Install a local WordPress environment and create a site that can be reset or restored quickly.
  2. Install Git and configure your author name and email with git config --global user.name and git config --global user.email.
  3. Open the project directory in your editor and confirm that the theme or plugin activates without PHP errors.
  4. Record the local setup, required PHP version, Node or Composer commands, and any build steps in a project README.
  5. Make a harmless change, such as editing a development-only style, and verify that the change appears on the local site before creating the first commit.

Initialize the repository and make the first commit

For a theme repository, change into the theme directory. For a plugin repository, change into that plugin directory. For a broader project, use the selected project root under wp-content.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #2
Windex Gaming Cleaning Wipes, Pre-Moistened Wipes to Instantly Clean all Gaming Gear and Electronics, Resealable Packaging for a Freshness Lock, 25 count (Pack of 1)
  • WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
  • AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
  • PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
  • ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
  • COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
  1. Run git init to create the local repository.
  2. Create the project’s ignore rules before staging files. This prevents credentials, uploads, caches, and generated output from entering the first commit.
  3. Inspect the candidate files with git status. Read the list rather than staging everything automatically.
  4. Stage only intended files with git add, then review the staged patch with git diff --cached.
  5. Create a descriptive initial commit, for example git commit -m "Add initial Acme theme structure".
  6. Create an empty or initialized repository on your chosen Git host, then add its SSH or HTTPS address with git remote add origin and push the branch with git push -u origin main.

GitHub Desktop follows the same model: the documented theme flow creates a repository in the theme folder and adds Git metadata, including .git and .gitattributes. Whether you use the desktop client or the command line, inspect the first commit in the remote interface and confirm that no secrets or user content were included.

Write project-specific exclusion rules

There is no universal WordPress .gitignore. The correct list depends on the host, build system, plugins, and whether a directory is rebuilt or uploaded during deployment. Start with rules for the assets your project definitely does not own, then review them with the hosting team.

# local configuration and secrets
.env
.env.*
wp-config-local.php

# runtime data
wp-content/uploads/
wp-content/cache/
wp-content/upgrade/
*.log

# dependency and build output
node_modules/
vendor/
dist/
coverage/

# editor and operating-system files
.DS_Store
.idea/
.vscode/

The example intentionally treats dist and vendor as generated directories. If your release artifact is built elsewhere and the host expects committed compiled files, remove the corresponding rule and document why. Never commit production passwords, API keys, private certificates, or a complete production configuration file. Use environment variables or the host’s secret store instead.

Use commits, branches, and reviews as a release record

Commit changes in units that can be tested and reverted. A commit that changes a template, its accompanying CSS, and the test that validates the behavior is easier to review than a week of unrelated edits. Write messages that identify the outcome, such as Fix archive pagination for filtered queries, rather than messages such as updates.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Keep the production branch protected when your Git host supports branch rules. Develop a feature or fix in a short-lived branch, push it to the remote, and open a pull request for review. The reviewer should inspect the diff, confirm that build files and migrations are present, and check that no environment-specific values slipped in. Merge only after the change works in the local environment and the project’s automated checks pass.

Tags are useful for releases. A tag such as acme-theme-2026.10.1 identifies the exact code that was sent to staging or production. If the project uses Composer or Node, commit the manifest and lock file so the deployment can reproduce the tested dependency versions; rebuild the dependency directory instead of committing it when the host supports that workflow.

Rank #3
Sale
LISEN Cell Phone Stand Phone Holder for Desk, Office Decor Gadgets for Men
  • Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
  • Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
  • Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
  • ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
  • Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)

Keep the database and uploads out of ordinary code commits

Git does not automatically version WordPress posts, pages, options, menus, plugin settings, or users. Media files in wp-content/uploads also need a storage and backup policy. Decide how these assets move between environments before you promise that a code deployment is reversible.

Export and import with WP-CLI

WP-CLI provides scriptable database operations. A typical backup before a migration is:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
wp db export backups/pre-release.sql

On the destination, import only after verifying the backup and maintenance plan:

wp db import backups/pre-release.sql

When a local copy uses a different domain, use WP-CLI’s search-and-replace command rather than editing a SQL dump by hand:

wp search-replace 'http://local.test' 'https://staging.example' --all-tables-with-prefix --skip-columns=guid

The exact flags depend on the migration. WordPress stores serialized PHP data in many options and metadata fields, so test search-and-replace on a disposable copy and confirm that serialized values remain valid. Take a fresh database backup before every destructive import or replacement, and verify the site in staging before touching production.

Separate uploads from deployment artifacts

Do not assume that deploying a theme or plugin copies media. Use the host’s documented media storage, synchronization, and backup process. If a site must replicate uploads between environments, define that process separately and record how permissions, large files, and deleted media are handled.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #4
Ledagic IC+RGBW USB Powered Led Light Bar with App & Remote Control, 2 Pack
  • Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
  • Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
  • 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
  • Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
  • USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC

Deploy through staging before production

The safest general sequence is local development, remote repository, staging, verification, and production. WordPress.com documents this local-to-GitHub-to-staging or production flow, and its GitHub Deployments feature can deploy code changes directly to a configured staging or production site when the plan and site settings support it.

  1. Merge the reviewed pull request or select a release tag.
  2. Build dependencies from the committed lock files and run the project’s linting, tests, and asset build.
  3. Deploy the resulting code to staging using the host’s documented Git integration, artifact upload, or server-side checkout.
  4. Run wp core verify-checksums where the host permits it, then check the changed templates, forms, scheduled tasks, REST endpoints, and logged-in and logged-out views.
  5. Apply a database migration only after taking the staging backup and confirming that the migration is compatible with the code already running there.
  6. Record the tested commit or tag, reviewer, migration status, and any manual activation steps.
  7. Promote the same tested code to production, take the production database backup required by the host, and monitor logs and key user journeys.

Some themes and plugins require an activation or update step after files arrive. Include that action in the release script or runbook rather than relying on a developer to remember it. Never activate an untested branch directly on a live site.

Compare deployment approaches

Deployment model Code movement Database handling Automation depth When it fits
Manual pull on a self-managed host Server checks out a reviewed commit or receives an artifact Separate WP-CLI export/import or migration script Low to medium Small teams with shell access and a clear runbook
Managed WordPress Git deployment Host connects a repository to staging or production Host-specific; still requires a planned database process Medium to high Teams whose plan and site configuration support repository deployments
CI/CD with WP-CLI Pipeline builds, tests, and sends a known artifact Scripted, reviewed migrations with backups High Frequent releases or multiple environments
Studio Sync Bidirectional site synchronization rather than a Git-only workflow Designed for complete-site and Site Editor changes Varies by setup Projects where Git is unavailable or full-site synchronization is the priority

Studio Sync is an alternative documented by WordPress.com for cases where Git is unavailable or when complete-site and Site Editor changes need bidirectional synchronization. It is a different operating model, not a reason to place a production database dump in a normal source repository.

Automate repeatable operations with WP-CLI

WP-CLI’s principle is that WordPress actions are scriptable. Keep repeatable release commands in the repository so a human and a CI runner execute the same procedure. Common building blocks include:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • wp plugin list and wp plugin update --all for inventory and controlled updates.
  • wp theme list and wp theme activate acme-theme for theme state.
  • wp core verify-checksums for a core integrity check where supported.
  • wp db export, wp db import, and wp search-replace for documented database operations.
  • Custom WP-CLI commands or shell scripts for cache clearing, rewrite flushing, health checks, and post-deployment verification.

Keep scripts idempotent where possible: running a check twice should not create duplicate records or damage content. Fail the pipeline when a required command returns a nonzero status. Store environment-specific credentials in the CI or host secret manager, never in the script. Test every script on staging with the same PHP and WordPress versions used in production.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Plan rollback before enabling automatic deployment

A code rollback and a database rollback are different operations. To restore code, redeploy the last known-good commit or use git revert to create a new commit that undoes the faulty change. A database backup or a compatible reverse migration is required for database changes; reverting PHP files alone cannot restore deleted records or changed options.

Best Value
Sale
HUANUO FlowLift™ Dual Monitor Stand, Fully Adjustable Gaming Monitor Desk Mount for 13–32″ Computer Screens, Full Motion VESA 75x75/100x100 with C-Clamp & Grommet Base, Each Arm Holds 4.4 to 19.8 lbs
  • Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
  • Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
  • Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
  • Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
  • Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
  1. Identify the failed release tag and the last verified tag.
  2. Put the site in the maintenance mode or traffic-control state required by the host.
  3. Redeploy the verified code version.
  4. Restore the database backup or run the tested reverse migration if the schema or content changed.
  5. Clear relevant caches, verify the front end and administrative screens, and inspect error logs.
  6. Record the incident, the exact commands used, and the follow-up fix before reopening automatic deployment.

Test rollback on staging before production automation. A rollback plan that has never been exercised is only a hypothesis, especially when a release includes irreversible data transformations.

Common mistakes and fixes

Committing the whole server directory

Symptom: the repository contains WordPress core, caches, logs, uploads, and installed packages. Fix: create a new scoped repository for the owned theme, plugin, or selected wp-content directories. Keep core and generated assets in the host or build process.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Leaking a configuration secret

Symptom: a password or API key appears in a commit or pull request. Fix: revoke and rotate the credential immediately, remove it from the working tree and history using a documented secret-removal process, and add the relevant file or pattern to the project’s ignore rules. Deleting the latest file does not invalidate an exposed credential.

Assuming Git restored the database

Symptom: code was rolled back but menus, settings, or content remain changed. Fix: restore the matching database backup or run a tested reverse migration, then verify serialized data and URLs.

Overwriting production uploads

Symptom: a deployment removes or replaces media. Fix: keep uploads outside the code artifact and use the host’s documented media and backup process.

Running a migration once without documenting it

Symptom: a second staging run fails or a new environment lacks a required schema change. Fix: store the migration and its order in the repository, make it safe to detect an already-applied change, and include backup and verification steps in the release runbook.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Deploying an unbuilt branch

Symptom: PHP changes arrive but compiled JavaScript or CSS is missing. Fix: define the build command, lock its dependencies, run it in CI or on the deployment target, and deploy the resulting artifact consistently.

Pre-release checklist

  • The repository contains only code and configuration the team intends to own.
  • Secrets, local settings, logs, caches, uploads, and generated dependencies are excluded or handled by a documented exception.
  • The commit or tag has been reviewed and can be identified unambiguously.
  • Build, lint, and test commands pass with the production-compatible runtime.
  • A database backup exists, and any migration has been tested with serialized-data handling.
  • Staging has been checked for front-end, editor, administrator, REST, cron, and integration behavior.
  • The production deployment and rollback commands are written down for the specific host.
  • Someone knows how to restore the database and where uploads are stored.

How to choose the right setup

Choose a theme or plugin repository when one component is independently maintained. Choose a selected wp-content repository when several custom components must be released together. On a self-managed host, start with reviewed commits, a staging server, WP-CLI scripts, and manual promotion; add CI/CD after the steps are reliable. On a managed WordPress.com site, use the documented GitHub repository and GitHub Deployments workflow when the plan and configuration support it. If your project needs complete-site and Site Editor synchronization or cannot use Git, evaluate Studio Sync instead.

The durable design is not a particular Git provider or CI product. It is a clear separation between versioned code, environment configuration, database state, and user-generated files, backed by a staging gate and a rollback procedure that has been tested on the host you actually run.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More quests from Patch Notes

  1. How to Set Up a RedM (RDR2) Server in 2026: License Key, txAdmin and server.cfg, Step by StepBlog11min
  2. Best RedM (RDR2) Server Hosting in 2026: Comparing Four Hosts on Slots, Memory and PriceBlog10min
  3. How to Host a Mindustry Server in 2026: server-release.jar, Port 6567 and the Commands That MatterBlog7min
Recommended PC Tool
Recommended PC Tool
Outdated Drivers Are Slowing You DownFree scan - exact matches
PC Slower Than It Used to Be?Free scan - under a minute

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.