To clone a WordPress website, you make a complete copy of its files and database, put that copy at a new address (a staging subdomain, a local machine or a new domain), update the site URL inside the copied database, and then lock the clone down so search engines cannot index it and it cannot email your customers or take payments. Most hosts and several plugins can create the copy for you. The part that needs care is what you do with the clone once it exists.
This guide explains how to clone a WordPress website for the common reasons people do it, which method to use, and the safety steps that most tutorials skip.
Why clone a WordPress site?
A clone is a working duplicate of a live site. People use one to:
- Build a staging site to test plugin updates, theme changes or a redesign before touching the live site.
- Debug a problem without experimenting on a site that customers are using.
- Develop locally on your own computer, where changes are fast and private.
- Start a new site from an existing one, such as a second brand that shares the same theme and plugin setup.
- Rehearse a migration, so you know exactly how long the real move takes.
The purpose matters because it changes the setup. A temporary staging copy needs strict privacy. A new site built from a clone needs its old content, users and settings cleaned out. If the goal is moving the live site permanently, that is a different job; see our guide to moving a WordPress site to a new host.
Choose your cloning method
Your host’s staging tool
Many managed WordPress hosts offer one-click staging that copies the site to a private address on the same account. This is usually the quickest and safest option, because the host handles the URL changes and often blocks search engines automatically. Check what it copies: some tools skip certain folders or custom database tables, and pushing changes back to live may overwrite the live database.
A cloning or migration plugin
Plugins such as Duplicator package the files and database into an archive with an installer that you run at the new location. This works on most hosts and for local copies. Large sites can run into upload limits, timeouts or memory limits on shared hosting, so test with a small site first if you have never used the plugin.
WP-CLI and command line tools
If you have SSH access on both ends, you can copy the files with tools like rsync or tar, export the database, and use WP-CLI to update URLs. This is the most reliable method for large sites and gives you full control. Our guide to migrating WordPress manually walks through the file and database steps; the sections below focus on what is specific to a clone.
How to clone a WordPress website, step by step
Whichever tool creates the copy, the steps around it are the same.
- Pick the clone’s address. For staging, a subdomain like
staging.example.comon the same server is common. For local work, use a local development tool. For a new site, use its final domain. - Back up the live site before you start, in case anything touches it by accident.
- Create the copy with your chosen method: files, database and the uploads folder.
- Point the clone at its own database. Never let a clone share the live site’s database. Its
wp-config.phpmust use a separate database, with its own user and password. - Update the URLs in the clone’s database (details below).
- Lock it down: block search engines, stop outgoing email and disable live payments.
- Test the clone and confirm the live site is untouched.
Changing URLs without breaking the clone
When the clone lives at a different address, every reference to the old domain in the database has to change: the site and home URLs, links in post content, image paths, and settings stored by themes and plugins.
You cannot do this with a simple find and replace on the SQL file. WordPress and many plugins store some settings as serialized PHP data, which records the length of each text value. Change a URL’s length with a plain text replace and those values become invalid, which can silently wipe widget, theme or plugin settings. The WordPress documentation on moving sites warns about exactly this.
Use a tool that understands serialized data. With WP-CLI, run a dry run first to see what would change:
wp search-replace 'https://example.com' 'https://staging.example.com' --skip-columns=guid --dry-runIf the counts look right, run it again without --dry-run. The --skip-columns=guid part leaves the GUID column alone, which WordPress says should never be changed. Without WP-CLI, a search and replace plugin that handles serialized data does the same job from the dashboard.
After the replace, clear any caches and visit the clone. If you are still redirected to the live site, check that the home and siteurl options were updated and that no WP_HOME or WP_SITEURL constants in wp-config.php are forcing the old address.
Lock the clone down
A clone is an exact copy of a live site, including its connections to the outside world. Left alone, it can cause real damage. Go through each of these.
Keep it out of search results
Duplicate copies of your site in search results compete with the real one. Protect staging with password protection at server level, which is the most reliable block. As a second layer, tick the setting under Settings > Reading that asks search engines not to index the site. A robots.txt block alone is not enough to keep URLs out of results.
Stop it emailing your users
A clone of a store or membership site can send order updates, password resets or newsletters to real customers, especially when scheduled tasks run. Disable outgoing email on the clone with a plugin that blocks or logs mail, or by reconfiguring the SMTP plugin to a test inbox.
Disable live payments and integrations
Switch payment gateways to test or sandbox mode, or disable them. Disconnect or repoint webhooks, CRM syncs, automation tools and API keys so the clone does not create duplicate records, charge cards or trigger workflows. If your live site connects to tools through Zapier or webhooks, check each one.
Watch scheduled tasks
WordPress cron on the clone will run the same scheduled jobs as live: subscription renewals, imports, social posting. Pause what you do not need, or disable WP-Cron on the clone while you work.
Limit access
Remove user accounts that do not need staging access, and change passwords if the clone is shared with contractors. A clone contains a full copy of customer data, so treat it with the same care as the live site.
Using a clone as the base for a new site
If you are cloning to start a new website, the clean-up is different:
- Delete posts, pages, products and media that belong to the old site.
- Remove customer and user accounts that should not move across.
- Update the site title, tagline, logo, contact details and legal pages.
- Replace analytics, tag manager and pixel IDs so data does not mix.
- Change API keys and license keys where licenses are per site.
- Regenerate security salts in
wp-config.php. - Rewrite content rather than reusing it word for word, so the two sites do not publish duplicate copy.
Pushing changes from staging back to live
This is where clones cause the most trouble. Copying the staging database over live replaces everything that happened on live since you cloned it: new orders, form entries, comments, user sign-ups and posts.
Safer approaches:
- Move code changes only (theme files, custom plugins) and repeat configuration changes by hand on live.
- Use your host’s push tool if it supports pushing files only, or selected tables.
- For content-heavy changes on a busy site, plan a short content freeze and push during a quiet period.
When the clone has served its purpose, delete it, its database and any backups of it you no longer need.
When to get help
Learning how to clone a WordPress website on a brochure site is straightforward. Cloning a store, a membership site or anything with live integrations is where small oversights cause big problems. If you want a staging environment set up properly or a clone turned into a new site, our WordPress migration team can handle it. Email support@growthscribe.com.
FAQ
What is the easiest way to clone a WordPress website?
If your host offers a staging tool, that is usually easiest, because it handles copying and URL changes for you. Otherwise a cloning plugin can package your files and database into an archive you install at the new address. Either way, lock the clone down afterward.
Will a cloned WordPress site hurt my SEO?
It can if search engines index it, because it duplicates your live content. Protect staging clones with a password at server level and turn on the setting that discourages search engines. A clone used as a new site needs its own rewritten content.
Why can’t I just find and replace the URL in the database file?
WordPress and many plugins store settings as serialized data that records the length of each value. Changing a URL’s length with a plain text replace corrupts those values and can wipe settings. Use WP-CLI’s search-replace command or a plugin that handles serialized data.
Can I copy my staging site back over my live site?
You can, but copying the whole database overwrites anything that changed on live since you made the clone, such as orders, comments and form entries. Move code changes separately and repeat settings changes by hand, or use a host tool that pushes only files or selected tables.
