Halloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsClean PCRecommendedOne scan can reveal what keeps slowing WindowsLook for cleanup and repair opportunities.Run ScanHalloween DealsAmazon USOctober picks are moving - compare before checkoutAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
World desk11 min

How to Set Up Version Control for WordPress (Themes, Plugins, and Safe Deployments)

A practical WordPress Git workflow: version the custom code you own, keep database content and secrets separate, and deploy reviewed commits through staging with WP-CLI.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Use Git to version the WordPress code and configuration your team owns—not the entire live site. Keep a custom theme, plugin, build files, deployment scripts, and documentation in a repository; keep the database, uploads, secrets, and host-managed core separate; then move reviewed commits through staging before production. This arrangement gives you an auditable change history and a practical code rollback without pretending that a Git checkout can restore database content.

What WordPress version control should cover

WordPress is a combination of files and state. PHP, CSS, JavaScript, templates, block patterns, plugin code, build configuration, and deployment scripts are source files. Posts, pages, menus, widget settings, user accounts, plugin options, and other settings are database records. Media uploaded through the dashboard is normally stored under wp-content/uploads, while credentials and environment-specific values belong in secret storage or host configuration.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Git is designed for the first group. A repository records who changed a file, what changed, why it changed, and which revision is deployed. It does not automatically capture a database edit made in the WordPress administrator, and it should not become a public container for passwords or production-only configuration.

For a normal project, treat WordPress core and third-party packages as managed inputs. Version the custom code that you own and record how the remaining inputs are installed. A full-site repository can still be useful, but the usual boundary is a carefully selected part of wp-content, not an unfiltered copy of the entire WordPress installation.

#1 Best Overall
Seagate 2TB Portable Hard Drive | USB 3.0 (STGX2000400) | Everyday HDD storage. Plug-and-play backup. Windows & macOS. Adobe CC trial included. 1-Year Warranty
  • Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
  • Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
  • To get set up, connect the portable hard drive to a computer for automatic recognition no software required
  • This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
  • The available storage capacity may vary.

Choose the repository boundary before you initialize Git

The right scope depends on whether you maintain one component or the application code for an entire site. Decide this first; moving files between repositories later changes deployment paths and can invalidate automation.

Project scope Typical repository location Track Keep outside ordinary commits
Custom theme wp-content/themes/your-theme Theme PHP, templates, styles, scripts, block assets, configuration, and build manifests Uploads, database records, secrets, and WordPress core
Custom plugin wp-content/plugins/your-plugin Plugin PHP, assets, tests, build files, and documentation Plugin-generated data, credentials, logs, and caches
Child theme or must-use plugin The individual directory under wp-content/themes or wp-content/mu-plugins All code needed to reproduce that component Runtime content and environment-specific values
Broader site codebase A deliberately scoped repository under wp-content Selected custom themes, plugins, mu-plugins, build configuration, dependency manifests, and release scripts Unfiltered uploads, database dumps containing personal data, secrets, caches, and host-managed files

WordPress.com’s setup guidance describes a GitHub repository for each theme, plugin, or full-site project and, for a full site, recommends tracking the contents of wp-content rather than automatically tracking the whole installation. On a self-managed host, the same boundary avoids committing a copy of core that is better installed and verified by the host or a release script.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Prepare a reproducible local environment

Start with a local WordPress site that resembles staging: the same PHP major version, database engine, enabled extensions, and build commands where practical. Use a code editor with Git integration, as the WordPress Theme Handbook treats a development environment and version-control tooling as foundational. Do not begin by cloning production into a public repository.

Collect the project details

  • Record the local site URL and document any required hosts-file or local-domain setting.
  • Write down the PHP and database versions, active theme, custom plugins, and the Node or Composer commands used to build them.
  • Identify the deployment target: a self-managed host, a managed WordPress service, or separate staging and production sites.
  • List environment-specific values—database credentials, salts, API keys, mail credentials, and private certificates—that must be supplied outside Git.
  • Decide where database exports and media backups will be stored. They are operational backups, not substitutes for source control.

Create the first repository

Use a repository that contains only the scope you chose. The command-line flow below assumes you are inside a custom theme directory; replace the path for a plugin or a broader project.

  1. Open the component directory. In a terminal, change to the directory that should become the repository root, for example wp-content/themes/your-theme.
  2. Initialize Git.
    git init

    This creates the local .git directory without uploading anything.

  3. Add exclusions before the first commit. Create a .gitignore suited to the project, review it, and confirm that no secret or generated file is staged.
  4. Inspect the proposed snapshot.
    git status

    Read the output rather than using a blanket git add . without checking what it includes.

  5. Stage and commit the intended files.
    git add .
    git commit -m "Initial version of custom theme"

    Use a message that identifies the change, not a vague label such as “updates.”

  6. Create a remote repository. On GitHub, choose a private repository unless the code is intentionally public. Do not initialize the remote with another README or license if that would create an unnecessary merge on the first push.
  7. Connect and push.
    git remote add origin <repository-url>
    git branch -M main
    git push -u origin main

    Replace <repository-url> with the remote address shown by GitHub; do not put a password or token in the command or in a file that will be committed.

GitHub Desktop offers the equivalent documented theme flow: choose the theme folder as the repository location, create the repository, and let the client add the .git and .gitattributes metadata. Review those generated files along with the initial diff before publishing.

Build a project-specific .gitignore

There is no host-independent exclusion list. The correct entries depend on your build tools, deployment target, and whether a file is source or generated output. Start from a small, reviewed file and add exclusions when you can explain why each one is safe.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #2
Seagate Portable 5TB External Hard Drive HDD – USB 3.0 for PC, Mac, PS4, & Xbox - 1-Year Rescue Service (STGX5000400), Black
  • Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
  • Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
  • To get set up, connect the portable hard drive to a computer for automatic recognition software required
  • This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
  • The available storage capacity may vary.
# Local configuration and secrets
.env
.env.*
*.key
*.pem

# Logs, caches, and local runtime data
*.log
wp-content/cache/
wp-content/uploads/

# Dependency directories rebuilt during deployment
node_modules/
vendor/

# Operating-system and editor noise
.DS_Store
.idea/
.vscode/

The example is a starting point, not a universal prescription. If your deployment requires committed Composer or Node output, do not exclude that output. Conversely, if a cache directory is outside the repository root, excluding it here has no effect. Check the result with git status --ignored and scan staged files for credentials before the first push. If a secret was committed, removing it in a later commit is not enough; revoke or rotate it and remove it from the repository history using the host’s documented procedure.

Use branches and reviews to control changes

Keep main deployable. Create a short-lived branch for a feature, bug fix, dependency update, or content-independent template change, then open a pull request for review. A useful review checks the rendered behavior, the file diff, build output, database implications, and the release or rollback plan.

A practical branch sequence

  1. Update your local base.
    git switch main
    git pull --ff-only
  2. Create a working branch.
    git switch -c fix/mobile-navigation
  3. Make one coherent change. Keep unrelated formatting or generated files out of the branch so the review remains understandable.
  4. Run the project checks. Use the documented lint, test, and build commands; if no automated checks exist, at minimum activate the change on local WordPress and exercise the affected templates or plugin screens.
  5. Commit and publish the branch.
    git add path/to/changed-files
    git commit -m "Fix mobile navigation toggle"
    git push -u origin fix/mobile-navigation
  6. Review and merge. Require another person where the project warrants it, resolve conflicts locally, and merge only after staging validation.

Do not use a branch as a substitute for a backup. A branch can restore code; it cannot restore a deleted page, an altered option, or a media file that was never committed.

Keep the database and files synchronized deliberately

Posts, pages, menus, plugin settings, and many Site Editor changes live in the database. A code checkout alone cannot reproduce them. Use WP-CLI database export, import, and search-replace operations as part of a documented migration process, and take a backup before changing a shared environment.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Export and import with WP-CLI

# Export the source database
wp db export backups/source.sql

# Import a prepared database on the target
wp db import backups/source.sql

# Replace the source URL after migration
wp search-replace 'https://source.example' 'https://staging.example' --all-tables-with-prefix

Use the actual domains and paths for your environments. Search-and-replace must handle serialized data correctly; test the chosen command and migration sequence on staging before using it on production. Keep database dumps out of the Git repository when they contain personal information or credentials, and store them under the retention and access controls used for backups.

Decide what happens to media

Uploads are usually environment data, not source. Keep them in the host’s media storage and include them in a backup or media-sync process. If a site intentionally versions a small set of design assets, document that exception and its deployment destination; do not silently mix ordinary user uploads with code.

Rank #3
Seagate Portable 1TB External Hard Drive HDD – USB 3.0 for PC, Mac, PlayStation, & Xbox, 1-Year Rescue Service (STGX1000400) , Black
  • Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
  • Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
  • To get set up, connect the portable hard drive to a computer for automatic recognition no software required
  • This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
  • The available storage capacity may vary.

Deploy through staging, not directly from an unreviewed checkout

The safest general sequence is local development, review in GitHub, deployment to staging, verification, and then production. Staging should use the same release commands and configuration shape as production, while its database and credentials remain separate.

Deployment approach How code reaches the site Database responsibility When it fits
Manual pull on a self-managed host An operator checks out a reviewed commit or tag, installs dependencies, builds assets, and runs release commands over the host’s approved access method. Separate WP-CLI export/import or migration script, with a backup first. Small teams that can document and repeat the release.
CI/CD to a self-managed host A pipeline runs checks, packages the selected commit, and invokes the host’s deployment mechanism. Explicit migration step; never assume a code deploy changes database state safely. Teams needing repeatability, approvals, and deployment logs.
WordPress.com GitHub Deployments When the plan and site configuration support it, GitHub Deployments can send code changes from GitHub to a WordPress.com staging or production site. Still separate; code deployment does not make database content version-controlled. Managed WordPress.com sites using its documented integration.
Studio Sync WordPress.com documents Studio Sync as an alternative for bidirectional synchronization when Git is unavailable or a complete site and Site Editor changes need to move together. Synchronization behavior follows that product’s workflow rather than a Git commit. Projects prioritizing full-site synchronization over a code-only repository.

For any target, review the exact diff, confirm the commit or tag being released, run the build, and activate or update the theme or plugin according to the host’s workflow. Do not infer that a successful file transfer means the site is ready; check PHP errors, front-end pages, forms, scheduled tasks, and the administrator screens affected by the change.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Automate repeatable release work with WP-CLI

WP-CLI describes its project as “Every action, scriptable.” Put repeatable commands in versioned release documentation or scripts so every operator and pipeline performs the same checks. Common building blocks include:

# Inspect installed components
wp core version
wp plugin list
wp theme list

# Verify WordPress core files
wp core verify-checksums

# Activate a reviewed theme
wp theme activate your-theme

# Update or activate a plugin when the release requires it
wp plugin update your-plugin --version=1.2.3
wp plugin activate your-plugin

Use only the commands and versions appropriate to your project. A deployment script might verify checksums, install locked dependencies, build assets, run application checks, execute a backward-compatible database migration, and record the released commit. Keep destructive commands—such as database imports or bulk search-replace—behind an explicit approval step.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Define rollback before enabling automatic production deployment

Rollback has two independent parts: code and data. To restore code, redeploy the last known-good commit or create a revert commit after reviewing the cause. To restore data, use a compatible database backup or a tested migration reversal. Reverting PHP files while leaving a newer database schema or option value can create a second failure.

Minimum rollback runbook

  1. Stop the automated deployment or place the site in the host’s maintenance mode if the incident requires it.
  2. Record the deployed commit, the database migration version, and the first observable error.
  3. Restore the previous code revision in staging first and confirm that its dependencies are available.
  4. Choose a database backup or reversal that matches that code revision. Do not import an unverified dump over production.
  5. Test login, front-end rendering, forms, scheduled jobs, and the specific feature that failed.
  6. Redeploy the approved revision, monitor logs, and document the cause and the recovery.

Every host handles access, backups, maintenance mode, and deployment hooks differently. Write the host-specific commands and approval points in the repository documentation before you turn on unattended production releases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #4
Seagate Portable 4TB External Hard Drive HDD – USB 3.0, 1-Year Rescue | Everyday HDD storage. Plug-and-play backup. Windows & macOS. Adobe CC trial included. 1-Year Warranty
  • Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
  • Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
  • To get set up, connect the portable hard drive to a computer for automatic recognition no software required
  • This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
  • The available storage capacity may vary.

Common failure modes and fixes

The repository contains the entire WordPress installation

Symptoms include large noisy diffs for core updates, files managed by the host, and accidental inclusion of secrets or uploads. Create a new scoped repository for custom code, or remove unrelated paths after confirming the deployment process does not depend on them. Install and verify core separately.

A secret appears in Git history

Rotate the exposed credential immediately, disable the old key, and follow the remote host’s history-rewrite procedure. Add the file pattern to the project’s ignore rules and check all branches and tags. Treat the old value as compromised even if the file is deleted from the current branch.

The deployed theme or plugin is missing built assets

Compare the local build output with the deployment package. Either commit the generated files when the host expects them, or install locked dependencies and run the build during deployment. The choice must be consistent with the repository’s ignore rules and documented release script.

The code deploy succeeds but the site is broken

Check for a database migration that was skipped, an incompatible plugin version, a missing environment variable, or a PHP-version difference between staging and production. Restore the last known-good code and compatible data rather than repeatedly redeploying the same failing commit.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

A migration damages serialized settings

Stop further imports, restore the pre-migration backup in a safe environment, and reproduce the operation on staging with a serialization-aware tool. Do not use an untested text replacement against a raw SQL dump.

Two developers edit the same template

Pull the current base before starting, keep branches focused, and resolve conflicts locally. Open the resulting page in a local WordPress site; a conflict that Git can merge syntactically can still produce invalid PHP or incorrect template behavior.

Quick Recap

Bestseller No. 1
Seagate 2TB Portable Hard Drive | USB 3.0 (STGX2000400) | Everyday HDD storage. Plug-and-play backup. Windows & macOS. Adobe CC trial included. 1-Year Warranty
Seagate 2TB Portable Hard Drive | USB 3.0 (STGX2000400) | Everyday HDD storage. Plug-and-play backup. Windows & macOS. Adobe CC trial included. 1-Year Warranty
This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable; The available storage capacity may vary.
$129.99
Bestseller No. 2
Seagate Portable 5TB External Hard Drive HDD – USB 3.0 for PC, Mac, PS4, & Xbox - 1-Year Rescue Service (STGX5000400), Black
Seagate Portable 5TB External Hard Drive HDD – USB 3.0 for PC, Mac, PS4, & Xbox - 1-Year Rescue Service (STGX5000400), Black
This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable; The available storage capacity may vary.
$219.99
Bestseller No. 3
Seagate Portable 1TB External Hard Drive HDD – USB 3.0 for PC, Mac, PlayStation, & Xbox, 1-Year Rescue Service (STGX1000400) , Black
Seagate Portable 1TB External Hard Drive HDD – USB 3.0 for PC, Mac, PlayStation, & Xbox, 1-Year Rescue Service (STGX1000400) , Black
This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable; The available storage capacity may vary.
$119.80
Bestseller No. 4
Seagate Portable 4TB External Hard Drive HDD – USB 3.0, 1-Year Rescue | Everyday HDD storage. Plug-and-play backup. Windows & macOS. Adobe CC trial included. 1-Year Warranty
Seagate Portable 4TB External Hard Drive HDD – USB 3.0, 1-Year Rescue | Everyday HDD storage. Plug-and-play backup. Windows & macOS. Adobe CC trial included. 1-Year Warranty
This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable; The available storage capacity may vary.
$189.99

Security and maintenance practices

  • Use a private remote for non-public code and restrict repository, deployment, and production access separately.
  • Store secrets in the host or CI secret manager, not in wp-config.php committed to Git. Commit a documented example configuration with fake values if teammates need a template.
  • Pin Composer and Node dependencies with their lock files when those tools are used. Rebuild generated directories during deployment unless the host explicitly requires them in the repository.
  • Tag production releases or record immutable commit IDs so an incident can identify exactly what was deployed.
  • Review dependency and WordPress core updates in staging. A Git diff shows source changes, but it does not prove that a third-party update is compatible with your database or PHP version.
  • Back up both database and uploads on a schedule independent of Git. Test that the backups can actually be restored.

A repeatable setup checklist

  1. Choose a local environment and editor that match the target closely enough to expose compatibility problems.
  2. Select one repository boundary: theme, plugin, must-use plugin, or a deliberately scoped wp-content project.
  3. Write and review .gitignore before staging files.
  4. Initialize Git, inspect git status, commit the first clean snapshot, and push it to a private or intentionally public GitHub repository.
  5. Document dependency installation, build commands, required PHP extensions, and environment variables.
  6. Adopt a branch and pull-request flow with a protected deployable branch.
  7. Define database export/import, URL replacement, media handling, and backup procedures outside the code repository.
  8. Deploy a reviewed commit to staging and run functional checks.
  9. Automate safe, repeatable operations with WP-CLI and keep destructive steps approved.
  10. Write and test a code-plus-database rollback runbook before production automation.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
PC Slower Than It Used to Be?Free scan - under a minute
Outdated Drivers Are Slowing You DownFree scan - exact matches

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.