Clear WordPress administration guides.

Back up both the database and site files, including wp-content, wp-config.php and any server configuration you depend on. Store the copy away from the hosting account and confirm that the archive opens and the database export is readable.

Follow the restore guide to test a complete backup in an isolated environment. Disable outgoing customer email, payments and other live integrations on the copy, then check media, logins and important features. Opening the archive alone does not test recovery.

Prepare hosting and HTTPS before changing WordPress addresses. The domain change guide covers replacing stored links with a tool that preserves their data format, checking Elementor pages, redirecting old addresses and notifying search engines. Keep the old domain available for the redirects.

Ask another authorised administrator or your host to help first. The password reset guide also explains a careful database fallback when those routes are unavailable. Confirm the correct site and user before changing a record; do not add temporary public password-reset code.

Increase it only after confirming memory exhaustion in a log. A higher limit can restore a request, but it may hide a plugin, query or import that consumes excessive memory. Stay within the host's configured maximum.

A staging copy lets you test updates and changes away from visitors. Configure access protection and contain outgoing mail, payments and integrations; discouraging search indexing does not make the copy private. Plan deployment so older test data never overwrites new live orders or form entries.

Inventory DNS, email, PHP, scheduled tasks, storage and integrations, then create and test a full backup. Lower DNS TTL in advance where appropriate and keep the old hosting available until the new site, HTTPS and mail-dependent forms are verified.

Use the database cleanup guide for a backed-up, targeted review of trash, spam and expired temporary records. Keep data you still need and check the site after each selected operation. An unfamiliar table name is not evidence that it is safe to delete.

Give each person the least privilege needed for their work. Reserve Administrator for people who must change plugins, themes, users or site-wide settings, and review accounts regularly when staff or suppliers change.

Disabling the built-in plugin and theme editors reduces the chance of accidental live changes and removes one route an attacker could use after gaining admin access. Keep a controlled SFTP, repository or deployment route for legitimate edits.