Setting Up Secure WordPress Development Environments

Development environments need security too. Insecure dev setups can leak credentials, expose sensitive data, and create pathways to production systems.

Development Environment Security Risks

Common Vulnerabilities

• Production credentials in dev environments
• Publicly accessible staging sites
• Debug mode exposing sensitive information
• Shared hosting between dev and production
• Version control exposing secrets

Local Development Setup

Recommended Tools

• Docker containers for isolation
• Local development tools (LocalWP, MAMP, Lando)
• Virtual machines for complete isolation
• WSL2 for Windows developers

Docker Configuration

# docker-compose.yml for secure WordPress dev
version: "3.8"
services:
  wordpress:
    image: wordpress:latest
    ports:
      - "127.0.0.1:8080:80"  # Local only
    environment:
      WORDPRESS_DEBUG: 1
    volumes:
      - ./wp-content:/var/www/html/wp-content
    networks:
      - wpnet

  db:
    image: mysql:8
    environment:
      MYSQL_ROOT_PASSWORD: ${DB_ROOT_PASS}
    networks:
      - wpnet

networks:
  wpnet:
    internal: true  # No external access

Staging Environment Security

Access Restrictions

• IP whitelist for staging access
• HTTP authentication layer
• VPN requirement for access
• Unique staging URLs (not predictable)

htaccess Protection

# Protect staging with password
AuthType Basic
AuthName "Staging Access"
AuthUserFile /path/to/.htpasswd
Require valid-user

# Also restrict by IP
Order deny,allow
Deny from all
Allow from 192.168.1.0/24
Satisfy all

Credential Management

Environment Variables

// wp-config.php using environment variables
define('DB_NAME', getenv('WP_DB_NAME'));
define('DB_USER', getenv('WP_DB_USER'));
define('DB_PASSWORD', getenv('WP_DB_PASS'));

// Never commit these values to version control

Secret Management Tools

• HashiCorp Vault
• AWS Secrets Manager
• 1Password CLI
• Doppler for environment sync

Version Control Security

Git Ignore Essentials

# .gitignore for WordPress
wp-config.php
.env
*.log
/wp-content/uploads/
/wp-content/cache/
/wp-content/upgrade/
.htpasswd

Pre-commit Hooks

• Scan for secrets before commit
• Check for debug code
• Validate PHP syntax
• Run security linters

Data Handling in Dev

Sanitizing Production Data

• Anonymize user data in dev copies
• Remove or replace emails
• Scramble personal information
• Never use real payment data

CI/CD Pipeline Security

• Secure deployment credentials
• Scan code before deployment
• Separate deployment keys per environment
• Audit deployment logs

Conclusion

Secure development environments prevent credential leaks and protect your production site. Use isolated environments, manage secrets properly, and never expose staging sites publicly.