I literally live between ops sentiment and this sentiment
I stand shit up as a test server and then threat model before cloning a production server to a separate vlan and lock it down proper, with the added Intel of a snapshot on how the test server got tested.








I stood up a test, staging, and prod pair of web server/dbs, got the Drupal 8 site stable on Drupal 10, hand it over, and yeah. No one uses anything but prod.
Thanks for 3x the work, ya dicks.