Best Practice: Applying Drupal Updates to a Production Website | Mediacurrent Blog Post
Let’s start with the most important "best practice" of applying Drupal updates: stay out of your production ("live") site. Use a local environment (such as Acquia’s Dev Desktop, WAMP, MAMP, etc.), remote development instance, or just about anything that’s not your live server. The point is that upgrading modules and Drupal core can often cause unintended consequences, and you don’t want to be on your live site if/when that happens.