Описание
When you copy a site to test changes (a staging site, a local copy, a clone made with a migration plugin), the copy takes the whole database with it: real customers, active subscriptions, payment keys and connections to other services. Nothing tells the copy that it is a copy, so it behaves like the real site. It emails customers, charges subscription renewals a second time and ends up in Google.
Staging Shield recognizes copies and closes those doors. On your real site it does nothing.
How it knows a site is a copy
- It compares the site’s address with your real site’s address, stored in a way that migration tools can’t rewrite when they clone the database.
- It reads the signals hosts and tools leave on copies: WP_ENVIRONMENT_TYPE, local domains (.local, .test, localhost) and the staging domains of Kinsta, WP Engine, Pantheon, Flywheel, Pressable, InstaWP and others.
- When it isn’t sure, it asks. Until you tell it which site is the real one, it protects nothing, so activating it can never break a live site.
What a copy can’t do
- Send emails. Order emails, password resets, newsletters and form notifications are blocked and listed, together with the plugin that tried to send them. It covers WordPress, SMTP plugins such as WP Mail SMTP, FluentSMTP and Post SMTP, and the APIs of email services like SendGrid, Mailgun, Brevo, Postmark and Amazon SES. An optional early guard also stops plugins that try to send on their own.
- Charge subscription renewals twice. WooCommerce Subscriptions switches to manual renewals on copies.
- Show up in search engines. noindex, X-Robots-Tag, a closed robots.txt and no sitemaps.
- Be seen by anyone who finds it. Optionally, only logged-in users can see the copy; visitors get a «private test copy» page.
- Be mistaken for the real site. The admin bar turns yellow, the browser tab says [COPY], and the cart and checkout show a «test copy» bar.
Nothing Staging Shield forces is ever saved to the database. If you publish a copy over your real site, the real site doesn’t inherit «no indexing» or blocked emails.
Check that it really works
The self-test tries, on your site and right now, what a plugin would do: send an email, call an email service, index the site. Each protection is marked green, amber or red, with what to do when something is wrong. Nothing reaches real people while it runs.
The Overview tab shows what has been stopped at each address and a short list of first steps. The screens come in a light and a dark theme, chosen by each person.
No tracking: nothing is sent unless you start the Pro trial, buy Pro or activate a license. See «External services» below.
Staging Shield Pro
For stores and agencies that clone sites often. Try it free for 14 days, no credit card required. Everything in the free version, plus:
- Payments in test mode on copies: WooPayments, Stripe, Redsys and any gateway with a test mode switch. Methods that can only charge real money are hidden at checkout.
- Scheduled tasks (WP-Cron) and background queues (Action Scheduler) paused, so renewals, syncs and imports don’t run from the copy.
- Connections cut off: email marketing, CRMs, automation webhooks (Zapier, Make), ad conversions, shipping, invoicing and live payment servers, plus WooCommerce webhooks.
- Plugins turned off only on copies: backups that would upload to the real site’s storage, analytics, caching, remote management. Nothing is saved, so they stay active on the real site.
- A share link to show a private copy to a client without creating a user.
- Emails sent to your own test inbox, or only to your team, instead of blocked.
- The self-test for all of the above, a report of what can’t be stopped from WordPress on your site, WP-CLI commands (including
wp staging-shield testfor deploy scripts) and translations in 12 languages.
External services
Email service APIs: blocked, never contacted
Staging Shield itself doesn’t connect to any email service. Its code lists the addresses of email-sending APIs (SendGrid, Mailgun, Brevo, Postmark, SparkPost, Mailjet, Amazon SES, the Gmail API, Microsoft Graph’s sendMail and others) only to recognize the requests other plugins make to them from a copy of your site, and block them. Nothing is sent to those services, and no data leaves your site.
The self-test checks that block by passing a SendGrid address through WordPress’s pre_http_request filter, which runs before any request is made. No request is ever sent.
Freemius
Staging Shield uses the Freemius SDK to offer the free trial and the Pro upgrade, and to manage Pro licenses and updates.
- The free version doesn’t ask you to share any data and sends nothing to Freemius while you use it.
- If you start the trial, buy Pro or activate a license, the plugin sends Freemius basic data such as your name and email, your site’s address, and your WordPress, PHP and plugin versions, so that licenses and updates can work.
Freemius: terms of service, privacy policy and data practices.
Скриншоты
Установка
- In your dashboard, go to Plugins > Add New and search for «Staging Shield», or upload the zip file.
- Activate it on your real site and keep it active when you copy the site.
- Open Staging Shield in the dashboard menu and follow the first steps: confirm that this is your real site. From then on, every copy of it is protected automatically.
If you install it first on a copy, tell it that it’s a copy and, if you can, type your real site’s address. Then run the self-test on the copy.
Часто задаваемые вопросы
-
Will it block emails or payments on my live site?
-
No. Protections only run on sites Staging Shield considers copies. On a site that hasn’t been set up yet it does nothing at all, and it only treats an address as your real site after you confirm it (or add it in wp-config.php).
-
How do I know it’s working?
-
Open Staging Shield > Overview on the copy and run the self-test. Every check tells you what it tried and what happened.
-
My real site changed its domain and now it says «Is this a copy?»
-
That’s expected: the address is no longer the one you confirmed, so Staging Shield protects the site to be safe. Click «This is now my real site» in the notice, or add the new address in Staging Shield > Overview. Until you confirm it, it is never hidden from search engines or closed to visitors.
-
How do I turn it off in an emergency?
-
Add this line to wp-config.php. Staging Shield, and its email guard, stop doing anything:
define( 'SSHIELD_DISABLE', true ); -
Can I set the real site’s address in wp-config.php?
-
Yes, and it’s the safest way, because a copy always has a different address:
define( 'SSHIELD_PRODUCTION_URL', 'https://example.com' );You can also force the decision with
define( 'SSHIELD_ENVIRONMENT', 'staging' );(orproduction), but be careful: if wp-config.php is copied to other environments, they inherit it. -
An email plugin still sends from my copy
-
Some email plugins replace how WordPress sends email. Turn on «Extra guard for email plugins» in Staging Shield > Protections: it adds a tiny must-use plugin that loads before any plugin. It does nothing on the real site and is removed when you deactivate Staging Shield.
-
I made the copy private. Will test payments still work?
-
Yes. The notifications payment services send in test mode still reach the copy. What is closed are the pages and the parts of the REST API that show content or let people buy.
-
Does it work with my host’s one-click staging?
-
Yes. Staging Shield doesn’t depend on how the copy was made. It recognizes the staging domains of many hosts, and for the rest it compares the address with your real site’s.
-
Does it work on multisite?
-
Yes, site by site: each site has its own real address and its own protections.
-
Does it send any data anywhere?
-
Staging Shield itself doesn’t send your site’s data anywhere. The Freemius SDK, used for the free trial and Pro licenses, only sends data if you start the trial, buy Pro or activate a license. See «External services» below.
-
Does the Pro license count my staging copies as extra sites?
-
No. Local and staging addresses (localhost, .local, .test, staging. and dev. subdomains, and the staging domains of hosts such as WP Engine) don’t use up license activations, so a one-site license covers your real site and its copies.
Отзывы
Нет отзывов об этом плагине.
Участники и разработчики
«Staging Shield» — проект с открытым исходным кодом. В развитие плагина внесли свой вклад следующие участники:
Участники
Перевести «Staging Shield» на ваш язык.
Заинтересованы в разработке?
Посмотрите код, проверьте SVN репозиторий, или подпишитесь на журнал разработки по RSS.
Журнал изменений
1.0.2
- The settings form is now sanitized as soon as it is read, before any of it is used.
1.0.1
- First release.