Gorilla Staging Guard

A staging site of your live site carries your whole database with it: your customers, your payment settings, your scheduled tasks. Whether your host, a plugin or you made it (a local site, a clone or a restored backup counts too), it can email those customers, charge their cards, run renewals and show up in search results as if it were the real shop.

Gorilla Staging Guard stops that on every staging site, and leaves your live site alone.

What a staging site can no longer do

• Email your customers. WordPress’s email is stopped and reported as sent, so forms and orders still work for testing. The common mailers and email services are covered, and the plugin names any it cannot stop.
• Take real payments through the gateways it knows. Stripe, PayPal, Mollie, Square, Authorize.Net and POLi read their settings as test mode. Nothing is saved, so pushing the staging site back over the live site leaves real payments on.
• Run your automations. Scheduled tasks and WooCommerce actions pause, WooCommerce Subscriptions renewals are not charged, and webhooks are not delivered.
• Contact the live site. It cannot reach your live site through WordPress’s own connections.
• Be listed by search engines. Search engines are asked not to list it, and WordPress offers no sitemap.

A label in the admin bar (“Env: Staging”, “Env: Development”, “Env: Production”) shows you which site you are on.

How it knows a site is a staging site

The live site records its own address the first time an administrator opens wp-admin there, when that address is clearly the main domain (otherwise it asks). A staging site carries that record with it, under a different address: a subdomain such as staging.example.com, a folder such as example.com/staging, or a name that says it is a staging site. No setting is needed on the staging site. Hosts and agencies can also say so in wp-config.php.

Safe for the live site

The live site’s own address and www are never treated as a staging site by their address alone. A site whose address does not clearly look like a staging site is asked about, never blocked: until you answer, it sends email and takes payments as usual. Nothing the plugin forces on a staging site is saved, so nothing it changes travels back to the live site.

Proof, not promises

On a staging site, the self-test asks each protection what it would do with a harmless test message, payment setting or task, and shows the answer. On the live site, “What would a staging site do?” runs the same test without changing anything. The Activity tab lists what was stopped, with addresses partly hidden.

Free, with no account

No sign-up, no upsell, no outside service. The plugin makes no requests of its own.

Documentation

The full guide, from how it knows a site is a staging site to every setting, is at https://docs.gorillaplugins.com/staging-guard/.