Title: Staging Shield Author: davidshum98 Published: September 26, 2026 Last modified: September 26, 2026 --- Search plugins ![](https://ps.w.org/staging-shield/assets/banner-772x250.png?rev=3714223) ![](https://ps.w.org/staging-shield/assets/icon.svg?rev=3714223) # Staging Shield By [davidshum98](https://profiles.wordpress.org/davidshum98/) [Download](https://downloads.wordpress.org/plugin/staging-shield.1.0.2.zip) * [Details](https://mri.wordpress.org/plugins/staging-shield/#description) * [Reviews](https://mri.wordpress.org/plugins/staging-shield/#reviews) * [Installation](https://mri.wordpress.org/plugins/staging-shield/#installation) * [Development](https://mri.wordpress.org/plugins/staging-shield/#developers) [Support](https://wordpress.org/support/plugin/staging-shield/) ## Description When you copy a site to test changes (a staging site, a local copy, a clone made with a migration plugin), the copy takes the whole database with it: real customers, active subscriptions, payment keys and connections to other services. Nothing tells the copy that it is a copy, so it behaves like the real site. It emails customers, charges subscription renewals a second time and ends up in Google. **Staging Shield recognizes copies and closes those doors. On your real site it does nothing.** #### How it knows a site is a copy * It compares the site’s address with your real site’s address, stored in a way that migration tools can’t rewrite when they clone the database. * It reads the signals hosts and tools leave on copies: WP_ENVIRONMENT_TYPE, local domains (.local, .test, localhost) and the staging domains of Kinsta, WP Engine, Pantheon, Flywheel, Pressable, InstaWP and others. * When it isn’t sure, it asks. Until you tell it which site is the real one, it protects nothing, so activating it can never break a live site. #### What a copy can’t do * **Send emails.** Order emails, password resets, newsletters and form notifications are blocked and listed, together with the plugin that tried to send them. It covers WordPress, SMTP plugins such as WP Mail SMTP, FluentSMTP and Post SMTP, and the APIs of email services like SendGrid, Mailgun, Brevo, Postmark and Amazon SES. An optional early guard also stops plugins that try to send on their own. * **Charge subscription renewals twice.** WooCommerce Subscriptions switches to manual renewals on copies. * **Show up in search engines.** noindex, X-Robots-Tag, a closed robots.txt and no sitemaps. * **Be seen by anyone who finds it.** Optionally, only logged-in users can see the copy; visitors get a “private test copy” page. * **Be mistaken for the real site.** The admin bar turns yellow, the browser tab says [COPY], and the cart and checkout show a “test copy” bar. Nothing Staging Shield forces is ever saved to the database. If you publish a copy over your real site, the real site doesn’t inherit “no indexing” or blocked emails. #### Check that it really works The self-test tries, on your site and right now, what a plugin would do: send an email, call an email service, index the site. Each protection is marked green, amber or red, with what to do when something is wrong. Nothing reaches real people while it runs. The Overview tab shows what has been stopped at each address and a short list of first steps. The screens come in a light and a dark theme, chosen by each person. No tracking: nothing is sent unless you start the Pro trial, buy Pro or activate a license. See “External services” below. #### Staging Shield Pro For stores and agencies that clone sites often. Try it free for 14 days, no credit card required. Everything in the free version, plus: * Payments in test mode on copies: WooPayments, Stripe, Redsys and any gateway with a test mode switch. Methods that can only charge real money are hidden at checkout. * Scheduled tasks (WP-Cron) and background queues (Action Scheduler) paused, so renewals, syncs and imports don’t run from the copy. * Connections cut off: email marketing, CRMs, automation webhooks (Zapier, Make), ad conversions, shipping, invoicing and live payment servers, plus WooCommerce webhooks. * Plugins turned off only on copies: backups that would upload to the real site’s storage, analytics, caching, remote management. Nothing is saved, so they stay active on the real site. * A share link to show a private copy to a client without creating a user. * Emails sent to your own test inbox, or only to your team, instead of blocked. * The self-test for all of the above, a report of what can’t be stopped from WordPress on your site, WP-CLI commands (including `wp staging-shield test` for deploy scripts) and translations in 12 languages. ### External services #### Email service APIs: blocked, never contacted Staging Shield itself doesn’t connect to any email service. Its code lists the addresses of email-sending APIs (SendGrid, Mailgun, Brevo, Postmark, SparkPost, Mailjet, Amazon SES, the Gmail API, Microsoft Graph’s sendMail and others) only to recognize the requests other plugins make to them from a copy of your site, and block them. Nothing is sent to those services, and no data leaves your site. The self-test checks that block by passing a SendGrid address through WordPress’s` pre_http_request` filter, which runs before any request is made. No request is ever sent. #### Freemius Staging Shield uses the [Freemius](https://freemius.com/) SDK to offer the free trial and the Pro upgrade, and to manage Pro licenses and updates. * The free version doesn’t ask you to share any data and sends nothing to Freemius while you use it. * If you start the trial, buy Pro or activate a license, the plugin sends Freemius basic data such as your name and email, your site’s address, and your WordPress, PHP and plugin versions, so that licenses and updates can work. Freemius: [terms of service](https://freemius.com/terms/), [privacy policy](https://freemius.com/privacy/) and [data practices](https://freemius.com/privacy/data-practices/). ## Screenshots [⌊The Overview on a copy: what Staging Shield recognized and how it knows, your real site's address, and what it has stopped so far.⌉⌊The Overview on a copy: what Staging Shield recognized and how it knows, your real site's address, and what it has stopped so far.⌉[ The Overview on a copy: what Staging Shield recognized and how it knows, your real site’s address, and what it has stopped so far. [⌊The one-click self-test tries each protection on the spot and marks it green, amber or red. Nothing reaches real people while it runs.⌉⌊The one-click self-test tries each protection on the spot and marks it green, amber or red. Nothing reaches real people while it runs.⌉[ The one-click self-test tries each protection on the spot and marks it green, amber or red. Nothing reaches real people while it runs. [⌊Protections: choose what a copy can't do. Each one says whether it's working on this site.⌉⌊Protections: choose what a copy can't do. Each one says whether it's working on this site.⌉[ Protections: choose what a copy can’t do. Each one says whether it’s working on this site. [⌊Activity: every email the copy tried to send, who it was for and which plugin tried to send it.⌉⌊Activity: every email the copy tried to send, who it was for and which plugin tried to send it.⌉[ Activity: every email the copy tried to send, who it was for and which plugin tried to send it. [⌊On a copy the admin bar says "Copy", and the cart and checkout show a "Test copy" bar, so nobody places a real order by mistake.⌉⌊On a copy the admin bar says "Copy", and the cart and checkout show a "Test copy" bar, so nobody places a real order by mistake.⌉[ On a copy the admin bar says “Copy”, and the cart and checkout show a “Test copy” bar, so nobody places a real order by mistake. [⌊Optional private copy: visitors who aren't logged in see this page instead of the copy.⌉⌊Optional private copy: visitors who aren't logged in see this page instead of the copy.⌉[ Optional private copy: visitors who aren’t logged in see this page instead of the copy. ## Installation 1. In your dashboard, go to Plugins > Add New and search for “Staging Shield”, or upload the zip file. 2. Activate it on your real site **and** keep it active when you copy the site. 3. Open Staging Shield in the dashboard menu and follow the first steps: confirm that this is your real site. From then on, every copy of it is protected automatically. If you install it first on a copy, tell it that it’s a copy and, if you can, type your real site’s address. Then run the self-test on the copy. ## FAQ ### Will it block emails or payments on my live site? No. Protections only run on sites Staging Shield considers copies. On a site that hasn’t been set up yet it does nothing at all, and it only treats an address as your real site after you confirm it (or add it in wp-config.php). ### How do I know it’s working? Open Staging Shield > Overview on the copy and run the self-test. Every check tells you what it tried and what happened. ### My real site changed its domain and now it says “Is this a copy?” That’s expected: the address is no longer the one you confirmed, so Staging Shield protects the site to be safe. Click “This is now my real site” in the notice, or add the new address in Staging Shield > Overview. Until you confirm it, it is never hidden from search engines or closed to visitors. ### How do I turn it off in an emergency? Add this line to wp-config.php. Staging Shield, and its email guard, stop doing anything: ``` define( 'SSHIELD_DISABLE', true ); ``` ### Can I set the real site’s address in wp-config.php? Yes, and it’s the safest way, because a copy always has a different address: ``` define( 'SSHIELD_PRODUCTION_URL', 'https://example.com' ); ``` You can also force the decision with `define( 'SSHIELD_ENVIRONMENT', 'staging' );`( or `production`), but be careful: if wp-config.php is copied to other environments, they inherit it. ### An email plugin still sends from my copy Some email plugins replace how WordPress sends email. Turn on “Extra guard for email plugins” in Staging Shield > Protections: it adds a tiny must-use plugin that loads before any plugin. It does nothing on the real site and is removed when you deactivate Staging Shield. ### I made the copy private. Will test payments still work? Yes. The notifications payment services send in test mode still reach the copy. What is closed are the pages and the parts of the REST API that show content or let people buy. ### Does it work with my host’s one-click staging? Yes. Staging Shield doesn’t depend on how the copy was made. It recognizes the staging domains of many hosts, and for the rest it compares the address with your real site’s. ### Does it work on multisite? Yes, site by site: each site has its own real address and its own protections. ### Does it send any data anywhere? Staging Shield itself doesn’t send your site’s data anywhere. The Freemius SDK, used for the free trial and Pro licenses, only sends data if you start the trial, buy Pro or activate a license. See “External services” below. ### Does the Pro license count my staging copies as extra sites? No. Local and staging addresses (localhost, .local, .test, staging. and dev. subdomains, and the staging domains of hosts such as WP Engine) don’t use up license activations, so a one-site license covers your real site and its copies. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Staging Shield” is open source software. The following people have contributed to this plugin. Contributors * [ davidshum98 ](https://profiles.wordpress.org/davidshum98/) [Translate “Staging Shield” into your language.](https://translate.wordpress.org/projects/wp-plugins/staging-shield) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/staging-shield/), check out the [SVN repository](https://plugins.svn.wordpress.org/staging-shield/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/staging-shield/) by [RSS](https://plugins.trac.wordpress.org/log/staging-shield/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.2 * The settings form is now sanitized as soon as it is read, before any of it is used. #### 1.0.1 * First release. ## Meta * Version **1.0.2** * Last updated **22 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.0 or higher ** * Tested up to **7.1.2** * PHP version ** 7.4 or higher ** * Language * [English (US)](https://wordpress.org/plugins/staging-shield/) * Tags * [clone](https://mri.wordpress.org/plugins/tags/clone/)[development](https://mri.wordpress.org/plugins/tags/development/) [disable emails](https://mri.wordpress.org/plugins/tags/disable-emails/)[staging](https://mri.wordpress.org/plugins/tags/staging/) [woocommerce](https://mri.wordpress.org/plugins/tags/woocommerce/) * [Advanced View](https://mri.wordpress.org/plugins/staging-shield/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/staging-shield/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/staging-shield/reviews/) ## Contributors * [ davidshum98 ](https://profiles.wordpress.org/davidshum98/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/staging-shield/)