Staging Shield

开发者	davidshum98
更新时间	2026年9月26日 20:13
PHP版本:	7.4 及以上
WordPress版本:	7.1
版权:	GPLv2 or later
版权网址:	版权信息

下载

1.0.2

详情介绍:

When you copy a site to test changes (a staging site, a local copy, a clone made with a migration plugin), the copy takes the whole database with it: real customers, active subscriptions, payment keys and connections to other services. Nothing tells the copy that it is a copy, so it behaves like the real site. It emails customers, charges subscription renewals a second time and ends up in Google. Staging Shield recognizes copies and closes those doors. On your real site it does nothing. How it knows a site is a copy

It compares the site's address with your real site's address, stored in a way that migration tools can't rewrite when they clone the database.
It reads the signals hosts and tools leave on copies: WP_ENVIRONMENT_TYPE, local domains (.local, .test, localhost) and the staging domains of Kinsta, WP Engine, Pantheon, Flywheel, Pressable, InstaWP and others.
When it isn't sure, it asks. Until you tell it which site is the real one, it protects nothing, so activating it can never break a live site.

What a copy can't do

Send emails. Order emails, password resets, newsletters and form notifications are blocked and listed, together with the plugin that tried to send them. It covers WordPress, SMTP plugins such as WP Mail SMTP, FluentSMTP and Post SMTP, and the APIs of email services like SendGrid, Mailgun, Brevo, Postmark and Amazon SES. An optional early guard also stops plugins that try to send on their own.
Charge subscription renewals twice. WooCommerce Subscriptions switches to manual renewals on copies.
Show up in search engines. noindex, X-Robots-Tag, a closed robots.txt and no sitemaps.
Be seen by anyone who finds it. Optionally, only logged-in users can see the copy; visitors get a "private test copy" page.
Be mistaken for the real site. The admin bar turns yellow, the browser tab says [COPY], and the cart and checkout show a "test copy" bar.

Nothing Staging Shield forces is ever saved to the database. If you publish a copy over your real site, the real site doesn't inherit "no indexing" or blocked emails. Check that it really works The self-test tries, on your site and right now, what a plugin would do: send an email, call an email service, index the site. Each protection is marked green, amber or red, with what to do when something is wrong. Nothing reaches real people while it runs. The Overview tab shows what has been stopped at each address and a short list of first steps. The screens come in a light and a dark theme, chosen by each person. No tracking: nothing is sent unless you start the Pro trial, buy Pro or activate a license. See "External services" below. Staging Shield Pro For stores and agencies that clone sites often. Try it free for 14 days, no credit card required. Everything in the free version, plus:

Payments in test mode on copies: WooPayments, Stripe, Redsys and any gateway with a test mode switch. Methods that can only charge real money are hidden at checkout.
Scheduled tasks (WP-Cron) and background queues (Action Scheduler) paused, so renewals, syncs and imports don't run from the copy.
Connections cut off: email marketing, CRMs, automation webhooks (Zapier, Make), ad conversions, shipping, invoicing and live payment servers, plus WooCommerce webhooks.
Plugins turned off only on copies: backups that would upload to the real site's storage, analytics, caching, remote management. Nothing is saved, so they stay active on the real site.
A share link to show a private copy to a client without creating a user.
Emails sent to your own test inbox, or only to your team, instead of blocked.
The self-test for all of the above, a report of what can't be stopped from WordPress on your site, WP-CLI commands (including wp staging-shield test for deploy scripts) and translations in 12 languages.

安装:

In your dashboard, go to Plugins > Add New and search for "Staging Shield", or upload the zip file.
Activate it on your real site and keep it active when you copy the site.
Open Staging Shield in the dashboard menu and follow the first steps: confirm that this is your real site. From then on, every copy of it is protected automatically.

If you install it first on a copy, tell it that it's a copy and, if you can, type your real site's address. Then run the self-test on the copy.

屏幕截图:

升级注意事项:

1.0.2 Hardening of the settings form. 1.0.1 First release.

常见问题:

Will it block emails or payments on my live site?

No. Protections only run on sites Staging Shield considers copies. On a site that hasn't been set up yet it does nothing at all, and it only treats an address as your real site after you confirm it (or add it in wp-config.php).

How do I know it's working?

Open Staging Shield > Overview on the copy and run the self-test. Every check tells you what it tried and what happened.

My real site changed its domain and now it says "Is this a copy?"

That's expected: the address is no longer the one you confirmed, so Staging Shield protects the site to be safe. Click "This is now my real site" in the notice, or add the new address in Staging Shield > Overview. Until you confirm it, it is never hidden from search engines or closed to visitors.

How do I turn it off in an emergency?

Add this line to wp-config.php. Staging Shield, and its email guard, stop doing anything: define( 'SSHIELD_DISABLE', true );

Can I set the real site's address in wp-config.php?

Yes, and it's the safest way, because a copy always has a different address: define( 'SSHIELD_PRODUCTION_URL', 'https://example.com' ); You can also force the decision with define( 'SSHIELD_ENVIRONMENT', 'staging' ); (or production), but be careful: if wp-config.php is copied to other environments, they inherit it.

An email plugin still sends from my copy

Some email plugins replace how WordPress sends email. Turn on "Extra guard for email plugins" in Staging Shield > Protections: it adds a tiny must-use plugin that loads before any plugin. It does nothing on the real site and is removed when you deactivate Staging Shield.

I made the copy private. Will test payments still work?

Yes. The notifications payment services send in test mode still reach the copy. What is closed are the pages and the parts of the REST API that show content or let people buy.

Does it work with my host's one-click staging?

Yes. Staging Shield doesn't depend on how the copy was made. It recognizes the staging domains of many hosts, and for the rest it compares the address with your real site's.

Does it work on multisite?

Yes, site by site: each site has its own real address and its own protections.

Does it send any data anywhere?

Staging Shield itself doesn't send your site's data anywhere. The Freemius SDK, used for the free trial and Pro licenses, only sends data if you start the trial, buy Pro or activate a license. See "External services" below.

Does the Pro license count my staging copies as extra sites?

No. Local and staging addresses (localhost, .local, .test, staging. and dev. subdomains, and the staging domains of hosts such as WP Engine) don't use up license activations, so a one-site license covers your real site and its copies.

更新日志: