Frequently asked questions¶

What counts as a staging site?¶

Any copy of your live site that runs at another address: a staging site made by your host or a plugin, a local site on your computer, a clone, or a restored backup. It carries the live site's database, so without protection it can reach the live site's customers.

Where is the plugin's screen?¶

Tools → Staging Guard, with the tabs Status, Activity, Settings and About.

Do I need to set anything up?¶

No. Install it on the live site; every staging site made from then on protects itself. If the plugin cannot tell whether a site is the live one, it asks once on the Plugins screen. Setting WP_ENVIRONMENT_TYPE on each site is the surest way: see Getting started.

How does it know a site is a staging site?¶

From wp-config.php or the hosting first, then by comparing the site's address with the live site's recorded address. See How it knows.

Can it ever block my live site?¶

Not on a guess. The live site's own address and www. are never treated as a staging site by their address alone, and a site it is not sure about is asked about, never blocked: until you answer, it sends email and takes payments as usual. See Safe for the live site.

How do I test email or checkout on a staging site?¶

On the staging site, under Tools → Staging Guard → Settings, list the addresses that may still receive mail, or switch on Send to me. Checkout works in each gateway's test mode. A staging site freshly copied from the live site starts with all of these off again. See Settings.

Can I set it in wp-config.php?¶

Yes: WP_ENVIRONMENT_TYPE, GORILLA_STAGING_GUARD_MODE, GORILLA_STAGING_GUARD_LIVE_URL and GORILLA_STAGING_GUARD_DISABLE. See Settings in wp-config.php.

I moved my site to a new domain. What happens?¶

A move to a new domain is asked about once, and the site keeps working until you answer. A move to a subdomain of the old address, or to an address named like a staging site, is treated as a staging site straight away. See A site moved to a new domain.

What happens when I push a staging site to the live site?¶

Nothing the plugin did on the staging site travels with it: test mode, paused tasks and search settings were never saved, and the staging site's own choices apply only at its address. See Pushing a staging site to the live site.

Does it work on multisite?¶

Yes. Each site in a network has its own status, recorded live address and activity. See Multisite.

What does it stop on a staging site?¶

Email, payments through the gateways it knows, subscription renewals, WooCommerce webhooks, scheduled tasks, requests to the live site and search engine listing. See What it stops.

What can it not stop?¶

Payment gateways it does not know, mailers with their own connection, files the web server sends without WordPress, and anything run outside WordPress. See What no plugin can stop.

Can it stop every email?¶

No plugin can. A mailer that talks to its email service on its own connection, such as Mailchimp for WooCommerce, can still send; the plugin names those it finds on the Status tab. FluentSMTP 2.1.0 and later is stopped like any other.

Does it work with other staging or email plugins?¶

Yes. It runs alongside SMTP and email log plugins, host staging tools, Staging Superpowers, Staging Shield, Disable Emails and Gorilla Essentials, and changes no setting in them. See Compatibility.

My live site's renewals stopped. Can it tell me?¶

Yes. WooCommerce Subscriptions stops automatic renewals when it thinks a site is a staging site, usually after a change of address. On a site the plugin knows is live, it says so on the Plugins screen.

Settings → Reading on my staging site says search engines are discouraged. Did it change my setting?¶

No. On a staging site the setting is read as on without being saved, and saving that screen never stores it, so the live site stays visible to search engines after a push. See Search engines.

Can search engines still find a staging site?¶

They can reach it, but are asked not to list it. To keep a staging site fully private, put it behind a password at your host. See Search engines.

Can I check it from the command line?¶

Yes, with wp staging-guard status and wp staging-guard test. See WP-CLI.

Does it contact any outside service?¶

No. The plugin makes no requests of its own and sends nothing anywhere. On a staging site it only refuses requests that other plugins make to email services and to the live site.

What does the activity log keep?¶

The time, a partly hidden first recipient, the number of recipients, the start of the subject and the sending plugin for each email; the host name only for a refused request. Never the message or a full address. See The Activity tab.

Why is the live address stored backwards?¶

So that migration tools, which rewrite every copy of the old address in the database, do not change it. See The live site's recorded address.

What is removed when I delete the plugin?¶

Nothing, unless you switch on Delete all data when the plugin is deleted on the Settings tab. See Delete all data.

What should I include when I ask for help?¶

The System information on the About tab, copied with its button. Remove anything private before posting it anywhere public.

How do I report a security issue?¶

Please do not post it in a public forum. Report it privately through the contact form.