How it knows a site is a staging site¶

Gorilla Staging Guard decides on every request whether the site is a staging site. It never blocks a site on a guess: when it is not sure, it asks, and the site keeps sending email and taking payments until someone answers.

The order it decides in¶

The first rule that applies decides:

Switched off in wp-config.php (GORILLA_STAGING_GUARD_DISABLE): nothing is protected.
Code on the site decides, through the gorilla_staging_guard_is_copy filter (For developers).
wp-config.php or the hosting says what the site is: GORILLA_STAGING_GUARD_MODE, then WP_ENVIRONMENT_TYPE, then a hosting signal. Production always wins when it is said.
Someone marked this address as a staging site on the plugin's screen.
The site's address compared with the live site's recorded address.
No live address recorded yet: an address that looks like a staging site is only a suggestion.

WP_ENVIRONMENT_TYPE and the hosting¶

WP_ENVIRONMENT_TYPE is WordPress's own setting, in wp-config.php or set by the server. staging, development and local mean a staging site; production, or any value WordPress does not know, means the live site.

Some hosts say it without a setting: Pantheon (its dev, test and multidev environments), WordPress VIP and WP Engine's legacy staging are recognised. Many other hosts set WP_ENVIRONMENT_TYPE on their staging sites for you.

GORILLA_STAGING_GUARD_MODE says the same for this plugin only, and takes precedence: see Settings.

The live site's recorded address¶

The live site records its own address the first time an administrator opens the dashboard there, but only when it is sure: the address is the domain itself or www., with nothing in it that looks like a staging site, or wp-config.php or the hosting says production. Every other first address is asked about, because a plugin is often tried on a staging site first, and that site must not claim to be the live one.

The record travels with every copy of the database. A staging site compares its own address with it.

The address is stored backwards with a short prefix (for example gsg1:moc.elpmaxe), because migration tools rewrite every copy of the old address in the database and the staging site would otherwise forget where it came from. It is not meant to hide anything.

Addresses that mean a staging site¶

Compared with the live site example.com, these are staging sites:

A subdomain of the live site: staging.example.com, shop.example.com.
A folder of the live site named like a staging site: example.com/staging, example.com/dev.
Any address whose first part says so: staging-example.host.com, dev.example.net, example-test.host.com.
A local address: localhost, or a name ending in .local, .test or .localhost.

Words that mark a staging site include staging, stage, stg, preprod, preview, demo, beta, test, qa, uat, dev, development, local, sandbox, backup, clone, copy, mirror and old. A word counts as a whole part of the name, optionally numbered: staging-2 and dev1 count, devil and latest do not. The full list is in For developers.

The domain itself and www. are never a staging site by their address alone. A live site that moved to a new domain keeps working until someone answers.

A folder staging site¶

A staging site in a folder of the live site's own domain (example.com/staging) is recognised when the folder is named like a staging site. A folder with any other name is asked about.

The question¶

When the plugin cannot tell, it asks once on the Plugins screen and on the Status tab:

This is the live site: the address is recorded as the live one.
This is a staging site: this address is marked as a staging site; email stops, payments go to test mode and scheduled tasks pause.
Not now: the question goes away for you, at this address; nothing changes.

Until you answer, the site sends email and takes payments as usual.

A site moved to a new domain¶

A move to a new domain is asked about once. The site keeps sending email and taking payments until you answer This is the live site.
A move to a subdomain of the old address (shop.example.com from example.com) or to an address named like a staging site is treated as a staging site straight away. Choose No, this is the live site on the Status tab, or add define( 'GORILLA_STAGING_GUARD_MODE', 'production' ); to wp-config.php before the move.

Pushing a staging site to the live site¶

When a staging site is pushed over the live site, the live site gets the staging site's database. That is safe:

The plugin saves nothing on the staging site to protect it, so no test mode, paused task or search setting travels to the live site.
The staging site's own choices on the Settings tab apply only at the staging site's address, so they do nothing on the live site.
The live site's recorded address travels back with the database, so the live site still knows it is the live site.

If a staging site becomes the live site at the same address (a new server tested before the switch), purge its page cache afterwards, so no page cached while it was a staging site keeps telling search engines to stay away.

Multisite¶

Each site in a network has its own verdict, recorded live address and activity, unless GORILLA_STAGING_GUARD_LIVE_URL is set in wp-config.php, which applies to every site. Sites in a network are not treated as staging sites of each other: on a network, a subdomain alone is not enough.

The reasons on the Status tab¶

The Status tab gives one of these reasons for its verdict.

wp-config.php switches the plugin off¶

"wp-config.php switches the plugin off (GORILLA_STAGING_GUARD_DISABLE), so nothing is protected on this site." Remove the line from wp-config.php to protect the site again.

Code on this site decides¶

"Code on this site says it is a staging site" or "… is not a staging site." A developer's gorilla_staging_guard_is_copy filter decides. Change it in that code.

wp-config.php or the hosting says production¶

"wp-config.php or the hosting says this is the production site." This is the live site; nothing is stopped. Change it in wp-config.php or at your host.

wp-config.php or the hosting says staging¶

"wp-config.php or the hosting says this is a staging, development or local site." Every protection is on. Change it in wp-config.php or at your host.

Someone marked this address¶

"Someone marked this address as a staging site on this screen." Someone answered This is a staging site. Choose No, this is the live site if that was wrong.

This is the recorded live address¶

"This is the address recorded as the live site: example.com." The live site; nothing is stopped.

WordPress runs at another address¶

"WordPress runs at …, set in wp-config.php, while the database belongs to …, the live site." WP_HOME or WP_SITEURL in wp-config.php sets another address than the one stored in the database. Some staging sites are set up like this, and some live sites. Until you answer, the site sends email and takes payments as usual. If it is the live site, make WP_HOME and WP_SITEURL match the address under Settings → General, or remove them. If it is a staging site, add define( 'GORILLA_STAGING_GUARD_MODE', 'staging' ); to wp-config.php.

A subdomain, a folder or a staging name¶

"This site (…) is a subdomain or a folder of the live site …, or its name says it is a staging site." See Addresses that mean a staging site. Choose No, this is the live site if it really is live.

It looks like a site that moved¶

"… is not a subdomain or folder of the recorded live site …, and its name does not say it is a staging site." A site that moved to a new domain looks like this. Answer the question: see A site moved.

A staging name, but no live address yet¶

"The name … looks like a staging site, but no live address is recorded to confirm it." The plugin suggests, but does not decide. Answer the question, or set WP_ENVIRONMENT_TYPE.

No live address recorded yet¶

"No live address is recorded yet." Open the dashboard on the live site once, answer the question, or set WP_ENVIRONMENT_TYPE on each site.

Next step¶

What it stops: each protection on a staging site, and what no plugin can stop.