DemoNest Sandbox Builder

DemoNest Sandbox Builder creates private, temporary, isolated WordPress Multisite sandbox sites for visitors to test plugins, themes, and WooCommerce stores.

DemoNest Sandbox Builder is not a shared-demo or external SaaS service. It creates a separate, private, temporary sandbox subsite for each visitor inside the site owner’s own WordPress Multisite network.

How it works

1. Demo Product: you prepare a demo-safe template site and create a Demo Product from it. It can have a primary plugin or theme, required dependencies, supporting plugins, safe demo-data profiles and an optional Demo Launch Guide (a short start page for the tester).
2. Shortcode: put [demonest_sandbox_builder demo_product="your-slug"] on a page.
3. Visitor request: the visitor picks 10 or 20 minutes. Instant Demo Access needs no email and opens in the same browser. Email Verified Access, if you choose it for a product, sends a verification link and then a one-time access link.
4. Isolated sandbox: each visitor gets a separate sandbox with a restricted temporary demo user. Dependencies are activated first, then the primary item.
5. Expiry and cleanup: when time is up, access is revoked, then the sandbox site and its data are removed. This is automatic.

What a Demo Product can include

• A primary plugin or theme, required dependencies (found automatically from “Requires Plugins” headers and checked before you save), supporting plugins and safe demo-data profiles. Nothing is downloaded; testers can never install, update or activate plugins or themes.
• A Demo Launch Guide: a title, a short introduction and one to four buttons that open places inside the tester’s own sandbox, never another website. Presets fill the form and detect the primary plugin’s settings page when it is clear.

Demo data

• WooCommerce Store Ready creates fictional demo data only (products, reviews and a few orders from clearly fake customers). It never copies customers, orders, payment data, licences or private content from any site.
• Seed-data protection keeps the preloaded demo products, orders and pages while testers can still create, edit and delete their own test data.

Self-hosted

Everything runs on your own network. No DemoNest Sandbox Builder account, API key or external demo service is needed, and the plugin contains no telemetry, analytics, advertising or tracking.

Privacy

The plugin uses no analytics, telemetry, advertising or tracking, and no visitor data is sent to any DemoNest Sandbox Builder-controlled server or to any other party. Its only third-party service is the optional, opt-in licensing service connection described under “Third-party service: Freemius” below. The few other requests the plugin makes are ones you control:

• Email: with Email Verified Access, a verification email and a ready email go through your site’s own wp_mail(). Instant Demo Access sends no email.
• Email Delivery Check: DNS lookups of the From domain and a test email to the administrator happen only after a Network Administrator presses the button.
• Loopback: while a store is prepared, an authenticated request goes only to a site of your own WordPress network.

A visitor’s email address is held in a short-lived temporary record for up to 30 minutes before confirmation and at most 2 hours afterwards, then removed. The plugin’s tables keep only a keyed one-way hash of it. The demo user gets a placeholder address on the reserved .invalid domain. Verification links last 30 minutes, access links 60 minutes and handoff tokens 2 minutes, are single use and are stored only as hashes. Instant Demo Access sets one HttpOnly cookie (ewdb_instant, about one hour). Logs hold identifiers and codes, never email addresses or tokens.

The optional attribution line is voluntary and off by default. A Network Administrator can turn it on; it is plain text, loads nothing and appears only on screens the plugin creates. The plugin does not register a WordPress personal-data exporter or eraser, because it keeps no raw visitor email beyond the short-lived records above. A suggested privacy text is added under Settings > Privacy > Policy Guide.

Third-party service: Freemius

The plugin bundles the official Freemius SDK (https://freemius.com) for an optional licensing service connection. It appears only to Network Administrators in Network Admin; visitors and sandbox users never see it. Nothing is sent to Freemius until a Network Administrator chooses to opt in. If you opt in, Freemius receives basic details (such as the network address, administrator name and email, and plugin, WordPress and PHP versions), as described in its privacy policy (https://freemius.com/privacy/) and terms (https://freemius.com/terms/). No visitor email, sandbox address or sandbox activity is sent. Sandboxes and cleanup work the same either way.

Requirements

• WordPress Multisite, network-activated. On a single site the plugin stays inactive.
• A demo-safe template site with demo content only, never real customers or orders.
• Wildcard DNS and a wildcard TLS certificate for a subdomain network. A shared cookie domain is not needed: the plugin does not require a shared cookie domain.
• Working email for Email Verified Access.
• WP-Cron, or a real server cron job calling wp-cron.php, for expiry and cleanup.

Uninstall

Deleting the plugin removes nothing by default. If you turn on “Delete DemoNest Sandbox Builder data on uninstall” in the network settings, deleting it removes only the plugin’s own tables, options and scheduled events. It never deletes sandbox sites, users or template sites.