Directory / plugin
Staging Superpowers
v1.3.1 · by Rodolfo Melogli
Make a staging copy of your site safe to test on: blocks emails and outside services, freezes scheduled tasks, keeps search engines and AI bots out.
About this plugin
Live stays safe. Every time.
Your staging copy has your real customers, your real payment keys and your real automations. One test can email thousands of people or charge a real card. Staging Superpowers stops all of it, the moment you activate it.
What it blocks
- Emails: every email to real people is blocked, even through SMTP plugins. Or forward them all to yourself.
- Outside services: Stripe, PayPal, Mailchimp, Klaviyo, Zapier, CRMs and 50+ more can’t be reached.
- Automations: WP-Cron and scheduled actions are frozen, so nothing runs twice.
- Search engines and AI bots: noindex, robots.txt, no sitemaps, and known crawlers refused.
- Analytics: test visits stay out of Google Analytics and Meta reports.
- Page caching: off, so you always see your latest change.
What it adds
- Staging look: a red STAGING badge and a status bar showing every protection.
- Changelog: every change you make on staging, so you know what to redo on live.
- Troubleshooting: switch plugins off and on in bulk. A fatal error is undone automatically.
- Visitors: only logged-in users see the copy by default; everyone else gets a “We’ll be right back” message. Or let everyone in.
- Emails log: every email it stopped or forwarded, with recipient, subject and sender plugin. Never the message body.
- Requests log: every outgoing request it blocked, with the plugin that tried.
On WooCommerce stores
- Payment methods are swapped for a Staging Test Gateway, so no real card is charged.
- Subscriptions copied from live are locked and never charged automatically, so live renewals keep working.
- Webhooks are paused.
Safe to keep on your live site
It only switches itself on where the address looks like staging (staging., dev., .local, WP Engine, Kinsta, Cloudways and more) or WP_ENVIRONMENT_TYPE is staging, development or local. On your live site it stays off. Every clone of your site already has it, and protects itself straight away. Push staging back to live and it switches itself off again.
Nothing in your database is changed by the protections. Deactivate it and the site behaves as before.
Staging Superpowers Pro
Staging Superpowers Pro adds tools for working on the copy: anonymize customers and staff before handing the site to an agency, send visitors to your live site, compare pages with live side by side, find staging links on live, see and block every outgoing request, and WooCommerce test data and switches.
Works with
- Payments: WooPayments, Mollie, FluentCart, Easy Digital Downloads, GiveWP, Paid Memberships Pro, Restrict Content Pro, WooCommerce Subscriptions. Stripe’s and Square’s own “don’t detach saved cards” protection turns on by itself on staging.
- Email: MailPoet, FluentCRM, WP Mail SMTP, FluentSMTP, Post SMTP.
- Marketing and analytics: Facebook for WooCommerce, Google for WooCommerce, Pinterest for WooCommerce, Klaviyo, Square, Site Kit by Google, MonsterInsights, GTM4WP, Meta pixel.
- Memberships and more: Jetpack, WP Fusion, Uncanny Automator, UpdraftPlus.
External services
This plugin does not connect to any external service and does not send data anywhere.
The web addresses listed in its settings are services the plugin blocks. The default list is: api.stripe.com, api.paypal.com, api-m.paypal.com, api.braintreegateway.com, connect.squareup.com, api.mollie.com, api.authorize.net, api.mailchimp.com, a.klaviyo.com, api.brevo.com, api.sendinblue.com, connect.mailerlite.com, api.omnisend.com, api.kit.com, api.convertkit.com, api.hubapi.com, ssapi.shipstation.com, api.taxjar.com, rest.avatax.com, graph.facebook.com, google-analytics.com, api.twilio.com, slack.com, hooks.zapier.com, make.com, integromat.com, api-us1.com, api.createsend.com, api.getdrip.com, api.sendgrid.com, mailgun.net, api.postmarkapp.com, sheets.googleapis.com, api.sparkpost.com, mandrillapp.com, bridge.mailpoet.com, api.mailjet.com, api.resend.com, api.mailersend.com, api.smtp2go.com, api.elasticemail.com, api.twitter.com, api.linkedin.com, developer.blog2social.com, blog2social-wordpress-api.adenion.de, onesignal.com, api.pushengage.com, rpc.pingomatic.com, api.cloudflare.com, api.automatorplugin.com, api.indexnow.org, business-api.tiktok.com, api.pinterest.com, api.shortpixel.com and smushpro.wpmudev.com. When “Connected services” is on, the plugin stops the staging site from contacting them, so a staging copy cannot reach your live accounts. The plugin never sends requests to them itself.