Title: 360 Orbit Staging Guard
Author: Jörg Liwa
Published: October 31, 2026
Last modified: October 31, 2026
---
Search plugins
# 360 Orbit Staging Guard
By [Jörg Liwa](https://profiles.wordpress.org/joergliwa/)
[Download](https://downloads.wordpress.org/plugin/360-orbit-staging-guard.1.1.1.zip)
* [Details](https://wordpress.org/plugins/360-orbit-staging-guard/#description)
* [Reviews](https://wordpress.org/plugins/360-orbit-staging-guard/#reviews)
* [Installation](https://wordpress.org/plugins/360-orbit-staging-guard/#installation)
* [Development](https://wordpress.org/plugins/360-orbit-staging-guard/#developers)
[Support](https://wordpress.org/support/plugin/360-orbit-staging-guard/)
## Description
A copy of a live website contains real customers, real orders and real service credentials.
One cron run can send reminder emails to customers, renew subscriptions or call
a payment service, silently and without warning. Staging Guard stops that on the
copy.
* **Outgoing calls are blocked.** Every call that goes through the WordPress HTTP
API is refused immediately, except your own address, hosts on your allow list
and, by default, WordPress.org (so updates and plugin installation keep working).
The log shows which hosts were called and lets you allow one with a click.
* **Emails are caught, not sent.** By default nothing leaves the site: each email
lands in the _Mail catcher_ tab with its recipients, headers and a safe preview.
Alternatively redirect everything to one address, discard it, or let it through.
* **Scheduled tasks are paused.** Due WP-Cron events are kept and run once you
switch the protection off.
* **Search engines stay away.** `noindex`, an `X-Robots-Tag` header and a `robots.
txt` that disallows everything. Your _Discourage search engines_ setting is never
changed.
* **Visitors can be locked out (optional).** Switch it on and everybody except
administrators sees a short notice (HTTP 403, noindex) instead of the copy. Let
in single IP addresses or ranges (IPv4 and IPv6), or share a secret access link
that sets a 7-day cookie, for example for a client who reviews the copy. The
page cache is kept out, REST requests and feeds are locked as well. It is off
by default.
* **You always know where you are.** A red marker in the admin bar shows on every
page that the protection is on, and the Status tab says why.
* **A different address only shows a notice.** If a copy still has the live settings
but runs under another address, the plugin tells you and offers to switch the
protection on. It never switches it on by itself, so a domain move of your live
site can never silently block its emails.
* **Emergency switch.** `define( 'WP360_SG_DISABLE', true );` in `wp-config.php`
switches everything off at once.
* **WP-CLI:** `wp 360-staging status|on|off|auto|hosts|allow |mails`.
#### What this protects, and what it does not
Staging Guard is a safeguard against accidents, not an isolation.
* It stops what goes through the WordPress HTTP API and `wp_mail()`. Code that
calls curl, `file_get_contents()` or its own library directly (many payment and
cloud SDKs) is not caught.
* Plugins that talk to a mail service or SMTP directly, or replace `wp_mail()`,
bypass the email protection.
* The visitor lock covers pages, feeds, sitemaps and the REST API. The login page,
the dashboard, scheduled tasks and AJAX requests stay reachable, so nobody gets
locked out. Behind a proxy or CDN the IP list sees the proxy, use the access
link there.
* For real isolation, block outgoing traffic in the firewall or remove the service
credentials from the copy.
#### Privacy
Caught emails can contain real customer data. They are stored in your database only,
are visible only to administrators (on a multisite network only to super admins),
are limited in number and age (50 emails, 7 days by default), never include attachments(
only their names) and are removed when you delete the plugin. The log stores host
names and counters only, never paths, parameters or content. The plugin itself makes
no requests to other servers.
#### Free vs. Pro
The free version covers everything above.
**Staging Guard Pro** adds:
* **Service presets** for common payment, newsletter, CRM, shipping, backup and
AI services, each set to allow or block.
* **Single scheduled tasks** can keep running while the rest stays paused.
* **Rules per path and method** for allowed hosts (for example only `GET` on `/
v1/read`).
* **Longer log and mail catcher** (up to 500 entries), search, CSV export of the
log, `.eml` export of an email and _send as a test_ to one address.
* **Export and import** of the settings for agencies that set up several websites
the same way.
* Automatic update notifications directly in the WordPress admin area.
## Screenshots
[⌊The status page: protection, environment and what is being caught.⌉⌊The status
page: protection, environment and what is being caught.⌉[
The status page: protection, environment and what is being caught.
[⌊The settings: mode, emails, allowed hosts and scheduled tasks.⌉⌊The settings:
mode, emails, allowed hosts and scheduled tasks.⌉[
The settings: mode, emails, allowed hosts and scheduled tasks.
[⌊The mail catcher with a safe preview.⌉⌊The mail catcher with a safe preview.⌉[
The mail catcher with a safe preview.
## Installation
1. Install the plugin under _Plugins Add New_ (search for “360 Orbit Staging Guard”),
or upload the ZIP under _Plugins Add New Upload Plugin_.
2. Activate the plugin on the staging or development copy. The live address is remembered
when you activate it.
3. Open **Staging Guard** in the **360 WP Orbit** menu and check the status.
4. Tip: set `WP_ENVIRONMENT_TYPE` to `staging` in the `wp-config.php` of the copy (`
define( 'WP_ENVIRONMENT_TYPE', 'staging' );`). WordPress assumes `production` when
nothing is set.
## FAQ
### When is the protection on?
In _Automatic_ mode (the default) the protection is on as long as the environment
type is not `production`. You can also set it to _Always on_ or _Off_. If the environment
type says production but the address differs from the live address, a notice offers
to switch the protection on.
### The notice says “This site runs under a different address”. What now?
Either click _Switch protection on now_ if this is a copy, or _This is the live
site_ if the live site moved to a new address. The second remembers the new address
as the live address.
### I switched the protection on by mistake on my live site.
Click _This is the live site_ on the Status tab, set the mode to _Off_, or add `
define( 'WP360_SG_DISABLE', true );` to `wp-config.php`.
### Where do I see the emails that were caught?
On the _Mail catcher_ tab of the Staging Guard page. HTML emails are shown in a
sandboxed preview that loads nothing from the internet and runs no scripts.
### Why is WordPress.org allowed?
So that updates and installing plugins keep working on the copy. Blocked calls to
WordPress.org also cause warnings when WP_DEBUG is on. You can switch it off in
the settings.
### An outgoing call still gets through.
Only calls that use the WordPress HTTP API are caught, and redirects are checked
as well. Libraries that open connections themselves are not caught. Block them in
the firewall, or remove the credentials of that service from the copy.
### Does it work on multisite?
The plugin works per site. Activate it on each site where you want to use it. Caught
emails can contain password reset links, so on a multisite network only super admins
can see them.
### What happens when I deactivate or delete the plugin?
Deactivating switches everything off and keeps your settings and caught emails until
you delete them on the Mail catcher tab. Deleting the plugin removes its settings,
its log and all caught emails.
### Liability?
This plugin is provided without any warranty (“as is”). The developer assumes no
liability for damage or loss arising from its use. It reduces the risk of accidents
on a copy, it does not isolate it.
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“360 Orbit Staging Guard” is open source software. The following people have contributed
to this plugin.
Contributors
* [ Jörg Liwa ](https://profiles.wordpress.org/joergliwa/)
[Translate “360 Orbit Staging Guard” into your language.](https://translate.wordpress.org/projects/wp-plugins/360-orbit-staging-guard)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/360-orbit-staging-guard/),
check out the [SVN repository](https://plugins.svn.wordpress.org/360-orbit-staging-guard/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/360-orbit-staging-guard/)
by [RSS](https://plugins.trac.wordpress.org/log/360-orbit-staging-guard/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 1.1.1
* Admin bar colors are now added through the WordPress style API.
## Meta
* Version **1.1.1**
* Last updated **17 hours ago**
* Active installations **Fewer than 10**
* WordPress version ** 6.4 or higher **
* Tested up to **7.1.4**
* PHP version ** 8.1 or higher **
* Tags
* [development](https://wordpress.org/plugins/tags/development/)[email](https://wordpress.org/plugins/tags/email/)
[noindex](https://wordpress.org/plugins/tags/noindex/)[staging](https://wordpress.org/plugins/tags/staging/)
[wp cron](https://wordpress.org/plugins/tags/wp-cron/)
* [Advanced View](https://wordpress.org/plugins/360-orbit-staging-guard/advanced/)
## Ratings
No reviews have been submitted yet.
[Your review](https://wordpress.org/support/plugin/360-orbit-staging-guard/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/360-orbit-staging-guard/reviews/)
## Contributors
* [ Jörg Liwa ](https://profiles.wordpress.org/joergliwa/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/360-orbit-staging-guard/)