Description

Updating a plugin on a live WordPress site is a leap of faith. Preflight Update Sandbox removes the guesswork.

When a plugin update is available, Preflight Update Sandbox boots a throwaway WordPress sandbox in your browser using WordPress Playground, reproduces your active plugins, and runs the update there first. It performs an A/B test:

Before — your active plugins at their current versions.
After — the same set, but with the target plugin updated.

If the “before” sandbox is healthy and the “after” sandbox is healthy, the update is marked Safe and you can apply it with one click. If “after” breaks while “before” worked, the update is flagged Unsafe and held back.

No staging server. No paid infrastructure. The sandbox runs in the browser and is discarded when you are done.

Why it is different

Rollback plugins only help after something breaks. Staging tools are heavy, manual, and often cost money. Preflight Update Sandbox tests before you commit, using free, disposable browser-based sandboxes — a capability only recently made possible by WordPress Playground.

What this early version does

Detects pending plugin updates.
Boots matched sandboxes (WordPress + PHP versions matched to your site).
Runs automated health checks (front page and login screen load, no fatal/critical errors).
Gives a Safe / Unsafe / Inconclusive verdict with details.
Live sandbox preview: boots the updated site in a visible, interactive sandbox right in the admin, with a Before/After toggle and an “Open in new tab” link, so you can click around and see the update working before applying it.
Applies a passed update with one click, securely.

On the roadmap

Theme and WordPress core update testing.
Importing your real content (WXR) into the sandbox for deeper checks.
Visual-regression screenshots (before vs. after).
Premium-plugin support via uploaded zips.
Scheduled background testing with email/Slack alerts.

External services

This plugin relies on external services to test updates. Nothing is sent to any third party except as described below, and testing only happens when you click a Test, Preview, or Clone button.

WordPress.org Plugin Directory & Downloads (api.wordpress.org, downloads.wordpress.org)
- What: The plugin queries the directory to resolve the correct download URLs and versions for the plugin being tested and for your active repository plugins, then those plugin ZIP files are downloaded into the in-browser sandbox.
- Data sent: plugin slugs and version numbers. No personal data is sent.
- Terms: https://wordpress.org/about/privacy/ — Privacy: https://wordpress.org/about/privacy/
WordPress Playground (playground.wordpress.net)
- What: The plugin loads the WordPress Playground runtime (a WebAssembly build of WordPress) from this service so a disposable WordPress sandbox can run inside your browser. The sandbox itself executes locally in your browser.
- Data sent: standard requests to download the Playground runtime and assets. When you use the staging-clone feature, a snapshot of your site (plugin/theme files, settings and content) is loaded into the sandbox running in your browser; this snapshot is not uploaded to Playground’s servers.
- Terms & Privacy: https://wordpress.org/about/privacy/ and https://developer.wordpress.org/playground/

If you do not want the plugin to contact these services, do not run a Test, Preview, or Clone.

Screenshots

Test results — each pending update gets a Safe / Unsafe verdict from a disposable sandbox, with per-check detail.

Staging clone — your real plugins, settings and content reproduced in an in-browser sandbox with the update applied. — Test results — each pending update gets a Safe / Unsafe verdict from a disposable sandbox, with per-check detail.

Installation

Upload the preflight-update-sandbox folder to /wp-content/plugins/, or install the zip via Plugins Add New Upload Plugin.
Activate Preflight Update Sandbox through the Plugins screen.
Open Preflight Update Sandbox in the admin menu.
Click Test in sandbox on any pending update.

Requires a browser with network access to playground.wordpress.net.

FAQ

Does this touch my live site during a test?: No. The test runs entirely in a disposable Playground sandbox in your browser. Your site is only changed if you click Apply update after a Safe verdict.
Why can’t it test my premium plugin?: The sandbox fetches plugin versions from the public WordPress.org directory. Premium plugins are not there, so they are flagged and skipped for now. Uploaded-zip support is on the roadmap.
What does “Inconclusive” mean?: The sandbox could not reproduce a healthy baseline (usually because a custom/premium plugin could not be installed), so no reliable verdict could be given.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“Preflight Update Sandbox” is open source software. The following people have contributed to this plugin.

Maryam Sultana

Translate “Preflight Update Sandbox” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

0.3.7

Replaced the separate “Quick test” button with a “Test this plugin only (faster)” checkbox that applies to both Test and Preview. Tick it for a fast check of just the plugin being updated; untick it to reproduce all your active repository plugins. One control, both actions.

0.3.6

New: “Quick test (this plugin only)” button — boots the sandbox with just the plugin being updated, for a faster check that also avoids unrelated plugins that can’t run in the sandbox.

0.3.5

Robustness: only the plugin under test is activated in the sandbox; other active plugins are installed but left inactive, so one plugin whose activation isn’t compatible with Playground’s SQLite engine can no longer abort the whole test.
Clearer result when a plugin can’t run in the browser sandbox (MySQL/SQLite incompatibility) instead of a raw error.

0.3.4

Fixed: admin action buttons (Test / Preview / Clone) did nothing because the localized data object name did not match after the rename. Corrected.

0.3.3

Renamed the plugin to “Preflight Update Sandbox” for a distinctive, non-generic identity.
Switched all file writes to the WP_Filesystem API (WXR export and protection files) instead of direct file_put_contents.

0.3.2

Compliance: renamed helper classes to use the full plugin prefix (Preflight_Sandbox_Scanner, Preflight_Sandbox_Blueprint, Preflight_Sandbox_Snapshot, Preflight_Sandbox_Admin, Preflight_Sandbox_Rest) to satisfy Plugin Check’s PrefixAllGlobals rule.

0.3.1

Compliance: resolved all Plugin Check findings — replaced direct filesystem calls in uninstall with the WP_Filesystem API, switched the module script to the wp_script_attributes filter (properly enqueued), removed the discouraged load_plugin_textdomain call, prefixed global-scope variables, and updated “Tested up to”.

0.3.0

New: Staging clone. “Clone my site & test” reproduces your real site inside the sandbox — your actual plugin and theme files (including premium/custom), your settings (wp_options), and your content (WXR) — then applies the update, so you test against a real copy of your site instead of a generic install. Runs entirely in your browser; the snapshot is never uploaded to a third-party server.

0.2.1

Fixed: “failed to create blueprint” / boot failures for plugins whose exact version zip isn’t archived at downloads.wordpress.org (e.g. File Manager). Download URLs are now resolved from the WordPress.org versions API (with the latest download link as a fallback) instead of being guessed, so blueprints use real, verified zips.

0.2.0

New: Live sandbox preview. A “Preview updated site” button boots the updated site in a visible, interactive WordPress Playground sandbox inside the admin, with a Before/After toggle and an “Open in new tab” link. See the update working, don’t just read a verdict.

0.1.3

Fixed: baseline boot failed (“Failed to fetch”) when an active plugin — including Preflight Update Sandbox itself or any premium/custom plugin — was not in the WordPress.org directory. The sandbox now reproduces only confirmed directory plugins and records the rest as skipped.

0.1.2

Fixed: “Invalid Blueprint” error. Removed the unsupported ifAlreadyInstalled option from installPlugin steps to conform to the current Playground blueprint schema.

0.1.1

Fixed: repo plugins were wrongly flagged as premium (and the Test button disabled) when the update payload had no direct wordpress.org package URL. Directory membership is now verified against the WordPress.org API and cached.

0.1.0

Initial release: plugin update A/B testing in WordPress Playground with health checks and one-click apply.