Protection and access Who gets into the staging environment?
Only whoever you let in. A password page stands in front of everything else, chosen IP addresses get through without a password, and the agency gets a user of its own only in the copy. Search engines stay out.
First the password, then the shop.
With "Protect the staging environment with a password" everybody first sees the plugin's password page, before Shopware shows anything. What you save in the tab "Protection" applies at once in a built staging environment.
Protected is: storefront and administration, the storefront only or the administration only.
A login lasts 30 days, adjustable in the plugin settings under "Login lasts (days)", for every staging environment; a direct link from the credentials lasts as long.
IP addresses and ranges under "Reachable without password from" in the plugin settings get in without a password, the office or a monitoring service for instance; a change applies at once in every staging environment.
No shared cache keeps pages of a protected staging environment, neither Shopware's HTTP cache nor a reverse proxy in front.
Pass on, replace, valid at once.
You enter the password yourself in the assistant, otherwise the plugin creates it during the first build.
Address and password of the password page, a direct link that opens without the password, the address of the administration and user and password of the default user, to copy and pass on.
Replaces the password of the password page or of the default user, at least eight characters. Whoever was logged in has to enter the new one; old direct links open nothing any more.
Opens storefront or administration in a new window, past the password page.
A login of its own for the agency.
With every build the plugin creates an administrator of its own, only in the staging environment. Its name follows that of the staging environment, in lower case and without spaces, or you give one of your own; a new name renames it on saving, its password stays.
If the password page also protects the administration, its login page shows the button "As <user name>" for everybody who entered the page password. The user's password does not leave the server.
The admin users of the live shop come with the database. In the tab "Setup" you switch each one active or inactive, only in the copy; "Disable all" lets only the default user in.
While "Remove the admin users' access keys" is on (default), setup deletes the admin users' API keys, login tokens and open sales channel sessions in the copy. With the shipped rule set customers have no password; you get into their account through "Log in as customer" in the copy's administration.
What visitors see when the copy is not ready.
For a Shopware update in the staging environment: Shopware's updater switches off all plugins, the password page too. In maintenance mode only the IP addresses under "Allowed IP addresses" see the storefront, even without this plugin; a button enters your own IP address with one click. The administration stays reachable.
Shown instead of the storefront while a build, a refresh or a teardown runs. The page reloads every 15 seconds and shows the staging environment as soon as it is ready.
After a run that did not complete, until a new run in the live shop completes successfully.
After a limited lifetime ends. Storefront, administration and API are locked, the data stays.
The plugin gives every response of the copy "noindex, nofollow". On top, robots.txt keeps search engines out; Shopware's staging mode takes care of that, and the plugin switches it on during setup.
What shop owners ask about it.
Do search engines see the staging environment?
No. Every page of the copy carries "noindex, nofollow", and robots.txt keeps search engines out. Images, CSS and JS are delivered by the web server itself; to close them as well, add the header X-Robots-Tag in the vhost, below the live shop only for the path of the staging environment.
Can my agency get in without my admin password?
Yes. "Create a default user in the staging environment" sets up an administrator only in the copy; the live shop never has it. "Show credentials" gives address, page password, a direct link and the default user to pass on. With the password page also in front of the administration, the button "As <user name>" logs the agency in after the page password.
What if the password got around?
"Set new password" replaces it at once. Whoever was logged in has to enter the new password, and direct links sent before no longer open the staging environment.
Do apps and headless frontends still reach the copy?
Yes. The password page protects storefront, administration or both; the interfaces (API and Store API) and robots.txt stay open, so apps, headless frontends and the plugin in the copy keep working.
More about the plugin
-
Setting up
The assistant in seven steps, the preflight and the first build.
-
What gets copied
Which files and tables come along, what stays empty and how rebuilding, refreshing and tearing down work.
-
Anonymization
The rule set, the replacements per column, the preview and the record of every build.
-
Emails and calls
Four ways for emails, three for calls from apps and webhooks, plus scheduled tasks and analytics.
-
Services and plugins
Search, Redis, queue, reverse proxy and plugins: what the copy shares with the live shop.
-
Differences to the live shop
The comparison shows extensions, settings, content, files and database structure, each with its side.
-
Schedule and automation
Schedule, lifetime with reminder, Flow Builder and console commands.
-
Hosting and server
What gets written on the server, Apache, nginx, an address of its own, database privileges and SFTP.
-
Comparison with the standard
What Shopware does itself with system:setup:staging and what the plugin adds.
-
Pricing
What a staging environment costs, monthly or yearly, and what each plan includes.