I get asked to test a checkout change on staging, and everyone assumes it’s safe because it isn’t the live shop. Then I open the payment settings and the Stripe keys are the live ones. PayPal is still in live mode. A test order on that copy wouldn’t be a test. It would take real money.
This isn’t rare, and it isn’t usually carelessness. A staging site is a copy. It copies the products, the orders, the customer emails and the gateway settings. The “safe” copy arrives with everything the live shop had, including the keys that talk to the real payment account.
Black Friday is 27 November, sixteen days away. A lot of shops will be testing sale prices, banners and checkout tweaks on staging this month.
A copy isn’t automatically safe
When you clone a WooCommerce shop, you usually get:
- Live Stripe or PayPal keys, with test mode switched off
- The same email settings, still able to reach real customers
- Webhook URLs and secrets from the live payment account
- Scheduled actions, including subscription renewals if the shop uses them
- A database full of real customer addresses and order history
None of that turns itself off just because the URL has “staging” in it.
I’ve written before about the staging site that nobody ever uses. This is the other side of that habit: using the copy, but treating “it’s only staging” as a guarantee. It isn’t.
Here’s what can actually happen if you place a test order too soon:
- You, or someone helping you, pay with a real card and the money is taken
- A customer whose details were copied from live gets an order email for a test you just placed
- A payment webhook fires against the wrong site, or a live event lands somewhere it shouldn’t
- If the shop has subscriptions, a cloned scheduled renewal can try to charge a real customer again, unless Subscriptions has actually switched into its own staging mode
That last point needs care. WooCommerce Subscriptions remembers the URL where it was first activated and treats a different URL as staging. In that mode it won’t take automatic payments or send subscription emails, though it will still trigger the scheduled events themselves. If it was first activated on the staging site, it can think that copy is the live shop. A hostname that contains “staging” is not proof.
A line in wp-config.php that sets WP_ENVIRONMENT_TYPE to staging is useful. It tells WordPress, and any plugin that looks, that this isn’t production. It does not, by itself, switch Stripe to test keys, stop emails or pause scheduled actions. I still do the checks myself.
The check I run before any test order
I don’t add a product to the cart until I’ve walked this list. It takes a few minutes.
- Test mode is on, and the keys match. In the Stripe or PayPal settings I want test or sandbox mode switched on, and I want to see test credentials in the fields, not the live ones. If test mode is on but a live secret key is still sitting in the live-key field, I don’t assume that’s harmless. I want the live keys out of the copy, or at least clearly not in use.
- Webhooks are pointed at this copy, for test events only. Payment gateways talk back to the shop when a payment succeeds or fails. If the staging copy still has the live webhook setup, or if a plugin has registered this URL against the live account, events can land in the wrong place. I want test-mode webhooks pointing at the staging URL, and I don’t want this copy attached to the live endpoint. If I’m not sure, I don’t place the order yet.
- Order and customer emails can’t leave the building. The staging database often contains real customer accounts. A test order can email them as if they’d just bought something. I disable or reroute outgoing mail — a plugin that stops emails on staging, an SMTP plugin set to log only, or a host tool that holds mail. Then I check that WooCommerce order emails, account emails and any marketing plugins are covered, not only the default WordPress mail. Subscription emails may already be off if Subscriptions is in staging mode, but other plugins can still send.
- Scheduled actions and renewals are under control. I look at WooCommerce → Status → Scheduled Actions. If subscriptions or other timed jobs were copied from live, I want to know they won’t charge anyone or email anyone. If the shop uses WooCommerce Subscriptions, I check WooCommerce → Status for Subscriptions Mode and the recorded live URL. If it says Live on a staging hostname, I stop. If it says Staging, I still don’t enable automatic payments on that copy just to make a test easier. For a thorough freeze, a small plugin can disable Action Scheduler’s default runner so those events don’t fire while I work.
- The environment is labelled, and I know what that does and doesn’t do. In wp-config.php I like to see
define( 'WP_ENVIRONMENT_TYPE', 'staging' );if the host hasn’t already set it. That label helps. It is not the whole job.
Only then do I place a test order, with a test card, and I watch where the money, the email and the order land.
What I do with the test order itself
I use a test payment method and a test customer, not a real card and not a real customer’s account copied from live. I complete checkout, then I check:
- The payment shows in the gateway’s test or sandbox dashboard, not the live one
- The order appears on staging, not on the live shop
- No email arrived in a real customer’s inbox
- No webhook updated the live orders list
If any of those is wrong, I stop and fix the copy before I do more testing.
This sits next to the other careful payment habits. I don’t update payment gateway plugins on a Friday, and I test those updates on staging with gateways in test mode and emails blocked. Same idea: don’t let a “safe” environment quietly talk to the real till.
Why this matters in the next two weeks
Shops will be testing sale coupons, checkout messages, banner changes and last-minute plugin tweaks over the next sixteen days. Staging is the right place for that work. It only stays the right place if it can’t take real money and can’t email real customers.
The check is the same in March. November is just when more people are rushing.
Wrap Up
A staging copy of a WooCommerce shop is not safe just because it isn’t live. If it still has live payment keys, it can take real money, send real emails and talk to the live payment account. Before any test order I check test mode and test keys, webhooks, emails and scheduled actions. Then I place the test, and I confirm it stayed on the copy.
If you’re about to test a Black Friday change and want a second pair of eyes on the staging setup, book a quick call and we’ll go through the list together.
Written by Connie, an AI, from Neil Matthews’ notes, archive, and direction. Neil directed and edited this piece. He did not write these words. Augmented publishing by Neil Matthews.