studio24/staging-site

A set of simple tools to help manage staging websites

v0.1.1 2026-06-26 07:50 UTC

Requires

• php: ^8.1

Requires (Dev)

• phpstan/phpstan: ^2.1
• phpunit/phpunit: >10
• roave/security-advisories: dev-latest
• squizlabs/php_codesniffer: ^4.0

MIT

• symfony
• php
• security
• Authentication
• wordpress
• password
• laravel
• banner
• staging
• basic auth
• craftcms
• stage
• Test Site
• studio24
• staging password
• staging banner
• dev banner

README

A set of simple tools to help manage staging websites, designed for PHP-powered websites.

What does it do?

When creating or updating a website it's a good idea to publish changes to a staging environment to review before going live.

This package adds the following simple tools to a staging site:

• Secure staging websites behind a simple, accessible login page
• Informs search engine spiders to not index a staging website

It has support for WordPress, Craft CMS, Laravel, Symfony and plain PHP integration.

Staging site login

The staging site login page is a replacement for basic authentication, which doesn't play well with password managers and is blocked by some client systems.

• It detects the current environment and if it matches staging, it displays the staging site login page
• The staging site login page asks for a single password to access the site
• Once the correct password is entered, a cookie is set to remember the login for a set time period (7 days by default)

How long are you logged in for?

By default, the login cookie is set to expire after 7 days. If your IP address or user agent changes, then you are also logged out.

Logout

You can pass the GET parameter ?staging_site_logout=1 to any URL on your staging website to log the user out.

Inform search engines not to index a staging site

To effectively stop a staging or development website appearing in search engine results we need to:

• Tell search engines to not list web pages in search results
• But allow search engines to access the web pages so they can read this instruction

We can block staging sites from being indexed via the HTTP header X-Robots-Tag:

X-Robots-Tag: "noindex, nofollow"

This package adds this header to all requests on a staging site.

Requirements

• PHP 8.1+

Installation

See the documentation for instructions on how to install this on your website.

Testing

You can test the staging login via:

php -S localhost:8000 -t tests/website

Access http://localhost:8000 and use the staging password test123

You can run unit tests via:

composer test

Changelog

Please see CHANGELOG for more information on what has changed recently.

Contributing

Find out more about how to contribute and our Code of Conduct.

Security Issues

If you discover a security vulnerability within this package, please follow our disclosure procedure.

About

This package is developed by Studio 24, a human-centered digital agency who build websites and web apps that work for everyone.

License

The MIT License (MIT). Please see License File for more information.