SafeStage: Email, App and Checkout Guards for Staging

by Lunova Solutions

Rating: no rating ( write a review )

Downloads: <10

Test Shopware with clear rules: redirect emails to your QA team, control app requests and block orders using unapproved payment methods. Includes banners and an audit log.

Annually €6.66* /month €94.80 * €79.90* /year 15.72% discount In comparison to the regular monthly price

Monthly €7.90* /month Cancelable monthly

Compatible with:

6.6.0.0 - 6.7.15.1

Includes:

Free trial month

The subscription starts with a free trial month during which it can be canceled at any time.

All updates

During the subscription all released updates are included for free

Support from the Extension Partner

In case you have any questions or problems with your extension you can always ask the Extension Partner for help during the subscription.

Description

Highlights

Redirect customer emails to designated QA recipients during testing
Control Shopware app webhooks and app Flow requests with explicit rules
Allow order placement only with explicitly approved payment methods
Review guard decisions in a searchable audit log within Administration
Make staging visible and apply robots directives to discourage indexing

Features

SafeStage master switch with individually enabled protection modules
Per-sales-channel settings for email, storefront, robots and Payment Guard
Email redirection to one or more valid destination addresses
Recipient allowlist for individual addresses, domains and subdomains
Configurable subject prefix for emails sent in staging mode

Optional CC and BCC removal with additional recipient filtering
Entire email blocked if recipients are unapproved and no redirect is valid
Global Outbound Guard for the Shopware app-system HTTP client
Outbound modes for logging, blocking or redirecting to sandbox targets
Allowed hosts and redirect mappings with optional blocking of missing matches
Optional Payment Guard with a selection of approved payment methods
Custom banner text for Administration and the storefront
Robots meta tag and X-Robots-Tag with noindex, nofollow and noarchive
Optional Disallow: / for robots.txt responses served by Shopware
Audit log with search, filters and details plus CLI status with JSON output

Show more Show less

About the Extension

Test your shop with clear rules for emails, apps and orders

Your staging shop should support realistic testing. Copied recipient details and active integrations can also trigger unwanted actions. SafeStage gives your QA team explicit rules for outgoing communication and order placement. Choose where test emails go, which app targets remain reachable and which payment methods are approved for test orders.

Review test emails with controlled recipients

Email Guard checks messages sent through the Shopware mail service. Unapproved recipients are replaced with your QA destination addresses while approved primary recipients remain. A configurable subject prefix makes test messages easy to recognise. You can remove CC and BCC recipients; if removal is disabled, only approved CC and BCC recipients remain.

If a recipient is not approved and no valid redirect destination is configured, SafeStage blocks the entire message. This also lets you use the guard without forwarding emails. Optional recipient logging masks the local part of addresses in the audit log.

Control Shopware app requests deliberately

The global Outbound Guard covers Shopware app webhooks and app Flow actions that use the Shopware app-system HTTP client. Block unapproved targets, redirect matching requests to a sandbox through a redirect map, or start by logging requests. Allowed hosts remain reachable. In redirect mode, you decide whether requests without a matching mapping are blocked.

Log only allows requests through. Requests without a redirect match also proceed if blocking for missing mappings is disabled. SafeStage does not intercept arbitrary cURL, SDK or custom HTTP clients used by other plugins.

Approve payment methods for test orders

Optional Payment Guard lets you select the payment methods permitted for test orders. An unapproved method produces a cart or checkout warning and blocks order placement. An empty allowlist blocks all payment methods. SafeStage does not switch payment providers into sandbox mode, so approved methods still need suitable test credentials.

Understand guard decisions

The Administration audit log shows email decisions, app requests with an available logging context and order attempts blocked by Payment Guard. Search, category and decision filters, and a detail view support your review. Entries record guard decisions rather than proof of email delivery or successful processing by an external system. App requests need an available Shopware context to create an audit entry.

Keep staging visible

Administration and storefront banners make active staging mode visible, with text you can customise. Optional robots meta and X-Robots-Tag directives set noindex, nofollow, noarchive. You can also apply Disallow: / to robots.txt responses served by Shopware. These directives address cooperating crawlers and do not provide access control.

Configure protection for your test environments

Email Guard, storefront banners, robots directives and Payment Guard support sales-channel settings. The Administration banner and Outbound Guard always use global configuration. The master switch must be active for the relevant scope.

SafeStage is designed for merchants, agencies and development teams running staging, QA, demo or preview shops. Start with a deliberately configured test shop and review its guard decisions in the audit log.

Your plugin. Your wishes. Our solution.

Do you have an idea for a feature that's missing in this plugin? Or do you need a custom modification for your store? As a Shopware Extension Partner, we develop tailored extensions and software solutions for e-commerce. Whether it's plugin development, consulting, or technical support – simply send us an email and we'll find the best solution for your project together.

E-Mail: support@lunova-solutions.de Web: www.lunova-solutions.de

Test your shop with clear rules for emails, apps and orders

Review test emails with controlled recipients

Control Shopware app requests deliberately

Approve payment methods for test orders

Understand guard decisions

Keep staging visible

Configure protection for your test environments

Your plugin. Your wishes. Our solution.

E-Mail: support@lunova-solutions.de Web: www.lunova-solutions.de

Details

Available: English, German
Latest update: 7 October 2026
Publication date: 18 September 2026
Version: 1.7.0
Category: Administration

Resources

Reviews (0)

Write a review

If you downloaded this extension you can write a review in the Shopware Account.

Write a review

No reviews found.

About the Extension Partner

Lunova Solutions

See all extensions

Partner Status

Shopware
Extension Partner

Details

Ø-Rating: 5

Average rating of 5 out of 5 stars
Partner since: 2026
Extensions: 19

Support

Based in: Germany
Speaks: German, English
Response time: Very quickly

Configure and verify SafeStage

Install: Install and activate SafeStage under Extensions > My extensions. Open Configuration from the extension menu. Use Save after changing settings.
Choose the scope: Start with All Sales Channels to define global settings. Under Safety Mode, switch on Enable SafeStage. Sales-channel overrides are available for email, storefront, robots and Payment Guard. The Administration banner and Outbound Guard use only global values.
Email Guard: Switch on Enable email guard. Add valid QA addresses under Redirect recipients, one per line or comma-separated. Replace the sample qa@example.test with your real test inbox. If a message has an unapproved recipient and no valid redirect destination, the entire message is blocked.
Email rules: Set Subject prefix. Enable Remove CC and BCC recipients and Log original recipients as required. Logged target addresses are masked, but subjects remain readable. Avoid personal data in subject lines.
Recipient allowlist: Allowed recipients and domains accepts individual addresses, domains such as @agency.test and patterns such as *.internal.test. The email pattern covers both the base domain and subdomains. Approved primary recipients continue receiving messages. If CC/BCC removal is disabled, only approved CC/BCC recipients remain. Choose every exception deliberately.
Banners and indexing: Enable Show storefront banner. Empty banner text uses translated defaults. Show administration banner (global only) and its text are configured globally. Reload Administration after saving to refresh the banner state. Enable noindex protection and optionally Disallow everything in robots.txt. Verify the actual HTTP response. A static robots.txt served directly by the web server is outside the plugin response override. With multiple sales channels on one host and port, a robots.txt restriction may affect the shared host.
Outbound Guard: Stay on All Sales Channels and enable Enable outbound guard (global only). Protection applies to the Shopware app-system HTTP client, including app webhooks and app Flow actions using that client. Custom HTTP clients in other plugins are outside its scope.
Choose the mode: Under Guard mode (global only), select Log only, Block external calls or Redirect to sandbox targets. Log only does not block requests. Allowed hosts (global only) are contacted unchanged in every mode. An outbound pattern such as *.internal.test permits subdomains but not the base domain. An empty custom host list defaults to localhost, 127.0.0.1 and ::1.
Sandbox mappings: Add one mapping per line in Redirect map (global only), such as live.example.test => https://sandbox.example.test. Replace these sample domains with your targets. Host mappings preserve the request path and query and replace any path specified on the target. URL mappings such as https://live.example.test/api => https://sandbox.example.test/mock append the matching path suffix to /mock. Source paths must match at path boundaries. External targets require HTTPS; HTTP is accepted for loopback targets. Use sandbox credentials because redirection does not automatically replace credentials.
Missing mappings: Keep Block targets without redirect mapping (global only) enabled if unmatched requests should be blocked in redirect mode. If disabled, unmatched requests proceed unchanged with a logging decision.
Payment Guard: Switch on Enable payment guard and select deliberately configured test methods under Allowed payment methods. The guard checks the selected method and blocks order placement when it is unapproved. An empty selection blocks all payment methods. It neither switches providers into sandbox mode nor hides payment methods.
Audit log: Open Settings > Extensions > SafeStage audit logs. Search for your test events and filter by Category and Decision. Open an entry for targets and metadata. Access requires system_config:read, which is also required for the Administration banner. App audit entries require a Shopware context. Daily cleanup removes entries older than 180 days when Shopware Scheduled Tasks and queue processing are running.
Verify: Test an unapproved email recipient, an approved address, the intended app targets and order placement with an unapproved payment method. Check banners, headers, the meta tag and /robots.txt on the affected host. Clear and rebuild the Shopware cache after configuration changes, then verify the responses again and account for proxy caches.

CLI verification

php bin/console lunova:safe-stage:status shows protection status. Use php bin/console lunova:safe-stage:status --json for machine-readable output. Select a sales channel with --sales-channel-id=YOUR_ID. The alias is lunova:testmode:status.

php bin/console lunova:safe-stage:robots previews a robots.txt block without writing a file. When protection is inactive, it still prints the block with a warning. Always verify the actual /robots.txt URL as well. The alias is lunova:testmode:robots.

SafeStage does not replace authentication, network rules or sandbox credentials. Use it in the intended test environment and verify each third-party integration separately.