DemoNest Sandbox Builder

Description

DemoNest Sandbox Builder creates private, temporary, isolated WordPress Multisite sandbox sites for visitors to test plugins, themes, and WooCommerce stores. Use it for plugin, theme, WooCommerce extension, agency and product demos.

DemoNest Sandbox Builder is not a shared-demo or external SaaS service. It creates a separate, private, temporary sandbox subsite for each visitor inside the site owner’s own WordPress Multisite network.

How it works

1. Demo Product: you prepare a demo-safe template site and create a Demo Product from it. It can have a primary plugin or theme, required dependencies, supporting plugins, safe demo-data profiles and an optional Demo Launch Guide (a short start page for the tester).
2. Shortcode: put [demonest_sandbox_builder demo_product="your-slug"] on a page.
3. Visitor request: the visitor picks 10 or 20 minutes. Instant Demo Access needs no email and opens in the same browser. Email Verified Access, if you choose it for a product, sends a verification link and then a one-time access link.
4. Isolated sandbox: each visitor gets a separate sandbox with a restricted temporary demo user. Dependencies are activated first, then the primary item.
5. Expiry and cleanup: when time is up, access is revoked, then the sandbox site and its data are removed. This is automatic.

What a Demo Product can include

• A primary plugin or theme, required dependencies (found automatically from « Requires Plugins » headers and checked before you save), supporting plugins and safe demo-data profiles. Nothing is downloaded and testers can never install, update or activate plugins or themes.
• A Demo Launch Guide: a title, a short introduction and one to four buttons that open places inside the tester’s own sandbox, never another website. Presets fill the form and detect the primary plugin’s settings page when it is clear.

Demo data

• WooCommerce Store Ready creates fictional demo data only (products, reviews and a few orders from clearly fake customers). It never copies customers, orders, payment data, licences or private content from any site.
• Seed-data protection keeps the preloaded demo products, orders and pages while testers can still create, edit and delete their own test data.

Self-hosted

Everything runs on your own network. No DemoNest Sandbox Builder account, API key or external demo service is needed, and there is no telemetry, analytics, advertising, tracking or licensing service.

Privacy

No analytics, telemetry, advertising, tracking, licensing service or third-party SaaS is used, and no visitor data is sent to any DemoNest Sandbox Builder-controlled server. The few requests the plugin makes are ones you control:

• Email: with Email Verified Access, a verification email and a ready email go through your site’s own wp_mail(). Instant Demo Access sends no email.
• Email Delivery Check: DNS lookups of the From domain and a test email to the administrator happen only after a Network Administrator presses the button.
• Loopback: while a store is prepared, an authenticated request goes only to a site of your own WordPress network.

A visitor’s email address is held in a short-lived temporary record for up to 30 minutes before confirmation and at most 2 hours afterwards, then removed. The plugin’s tables keep only a keyed one-way hash of it. The demo user gets a placeholder address on the reserved .invalid domain. Verification links last 30 minutes, access links 60 minutes and handoff tokens 2 minutes, are single use and are stored only as hashes. Instant Demo Access sets one HttpOnly cookie (ewdb_instant, about one hour). Logs hold identifiers and codes, never email addresses or tokens.

The optional attribution line is voluntary and off by default. A Network Administrator can turn it on; it is plain text, loads nothing and appears only on screens the plugin creates. The plugin does not register a WordPress personal-data exporter or eraser, because it keeps no raw visitor email beyond the short-lived records above. A suggested privacy text is added under Settings > Privacy > Policy Guide.

Requirements

• WordPress Multisite, network-activated. On a single site the plugin stays inactive.
• A demo-safe template site with demo content only, never real customers or orders.
• Wildcard DNS and a wildcard TLS certificate for a subdomain network. A shared cookie domain is not needed: the plugin does not require a shared cookie domain.
• Working email for Email Verified Access.
• WP-Cron, or a real server cron job calling wp-cron.php, for expiry and cleanup.

Uninstall

Deleting the plugin removes nothing by default. If you first turn on « Delete DemoNest Sandbox Builder data on uninstall » in the network settings, deleting it removes only the plugin’s own tables, options and scheduled events. It never deletes sandbox sites, users or template sites.