MightySandbox

A WordPress plugin that lets a single logged-in administrator run live-site checkout in test/sandbox mode against the WooCommerce Authorize.Net and Stripe payment gateways, without affecting any other shoppers.

Install via WP-CLI

wp plugin install https://github.com/builtmighty/mighty-sandbox/releases/latest/download/mighty-sandbox.zip --activate

Requirements

• WordPress 6.0+
• PHP 8.1+
• WooCommerce
• Authorize.Net CIM and/or Stripe gateway with both production and test API credentials saved in the gateway settings

Features

• Per-admin sandbox toggle — a button in the WP admin bar flips your own session between live and test mode in one click. Pulsing red when ON, green when OFF, so you can't forget you're in sandbox.
• Per-request scope — the test-mode override is applied only to your PHP request. Every other shopper continues to hit the live payment gateway and pays real money in real time.
• Multiple gateways — supports Authorize.Net CIM (credit card + eCheck) and Stripe (classic + Express Checkout settings rows).
• Sandbox order flagging — orders placed while in sandbox mode are stamped with _mighty_sandbox meta, a prominent red "DO NOT SHIP" notice on the order edit screen, and a TEST badge column on the orders list (HPOS and legacy).
• HPOS compatible — declares compatibility with WooCommerce's High-Performance Order Storage.
• Settings-screen safety — the test-mode override is skipped on the WooCommerce → Settings → Payments screen, so admins editing gateway credentials always see the real stored values.
• Defense in depth — sandbox mode requires both the manage_options capability AND the user-meta flag; demoting an administrator instantly disables their sandbox without any meta cleanup.
• Automatic updates — auto-updates from GitHub releases via the built-in Plugin Update Checker.

Installation

1. Install the ZIP via the WP-CLI command above, or upload the contents to wp-content/plugins/mighty-sandbox/ and activate from the Plugins screen.
2. Confirm the target gateway already has both production AND test API credentials saved (Mighty Sandbox flips the environment switch; it does not supply credentials).
3. Click "Sandbox: OFF" in the admin bar to flip your session to test mode. Click again to return to live.

How It Works

1. Hooks the WordPress option_* filters for each gateway's settings row:
   • option_woocommerce_authorize_net_cim_credit_card_settings
   • option_woocommerce_authorize_net_cim_echeck_settings
   • option_woocommerce_stripe_settings
   • option_woocommerce_stripe_express_checkout_settings
2. When the current user is an administrator with sandbox mode active AND the request is not the WC payment-settings admin screen, the filter rewrites the returned array to flip environment → test (Authorize.Net) or testmode → yes (Stripe).
3. The gateway then transparently uses the test credentials the site owner has already saved in the gateway settings.
4. Because the filter only mutates the value returned to the current PHP request, other shoppers' requests are untouched.
5. At checkout, the gateway-filter component stamps the resulting order with _mighty_sandbox = yes so the warehouse cannot accidentally ship a test order.

Security

• Settings and toggle gated by the manage_options capability
• Nonce verification on the admin-bar toggle AJAX endpoint
• Capability check enforced on every state mutation
• User-meta flag deleted on plugin uninstall (sandbox order meta is intentionally retained as forensic evidence)