WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm glad to have the opportunity to ask my first question here.

The scenario is this: My team and I released a Premium Plugin last week.

We have since received a number of requests for a Live Demo.

I'm considering creating a subdomain at demo.mysite.com, and modding the admin login page to display the demo username and password.

Will it be sufficient, from a security standpoint, just to run it on a separate WordPress installation?

Are there admin-level features I'll want to disable?

I basically want the demo to be as realistic as possible without somehow compromising the security or integrity of my primary site.

Any advice appreciated,


share|improve this question
What does "Premium Plugin" mean? You don't want to offer it for download freely? So it should not be downloadable from the demo host? – hakre Aug 25 '10 at 9:17

If it's a separate WordPress installation, you won't have anything to worry about regarding the integrity of your primary site - they won't be connected in any way.

Though to protect your plug-in, I wouldn't just create an admin user. I'd install a role manager system and create a "Demo" userlevel with almost the same permissions as admin ... minus "Edit Plugins" and any user management capabilities.

This way, people can log in as your demo user and have all of the typical powers of an admin user. But they can't edit plugins and therefore can't view/steal the source of your plugin. Limiting user management capabilities means they can't work around this restriction by creating other users with custom permissions, either.

share|improve this answer
the plugin you mentioned doesn't allow plugin restrictions. Better use; User Role Editor (wordpress.org/extend/plugins/user-role-editor) – numediaweb May 13 '12 at 18:36

Unless you're concerned about not mixing your main site (I assume running on Wordpress) with the Demo Site, I suggest you seperate both from each other, so to have a dedicated webspace for the demo only which is not connected to your main site. This could be done via a subdomain.

Next to that I would create an auto-install script that does create a new install from time to time while resetting the whole demo-server. This will enable your users to play around with the Demo (remember those are admins) while you have the site automatically maintained.

If you need to reduce the users rights so that they are limited in the way to deal with your demo site, EAMann already made some valuable suggestions.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.