tombenner

Front-End Users is a WordPress plugin that prevents specified user roles from accessing the WordPress admin section (the pages in /wp-admin/), sets up a profile editing page on the front-end, and allows for customization of front-end user-specific pages. This allows you to hide all of the WordPress back-end from specified roles (e.g. Subscribers) and instead present to them a profile editing page (and, optionally, other user-specific pages) that have the same layout as the rest of the site. The front-end functionality is available to all roles, but you can choose which roles are able to access the WordPress admin section (by default, only Administrators have access to it).
Front-End Users also makes it easy to:
<ul>
<li>Display user-specific links that depend on the login state (e.g. “Sign in | Register”, “John | Sign out”, “John | Dashboard | Sign out”)</li>
<li>Change the URL of the profile editing page and other user-specific pages</li>
<li>Add other user-specific pages and display a menu of all of some of these pages</li>
<li>Determine whether the current user has access to the admin section</li>
</ul>
The documentation for the hooks is in <a href="http://github.com/tombenner/front-end-users/blob/master/example_hooks.php" rel="nofollow ugc">example_hooks.php</a>, and the documentation for the functions is in <a href="http://github.com/tombenner/front-end-users/blob/master/functions.php" rel="nofollow ugc">functions.php</a>.
If the <a href="https://wordpress.org/extend/plugins/user-avatar/" rel="ugc">User Avatar plugin</a> is also installed, the avatar-editing functionality it provides will be shown on the front-end user settings page.
If you’d like to grab development releases, see what new features are being added, or browse the source code please visit the <a href="http://github.com/tombenner/front-end-users" rel="nofollow ugc">GitHub repo</a>.

Front-End Users

Hides the WordPress admin section from specified user roles, allows users to edit their settings from the front-end, and more.

savedprompt

Secure Draft Preview Links lets you generate a cryptographically secure, unguessable link for any draft post so that people without a WordPress account can read it before it goes live.
<h4>How it works</h4>
<ol>
<li>Open any draft post or page in the editor.</li>
<li>Check Enable public preview in the Publish panel (Classic Editor) or Status & Visibility panel (Block Editor).</li>
<li>Copy the generated link and share it with anyone.</li>
<li>The recipient can view the draft without logging in.</li>
<li>Uncheck the box or set the expiry to Expired to revoke access immediately.</li>
</ol>
<h4>Editor features</h4>
<ul>
<li>Works with both the Classic Editor and the Block Editor (Gutenberg).</li>
<li>Checkbox to enable / disable preview — shown even on auto-draft posts (disabled with a “save first” hint).</li>
<li>When a post is published the checkbox automatically disables and shows “Not available for published posts”.</li>
<li>Preview URL displayed in a monospace code box — horizontally scrollable, click to select all.</li>
<li>Copy button and Open preview button inline with the URL box.</li>
<li>Generate new link button — invalidates the old link immediately, with a confirmation step before firing.</li>
<li>Stop sharing confirmation bar — shown when unchecking the checkbox, requires explicit confirmation before removing the link.</li>
<li>Expiry selector with four options:
<ul>
<li>48 hours — default, shows exact time remaining (e.g. “Expires on: Apr 29 · 14:32 (4h 12m remaining)”).</li>
<li>Always available — link never expires.</li>
<li>Custom time — set Days, Hours, and Minutes; live “Expires on:” display updates as you type; shows error if all fields are cleared without saving.</li>
<li>Expired (disable now) — immediately invalidates the link without deleting the token.</li>
</ul>
</li>
<li>Expiry settings auto-save on change with a “Expiry setting saved.” confirmation message.</li>
<li>Block Editor: snackbar notices for every action (enable, disable, copy, generate new link).</li>
<li>Block Editor: Open public preview item added to the Preview dropdown (WordPress 6.7+).</li>
</ul>
<h4>Preview Links admin page</h4>
<ul>
<li>Dedicated Preview Links menu item in the WordPress admin sidebar.</li>
<li>Two tabs: Active and Expired, each showing a count badge.</li>
<li>Paginated table — 20 items per page, with top and bottom pagination controls.</li>
<li>Per-row columns: Post title, Post type, Exact expiry time, Preview URL, Share buttons, Actions.</li>
<li>Copy URL and Open preview icon buttons inline with the URL.</li>
<li>Share buttons: Facebook, X (Twitter), LinkedIn, Email — captions include the post title and expiry time (omitted for never-expires links).</li>
<li>Regenerate button — generates a new token with a confirmation dialog; old link stops working immediately.</li>
<li>Stop Sharing button — removes the token with a confirmation dialog.</li>
<li>Edit Post link opens in a new tab.</li>
<li>Confirmation dialogs use an inline modal (no browser <code>confirm()</code>) with clear messaging about consequences.</li>
<li>Toast notifications slide up from the bottom-right on every action.</li>
</ul>
<h4>Security</h4>
<ul>
<li>Tokens are 64-character cryptographically random hex strings generated with <code>random_bytes()</code>.</li>
<li>Token validation uses <code>hash_equals()</code> to prevent timing attacks.</li>
<li>Expired links return a 410 Gone HTTP response.</li>
<li>Invalid tokens return a 403 Forbidden HTTP response.</li>
<li>Preview link is automatically removed when a post is published, made private, or trashed.</li>
<li>All AJAX endpoints are protected with nonces and capability checks.</li>
<li>No data is exposed to unauthenticated users beyond the post content itself.</li>
</ul>
<h4>Post list table</h4>
<ul>
<li>Public Preview badge shown next to post titles that have an active preview link.</li>
<li>Public Preview filter view in the post list table to quickly find all posts with active links.</li>
</ul>
<h4>Technical</h4>
<ul>
<li>Works with all viewable public post types (posts, pages, and custom post types).</li>
<li>Pagination links on multi-page posts are rewritten to include the preview token.</li>
<li>Token meta is registered with the REST API for block editor compatibility.</li>
<li>No external dependencies — pure PHP, jQuery (Classic Editor), and WordPress’s own React/wp-components (Block Editor).</li>
</ul>

Secure Draft Preview Links

Share draft posts with anyone via a secure, time-limited preview link — no login required.

Front-End Users vs Secure Draft Preview Links