savedprompt

<p><strong>Secure Draft Preview Links</strong> lets you generate a cryptographically secure, unguessable link for any draft post so that people without a WordPress account can read it before it goes live.</p>
<h4>How it works</h4>
<ol>
<li>Open any draft post or page in the editor.</li>
<li>Check <strong>Enable public preview</strong> in the Publish panel (Classic Editor) or Status & Visibility panel (Block Editor).</li>
<li>Copy the generated link and share it with anyone.</li>
<li>The recipient can view the draft without logging in.</li>
<li>Uncheck the box or set the expiry to <strong>Expired</strong> to revoke access immediately.</li>
</ol>
<h4>Editor features</h4>
<ul>
<li>Works with both the <strong>Classic Editor</strong> and the <strong>Block Editor</strong> (Gutenberg).</li>
<li>Checkbox to enable / disable preview — shown even on auto-draft posts (disabled with a “save first” hint).</li>
<li>When a post is published the checkbox automatically disables and shows “Not available for published posts”.</li>
<li>Preview URL displayed in a monospace code box — horizontally scrollable, click to select all.</li>
<li><strong>Copy</strong> button and <strong>Open preview</strong> button inline with the URL box.</li>
<li><strong>Generate new link</strong> button — invalidates the old link immediately, with a confirmation step before firing.</li>
<li><strong>Stop sharing</strong> confirmation bar — shown when unchecking the checkbox, requires explicit confirmation before removing the link.</li>
<li>Expiry selector with four options:
<ul>
<li><strong>48 hours</strong> — default, shows exact time remaining (e.g. “Expires on: Apr 29 · 14:32 (4h 12m remaining)”).</li>
<li><strong>Always available</strong> — link never expires.</li>
<li><strong>Custom time</strong> — set Days, Hours, and Minutes; live “Expires on:” display updates as you type; shows error if all fields are cleared without saving.</li>
<li><strong>Expired (disable now)</strong> — immediately invalidates the link without deleting the token.</li>
</ul>
</li>
<li>Expiry settings auto-save on change with a “Expiry setting saved.” confirmation message.</li>
<li>Block Editor: snackbar notices for every action (enable, disable, copy, generate new link).</li>
<li>Block Editor: <strong>Open public preview</strong> item added to the Preview dropdown (WordPress 6.7+).</li>
</ul>
<h4>Preview Links admin page</h4>
<ul>
<li>Dedicated <strong>Preview Links</strong> menu item in the WordPress admin sidebar.</li>
<li>Two tabs: <strong>Active</strong> and <strong>Expired</strong>, each showing a count badge.</li>
<li><strong>Paginated table</strong> — 20 items per page, with top and bottom pagination controls.</li>
<li>Per-row columns: Post title, Post type, Exact expiry time, Preview URL, Share buttons, Actions.</li>
<li><strong>Copy URL</strong> and <strong>Open preview</strong> icon buttons inline with the URL.</li>
<li><strong>Share buttons</strong>: Facebook, X (Twitter), LinkedIn, Email — captions include the post title and expiry time (omitted for never-expires links).</li>
<li><strong>Regenerate</strong> button — generates a new token with a confirmation dialog; old link stops working immediately.</li>
<li><strong>Stop Sharing</strong> button — removes the token with a confirmation dialog.</li>
<li><strong>Edit Post</strong> link opens in a new tab.</li>
<li>Confirmation dialogs use an inline modal (no browser <code>confirm()</code>) with clear messaging about consequences.</li>
<li>Toast notifications slide up from the bottom-right on every action.</li>
</ul>
<h4>Security</h4>
<ul>
<li>Tokens are 64-character cryptographically random hex strings generated with <code>random_bytes()</code>.</li>
<li>Token validation uses <code>hash_equals()</code> to prevent timing attacks.</li>
<li>Expired links return a <strong>410 Gone</strong> HTTP response.</li>
<li>Invalid tokens return a <strong>403 Forbidden</strong> HTTP response.</li>
<li>Preview link is automatically removed when a post is published, made private, or trashed.</li>
<li>All AJAX endpoints are protected with nonces and capability checks.</li>
<li>No data is exposed to unauthenticated users beyond the post content itself.</li>
</ul>
<h4>Post list table</h4>
<ul>
<li><strong>Public Preview</strong> badge shown next to post titles that have an active preview link.</li>
<li><strong>Public Preview</strong> filter view in the post list table to quickly find all posts with active links.</li>
</ul>
<h4>Technical</h4>
<ul>
<li>Works with all viewable public post types (posts, pages, and custom post types).</li>
<li>Pagination links on multi-page posts are rewritten to include the preview token.</li>
<li>Token meta is registered with the REST API for block editor compatibility.</li>
<li>No external dependencies — pure PHP, jQuery (Classic Editor), and WordPress’s own React/wp-components (Block Editor).</li>
</ul>


Secure Draft Preview Links

Share draft posts with anyone via a secure, time-limited preview link — no login required.

Mehul Gohil

<p>PreviewShare is a secure public preview plugin for WordPress. It helps editors share draft posts, pending pages, scheduled content, private posts, and other enabled public post types through controlled preview links without publishing early or creating temporary reviewer accounts.</p>
<p>Use PreviewShare when a client, legal reviewer, teammate, editor, or stakeholder needs to review WordPress content before it goes live. Each preview URL uses a random token, can expire automatically, can be revoked, and is designed for private review workflows such as client approval, content approval, editorial review, and scheduled campaign checks.</p>
<p>PreviewShare stores token hashes instead of plain-text tokens, adds noindex/nofollow robots directives to shared previews, and shows a clear preview banner on private preview pages.</p>
<h4>Common use cases</h4>
<ul>
<li>Share a WordPress draft post with a client before publishing.</li>
<li>Send a private preview link for a pending page, scheduled campaign, or unpublished landing page.</li>
<li>Let stakeholders review content without giving them a WordPress login.</li>
<li>Create separate labeled preview links for legal review, client review, editorial review, or team approval.</li>
<li>Revoke access after feedback is complete or when a preview link should no longer work.</li>
<li>Keep search engines from indexing private preview URLs with robots directives.</li>
</ul>
<h4>Key features</h4>
<ul>
<li>Generate secure public preview links from the block editor, Classic Editor, post list table, or Preview dropdown.</li>
<li>Share pretty URLs such as <code>https://example.com/preview/exampletoken</code>.</li>
<li>Set a default expiration time for preview links from the PreviewShare settings screen.</li>
<li>Override the expiration time per post or page.</li>
<li>Create multiple labeled preview links for different reviewers.</li>
<li>Revoke preview access when a link should stop working.</li>
<li>View and manage preview link status, expiry, labels, and view counts from the settings screen.</li>
<li>Choose which public post types support public preview sharing.</li>
<li>Keep token lookup fast with optional object cache support.</li>
</ul>
<h4>How PreviewShare protects preview links</h4>
<p>PreviewShare is built for private review, not public publishing. It uses random preview tokens, stores token hashes in WordPress post meta, supports automatic expiration, supports manual revocation, and sends <code>noindex</code>, <code>nofollow</code>, <code>noarchive</code>, <code>nosnippet</code>, and <code>noimageindex</code> directives for preview requests.</p>
<p>Anyone with a valid preview URL can open that preview, so links should still be shared only with intended reviewers.</p>
<h3>Development</h3>
<p>The public source repository is available at https://github.com/mehul0810/previewshare.</p>
<p>Production ZIP files are built from the source repository with:</p>
<pre><code>npm install
npm run plugin-zip
</code></pre>
<p>The release artifact includes compiled assets, Composer autoload files, <code>composer.json</code>, plugin PHP, languages, readme, and license files. Development files such as <code>node_modules</code>, source assets, CI configuration, tests, and build tooling are excluded from production ZIP files.</p>


PreviewShare

Create secure public preview links for WordPress drafts, scheduled posts, and client reviews without user accounts.

Secure Draft Preview Links vs PreviewShare