savedprompt

<p><strong>Secure Draft Preview Links</strong> lets you generate a cryptographically secure, unguessable link for any draft post so that people without a WordPress account can read it before it goes live.</p>
<h4>How it works</h4>
<ol>
<li>Open any draft post or page in the editor.</li>
<li>Check <strong>Enable public preview</strong> in the Publish panel (Classic Editor) or Status & Visibility panel (Block Editor).</li>
<li>Copy the generated link and share it with anyone.</li>
<li>The recipient can view the draft without logging in.</li>
<li>Uncheck the box or set the expiry to <strong>Expired</strong> to revoke access immediately.</li>
</ol>
<h4>Editor features</h4>
<ul>
<li>Works with both the <strong>Classic Editor</strong> and the <strong>Block Editor</strong> (Gutenberg).</li>
<li>Checkbox to enable / disable preview — shown even on auto-draft posts (disabled with a “save first” hint).</li>
<li>When a post is published the checkbox automatically disables and shows “Not available for published posts”.</li>
<li>Preview URL displayed in a monospace code box — horizontally scrollable, click to select all.</li>
<li><strong>Copy</strong> button and <strong>Open preview</strong> button inline with the URL box.</li>
<li><strong>Generate new link</strong> button — invalidates the old link immediately, with a confirmation step before firing.</li>
<li><strong>Stop sharing</strong> confirmation bar — shown when unchecking the checkbox, requires explicit confirmation before removing the link.</li>
<li>Expiry selector with four options:
<ul>
<li><strong>48 hours</strong> — default, shows exact time remaining (e.g. “Expires on: Apr 29 · 14:32 (4h 12m remaining)”).</li>
<li><strong>Always available</strong> — link never expires.</li>
<li><strong>Custom time</strong> — set Days, Hours, and Minutes; live “Expires on:” display updates as you type; shows error if all fields are cleared without saving.</li>
<li><strong>Expired (disable now)</strong> — immediately invalidates the link without deleting the token.</li>
</ul>
</li>
<li>Expiry settings auto-save on change with a “Expiry setting saved.” confirmation message.</li>
<li>Block Editor: snackbar notices for every action (enable, disable, copy, generate new link).</li>
<li>Block Editor: <strong>Open public preview</strong> item added to the Preview dropdown (WordPress 6.7+).</li>
</ul>
<h4>Preview Links admin page</h4>
<ul>
<li>Dedicated <strong>Preview Links</strong> menu item in the WordPress admin sidebar.</li>
<li>Two tabs: <strong>Active</strong> and <strong>Expired</strong>, each showing a count badge.</li>
<li><strong>Paginated table</strong> — 20 items per page, with top and bottom pagination controls.</li>
<li>Per-row columns: Post title, Post type, Exact expiry time, Preview URL, Share buttons, Actions.</li>
<li><strong>Copy URL</strong> and <strong>Open preview</strong> icon buttons inline with the URL.</li>
<li><strong>Share buttons</strong>: Facebook, X (Twitter), LinkedIn, Email — captions include the post title and expiry time (omitted for never-expires links).</li>
<li><strong>Regenerate</strong> button — generates a new token with a confirmation dialog; old link stops working immediately.</li>
<li><strong>Stop Sharing</strong> button — removes the token with a confirmation dialog.</li>
<li><strong>Edit Post</strong> link opens in a new tab.</li>
<li>Confirmation dialogs use an inline modal (no browser <code>confirm()</code>) with clear messaging about consequences.</li>
<li>Toast notifications slide up from the bottom-right on every action.</li>
</ul>
<h4>Security</h4>
<ul>
<li>Tokens are 64-character cryptographically random hex strings generated with <code>random_bytes()</code>.</li>
<li>Token validation uses <code>hash_equals()</code> to prevent timing attacks.</li>
<li>Expired links return a <strong>410 Gone</strong> HTTP response.</li>
<li>Invalid tokens return a <strong>403 Forbidden</strong> HTTP response.</li>
<li>Preview link is automatically removed when a post is published, made private, or trashed.</li>
<li>All AJAX endpoints are protected with nonces and capability checks.</li>
<li>No data is exposed to unauthenticated users beyond the post content itself.</li>
</ul>
<h4>Post list table</h4>
<ul>
<li><strong>Public Preview</strong> badge shown next to post titles that have an active preview link.</li>
<li><strong>Public Preview</strong> filter view in the post list table to quickly find all posts with active links.</li>
</ul>
<h4>Technical</h4>
<ul>
<li>Works with all viewable public post types (posts, pages, and custom post types).</li>
<li>Pagination links on multi-page posts are rewritten to include the preview token.</li>
<li>Token meta is registered with the REST API for block editor compatibility.</li>
<li>No external dependencies — pure PHP, jQuery (Classic Editor), and WordPress’s own React/wp-components (Block Editor).</li>
</ul>


Secure Draft Preview Links

Share draft posts with anyone via a secure, time-limited preview link — no login required.

tidyplugins

<p><strong>Tidy Draft Share</strong> lets you share any unpublished WordPress post with clients, editors, or collaborators — without publishing it and without giving them a WordPress account.</p>
<p>Generate a secure, time-limited link and send it to anyone. They will see the post exactly as it will look once published: same theme, same layout, same formatting.</p>
<h4>Why Tidy Draft Share?</h4>
<p>Most editorial workflows hit the same wall: <em>“Can you take a look at this before I publish it?”</em>. The usual workarounds — copying text into an email, exporting a PDF, or creating a temporary user account — are clunky and error-prone.</p>
<p>Tidy Draft Share solves this with a single click. Create a link, send it, done. The recipient sees a pixel-perfect preview of the post inside your actual theme. When the link expires, access is gone.</p>
<h4>Key features</h4>
<ul>
<li><strong>One-click sharing</strong> — Generate a secure link from the editor sidebar or the posts list, and copy it to your clipboard instantly</li>
<li><strong>Flexible expiration</strong> — Choose from 1 hour, 24 hours, 3 days, 7 days, 30 days, or no expiration at all</li>
<li><strong>Revoke anytime</strong> — Disable any link immediately with one click; access stops on the spot</li>
<li><strong>Multiple links per post</strong> — Create separate links for different reviewers, each with its own expiration and view count</li>
<li><strong>View tracking</strong> — See how many times each link has been opened</li>
<li><strong>Works everywhere</strong> — Supports posts, pages, and any custom post type (WooCommerce products, portfolio items, etc.)</li>
<li><strong>All unpublished statuses</strong> — Drafts, pending review, scheduled, and private posts</li>
<li><strong>SEO safe</strong> — Shared previews include a noindex/nofollow meta tag automatically, so search engines never index them</li>
<li><strong>Preview banner</strong> — A clear “Draft preview” banner at the top of the page tells the reader the content is not published yet</li>
<li><strong>Expired link page</strong> — Visitors see a clean, branded message when a link has expired instead of a confusing error</li>
<li><strong>Gutenberg & Classic</strong> — Full sidebar panel in the block editor, classic meta box for older setups</li>
<li><strong>Quick share from posts list</strong> — One-click share directly from your posts table, no need to open the editor</li>
<li><strong>Clean uninstall</strong> — All data is removed from your database when the plugin is deleted</li>
</ul>
<h4>Use cases</h4>
<ul>
<li>Share a formatted article with a client for approval before publishing</li>
<li>Let an external editor proofread a draft without creating a WordPress account</li>
<li>Preview scheduled content with your marketing team or stakeholders</li>
<li>Send a private post to a specific person without opening it to all logged-in users</li>
</ul>
<h4>Privacy & security</h4>
<p>Every share link uses a cryptographically secure 32-character token. Token validation uses constant-time comparison to prevent timing attacks. Links are checked on every visit — expired or revoked links return a 403 immediately. No data is sent to external servers; everything stays in your WordPress database.</p>


Tidy Draft Share

Share unpublished WordPress posts with anyone via secure, expiring preview links — no login required.

Secure Draft Preview Links vs Tidy Draft Share