Pixy Puala

Why this plugin?
WordPress core preview links work well for editors, and Public Post Preview shares via anonymous nonces. 
This plugin adds a missing middle ground: draft previews that are secured by authentication and access control 
lists (ACLs) — role-based, user-specific, or per-email tokens — plus analytics and a one-click revoke-all.
Universal Compatibility
Works seamlessly with: 
* Full Site Editing (FSE) themes 
* Block themes (modern WordPress) 
* Classic PHP-based themes 
* All page builders including Elementor, WPBakery, Divi, etc. 
* WooCommerce product drafts 
* Any CSS framework including Tailwind CSS v4+
Key features
<ul>
<li>Create expiring preview links (default 72h; configurable).</li>
<li>Restrict by roles, specific users, or per-email tokens (no login for recipients).</li>
<li>Require HTTPS for previews (on by default).</li>
<li>Per-link analytics: allowed/denied events, hashed IP, user agent (privacy-friendly).</li>
<li>Meta box in the editor (Post/Page by default; filterable) to generate, copy, and revoke.</li>
<li>“Revoke All” for a post.</li>
<li>Everything prefixed (<code>srpl_</code>), sanitized, and aligned with WordPress coding standards.</li>
</ul>
How it works
Each generated link has a unique token, TTL, and ACL:
<ul>
<li>Role-based Access: Requires login. Only users with allowed roles can view the preview.</li>
<li>User-based Access: Requires login. Only specific user IDs can access the preview.</li>
<li>Email Token Access: No login required. Recipients receive unique URLs with email verification tokens.</li>
</ul>
When a link is visited, SRPL validates the token, expiry, and ACL, then renders the draft with your theme’s header/footer. Events are logged (when enabled) to a small custom table (<code>wp_srpl_events</code>) with hashed IP for privacy.
Privacy
<ul>
<li>IPs are hashed using <code>hash_hmac(sha256, ip, wp_salt('auth'))</code>.</li>
<li>You can disable analytics entirely under Settings → Secure Previews.</li>
</ul>
Developer Friendly
<ul>
<li>Fully documented filters and actions</li>
<li>Clean, object-oriented codebase</li>
<li>PSR-4 autoloading</li>
<li>Extensive inline documentation</li>
</ul>
<h3>Developer Documentation</h3>
Filters
<ul>
<li><code>srpl_supported_post_types</code> – Modify post types that support preview links</li>
<li><code>srpl_default_ttl_hours</code> – Change default expiration time (in hours)</li>
<li><code>srpl_force_ssl</code> – Control whether previews are forced to use HTTPS</li>
<li><code>srpl_analytics_enabled</code> – Enable or disable analytics collection</li>
</ul>
Functions
<ul>
<li><code>LinkManager::create($post_id, $args)</code> – Create a new preview link</li>
<li><code>LinkManager::revoke($link_id)</code> – Revoke a specific link</li>
<li><code>LinkManager::revoke_all_for_post($post_id)</code> – Revoke all links for a post</li>
<li><code>LinkManager::find_by_token($token)</code> – Find a link by its token</li>
</ul>
Database Structure
<ul>
<li>Post Meta for Links: _srpl_token, _srpl_mode, _srpl_roles, _srpl_users, _srpl_emails, _srpl_expires, _srpl_revoked, _srpl_hits, _srpl_last_access</li>
<li>Analytics Table: wp_srpl_events (link_id, post_id, user_id, outcome, ip_hash, ua, created_at)</li>
</ul>
<h3>License</h3>
This plugin is free software, licensed under the GPL v2 or later.

Secure Role-Restricted Draft Previews

Generate secure, expiring preview URLs for drafts with role/user restrictions. Compatible with FSE, Block Themes, and Classic Themes.

Dan-Lucian Stefancu

Since WordPress 2.5 there aren’t any links to the post drafts in the edit post section, so I’ve made a quick plugin that simply displays a box with the last 10 recent drafts in edit post page, as an unordered list, sorted by the last edit time.
The list is populated with the drafts titles, linked to the edit post page of each. The box is shown only to users with Editor role or higher.
In WordPress 2.7 or higher the box is displayed in the sidebar of edit post page, under the categories.

Add drafts

Displays a box with the last 10 recent drafts in the edit post page.

Secure Role-Restricted Draft Previews vs Add drafts