Pixy Puala

Why this plugin?
WordPress core preview links work well for editors, and Public Post Preview shares via anonymous nonces. 
This plugin adds a missing middle ground: draft previews that are secured by authentication and access control 
lists (ACLs) — role-based, user-specific, or per-email tokens — plus analytics and a one-click revoke-all.
Universal Compatibility
Works seamlessly with: 
* Full Site Editing (FSE) themes 
* Block themes (modern WordPress) 
* Classic PHP-based themes 
* All page builders including Elementor, WPBakery, Divi, etc. 
* WooCommerce product drafts 
* Any CSS framework including Tailwind CSS v4+
Key features
<ul>
<li>Create expiring preview links (default 72h; configurable).</li>
<li>Restrict by roles, specific users, or per-email tokens (no login for recipients).</li>
<li>Require HTTPS for previews (on by default).</li>
<li>Per-link analytics: allowed/denied events, hashed IP, user agent (privacy-friendly).</li>
<li>Meta box in the editor (Post/Page by default; filterable) to generate, copy, and revoke.</li>
<li>“Revoke All” for a post.</li>
<li>Everything prefixed (<code>srpl_</code>), sanitized, and aligned with WordPress coding standards.</li>
</ul>
How it works
Each generated link has a unique token, TTL, and ACL:
<ul>
<li>Role-based Access: Requires login. Only users with allowed roles can view the preview.</li>
<li>User-based Access: Requires login. Only specific user IDs can access the preview.</li>
<li>Email Token Access: No login required. Recipients receive unique URLs with email verification tokens.</li>
</ul>
When a link is visited, SRPL validates the token, expiry, and ACL, then renders the draft with your theme’s header/footer. Events are logged (when enabled) to a small custom table (<code>wp_srpl_events</code>) with hashed IP for privacy.
Privacy
<ul>
<li>IPs are hashed using <code>hash_hmac(sha256, ip, wp_salt('auth'))</code>.</li>
<li>You can disable analytics entirely under Settings → Secure Previews.</li>
</ul>
Developer Friendly
<ul>
<li>Fully documented filters and actions</li>
<li>Clean, object-oriented codebase</li>
<li>PSR-4 autoloading</li>
<li>Extensive inline documentation</li>
</ul>
<h3>Developer Documentation</h3>
Filters
<ul>
<li><code>srpl_supported_post_types</code> – Modify post types that support preview links</li>
<li><code>srpl_default_ttl_hours</code> – Change default expiration time (in hours)</li>
<li><code>srpl_force_ssl</code> – Control whether previews are forced to use HTTPS</li>
<li><code>srpl_analytics_enabled</code> – Enable or disable analytics collection</li>
</ul>
Functions
<ul>
<li><code>LinkManager::create($post_id, $args)</code> – Create a new preview link</li>
<li><code>LinkManager::revoke($link_id)</code> – Revoke a specific link</li>
<li><code>LinkManager::revoke_all_for_post($post_id)</code> – Revoke all links for a post</li>
<li><code>LinkManager::find_by_token($token)</code> – Find a link by its token</li>
</ul>
Database Structure
<ul>
<li>Post Meta for Links: _srpl_token, _srpl_mode, _srpl_roles, _srpl_users, _srpl_emails, _srpl_expires, _srpl_revoked, _srpl_hits, _srpl_last_access</li>
<li>Analytics Table: wp_srpl_events (link_id, post_id, user_id, outcome, ip_hash, ua, created_at)</li>
</ul>
<h3>License</h3>
This plugin is free software, licensed under the GPL v2 or later.

Secure Role-Restricted Draft Previews

Generate secure, expiring preview URLs for drafts with role/user restrictions. Compatible with FSE, Block Themes, and Classic Themes.

David Artiss

Based on <a href="https://twitter.com/johnbillion/status/1314494422529331203" rel="nofollow ugc">an idea by John Blackbourn</a>, and mentioned by <a href="https://poststatus.com/" rel="nofollow ugc">Post Status</a>, this plugin is designed to be a reminder to those who leave draft posts unloved. And, yes, all of John’s ideas are here, with more to boot.
<ul>
<li>Send emails out on a daily or weekly schedule and at a time that you’d prefer</li>
<li>Look for draft pages as well as posts, if you like. Or just pages, if that’s what you want. We won’t judge</li>
<li>Target those drafts that were created more than a specific time period ago, or have not been updated for a while</li>
<li>Each user, who has drafts that then reminding about, will receive an email. No, they can’t unsubscribe from them</li>
<li>Each email will show the number of drafts, along with a reminder of each of them</li>
<li>Optional ability to prevent the plugin from being deactivated (allow you to avoid the temptation to do so rather than, you know, deal with the drafts)</li>
<li>Debug features to allow to verify what’s being sent</li>
</ul>
Oh, and, naturally, the code passes <a href="https://github.com/WordPress/WordPress-Coding-Standards" rel="nofollow ugc">WordPress</a> and <a href="https://github.com/Automattic/VIP-Coding-Standards" rel="nofollow ugc">WordPress VIP</a> coding standards.
I’d like to thank <a href="https://calebburks.com/" rel="nofollow ugc">Caleb Burks</a> for the feedback he provided. Also, the iconography is courtesy of the very talented <a href="https://www.fiverr.com/jankirathore" rel="nofollow ugc">Janki Rathod</a>.
Please visit the <a href="https://github.com/dartiss/draft-concluder" title="Github" rel="nofollow ugc">Github page</a> for the latest code development, planned enhancements and known issues
<h3>Mentions</h3>
Draft Concluder was mentioned in issue 421 of <a href="https://poststatus.com/newsletter/" rel="nofollow ugc">the Post Status newsletter</a> (published 16th November 2020).
It was also mentioned in <a href="https://thewpweekly.com/21/" rel="nofollow ugc">edition 21 of the WP Weekly newsletter</a> (published 23rd November 2020)

Draft Concluder

Email users that have outstanding drafts.

Secure Role-Restricted Draft Previews vs Draft Concluder