Travis Lopes

Marco Pereirinha

Need to show a post to someone but they don’t have a WordPress user account? Share Drafts Publicly allows you to generate a private URL for non-users to view post drafts with a simple click of a button.

Share Drafts Publicly

Thank you, Travis, for sharing your good work.
It made my life easier.

Simple and quite effective

Provide a secret link to non-logged in users to view post drafts.

savedprompt

Secure Draft Preview Links lets you generate a cryptographically secure, unguessable link for any draft post so that people without a WordPress account can read it before it goes live.
<h4>How it works</h4>
<ol>
<li>Open any draft post or page in the editor.</li>
<li>Check Enable public preview in the Publish panel (Classic Editor) or Status & Visibility panel (Block Editor).</li>
<li>Copy the generated link and share it with anyone.</li>
<li>The recipient can view the draft without logging in.</li>
<li>Uncheck the box or set the expiry to Expired to revoke access immediately.</li>
</ol>
<h4>Editor features</h4>
<ul>
<li>Works with both the Classic Editor and the Block Editor (Gutenberg).</li>
<li>Checkbox to enable / disable preview — shown even on auto-draft posts (disabled with a “save first” hint).</li>
<li>When a post is published the checkbox automatically disables and shows “Not available for published posts”.</li>
<li>Preview URL displayed in a monospace code box — horizontally scrollable, click to select all.</li>
<li>Copy button and Open preview button inline with the URL box.</li>
<li>Generate new link button — invalidates the old link immediately, with a confirmation step before firing.</li>
<li>Stop sharing confirmation bar — shown when unchecking the checkbox, requires explicit confirmation before removing the link.</li>
<li>Expiry selector with four options:
<ul>
<li>48 hours — default, shows exact time remaining (e.g. “Expires on: Apr 29 · 14:32 (4h 12m remaining)”).</li>
<li>Always available — link never expires.</li>
<li>Custom time — set Days, Hours, and Minutes; live “Expires on:” display updates as you type; shows error if all fields are cleared without saving.</li>
<li>Expired (disable now) — immediately invalidates the link without deleting the token.</li>
</ul>
</li>
<li>Expiry settings auto-save on change with a “Expiry setting saved.” confirmation message.</li>
<li>Block Editor: snackbar notices for every action (enable, disable, copy, generate new link).</li>
<li>Block Editor: Open public preview item added to the Preview dropdown (WordPress 6.7+).</li>
</ul>
<h4>Preview Links admin page</h4>
<ul>
<li>Dedicated Preview Links menu item in the WordPress admin sidebar.</li>
<li>Two tabs: Active and Expired, each showing a count badge.</li>
<li>Paginated table — 20 items per page, with top and bottom pagination controls.</li>
<li>Per-row columns: Post title, Post type, Exact expiry time, Preview URL, Share buttons, Actions.</li>
<li>Copy URL and Open preview icon buttons inline with the URL.</li>
<li>Share buttons: Facebook, X (Twitter), LinkedIn, Email — captions include the post title and expiry time (omitted for never-expires links).</li>
<li>Regenerate button — generates a new token with a confirmation dialog; old link stops working immediately.</li>
<li>Stop Sharing button — removes the token with a confirmation dialog.</li>
<li>Edit Post link opens in a new tab.</li>
<li>Confirmation dialogs use an inline modal (no browser <code>confirm()</code>) with clear messaging about consequences.</li>
<li>Toast notifications slide up from the bottom-right on every action.</li>
</ul>
<h4>Security</h4>
<ul>
<li>Tokens are 64-character cryptographically random hex strings generated with <code>random_bytes()</code>.</li>
<li>Token validation uses <code>hash_equals()</code> to prevent timing attacks.</li>
<li>Expired links return a 410 Gone HTTP response.</li>
<li>Invalid tokens return a 403 Forbidden HTTP response.</li>
<li>Preview link is automatically removed when a post is published, made private, or trashed.</li>
<li>All AJAX endpoints are protected with nonces and capability checks.</li>
<li>No data is exposed to unauthenticated users beyond the post content itself.</li>
</ul>
<h4>Post list table</h4>
<ul>
<li>Public Preview badge shown next to post titles that have an active preview link.</li>
<li>Public Preview filter view in the post list table to quickly find all posts with active links.</li>
</ul>
<h4>Technical</h4>
<ul>
<li>Works with all viewable public post types (posts, pages, and custom post types).</li>
<li>Pagination links on multi-page posts are rewritten to include the preview token.</li>
<li>Token meta is registered with the REST API for block editor compatibility.</li>
<li>No external dependencies — pure PHP, jQuery (Classic Editor), and WordPress’s own React/wp-components (Block Editor).</li>
</ul>

Secure Draft Preview Links

Share draft posts with anyone via a secure, time-limited preview link — no login required.

Share Drafts Publicly vs Secure Draft Preview Links