uukidev

YUI Preview Token solves the authentication problem in decoupled (headless) WordPress architectures. Application Passwords are a great built-in WordPress feature for this purpose, but they require managing long-lived secrets on the frontend side. This plugin instead issues per-post tokens that grant read access for a configurable period — no persistent secrets required.
The frontend (Astro, Next.js, Nuxt, etc.) receives a preview URL and can fetch the draft content directly via the REST API.
<h4>How it works</h4>
<ol>
<li>An authorized WordPress user generates a token from the Gutenberg sidebar, Quick Edit panel, or Classic Editor meta box.</li>
<li>The token is embedded in a preview URL pointing to your external frontend.</li>
<li>The frontend calls <code>/wp-json/yui-preview-token/v1/preview?token=…</code> to retrieve the draft content.</li>
<li>The token expires automatically; no manual cleanup needed.</li>
</ol>
<h4>Key Features</h4>
Token Management
<ul>
<li>Generate tokens with expiry presets: 1 hour, 24 hours, 30 days, custom date/time, or no expiry.</li>
<li>One token per post — issuing a new token invalidates the previous one.</li>
<li>Tokens are generated with <code>bin2hex(random_bytes(32))</code> (256-bit CSPRNG). The lookup key stored in <code>wp_options</code> is the SHA-256 hash of the raw token, not the token itself — so a database leak does not expose usable tokens directly.</li>
<li>Automatic cleanup of expired tokens via WP Cron (daily).</li>
</ul>
Editor Integration
<ul>
<li>Gutenberg: dedicated panel in the Document Settings sidebar.</li>
<li>Quick Edit: token controls directly in the post list.</li>
<li>Classic Editor: meta box in the editor sidebar.</li>
<li>Copy preview URL to clipboard with one click.</li>
<li>Update expiry without invalidating the current token.</li>
</ul>
Admin Settings
<ul>
<li>Set the external frontend URL (clicking “Open external preview” navigates directly to this URL).</li>
<li>Configure allowed CORS origins (multiple, with wildcard support — <code>https://*.example.com</code>).</li>
<li>Choose the minimum WordPress role required to issue tokens (Subscriber → Administrator).</li>
<li>Tune rate limiting (requests per time window).</li>
<li>Optionally permit no-expiry tokens.</li>
</ul>
Issued Tokens List
<ul>
<li>View all active and expired tokens with post title, status, expiry, and issuer.</li>
<li>Revoke individual tokens or bulk-delete expired ones — all from the Settings screen.</li>
</ul>
Security
<ul>
<li>HTTPS required for the preview endpoint (overridable for local development).</li>
<li>Per-IP rate limiting with configurable thresholds (default: 30 req / 60 s).</li>
<li>Role-based access control for token issuance.</li>
<li>CORS headers only sent for explicitly configured origins; WP core’s permissive echo-back is suppressed.</li>
<li><code>Referrer-Policy: no-referrer</code> prevents token leakage via referer headers.</li>
<li>Tokens are only valid for <code>draft</code>, <code>pending</code>, and <code>future</code> post statuses.</li>
<li>Admin-only settings page with defence-in-depth capability checks.</li>
<li>CSRF protection on all admin actions (nonce verification).</li>
</ul>
Audit Logging
<ul>
<li>Logs token issuance and usage events (post ID, user ID, client IP).</li>
<li>Logs security events: invalid token attempts, rate-limit violations, capability denials.</li>
<li>Output goes to <code>WP_DEBUG_LOG</code> by default; point to a dedicated file with <code>PVT_LOG_FILE</code>.</li>
</ul>
Internationalisation
<ul>
<li>Ships with Japanese (ja) and Simplified Chinese (zh_CN) translations.</li>
<li>All admin UI strings are translation-ready.</li>
</ul>
<h4>Developer Hooks</h4>
Filter
<ul>
<li><code>yuipt_preview_response_data</code> — Modify the REST API response data before it is sent.</li>
</ul>
Actions
<ul>
<li><code>yuipt_token_issued( int $post_id, int $user_id )</code> — Fires after a token is issued.</li>
<li><code>yuipt_token_used( int $post_id, int $user_id )</code> — Fires when a token is used successfully.</li>
<li><code>yuipt_invalid_token( string $ip )</code> — Fires on an invalid/expired token attempt.</li>
<li><code>yuipt_rate_limit_exceeded( string $ip, string $endpoint )</code> — Fires when rate limit is hit.</li>
<li><code>yuipt_capability_denied( int $user_id, int $post_id )</code> — Fires on a capability denial.</li>
</ul>
Constants (wp-config.php)
<ul>
<li><code>PVT_SKIP_HTTPS_CHECK</code> — Set to <code>true</code> to disable the HTTPS requirement (development only).</li>
<li><code>PVT_LOG_FILE</code> — Absolute path to a dedicated audit log file.</li>
</ul>
<h4>Use Case</h4>
This plugin is designed for headless WordPress setups where a decoupled frontend (e.g. Astro, Next.js, Nuxt, SvelteKit) renders content from the WordPress REST API. It gives content editors a simple, secure way to share draft previews with stakeholders without granting them WordPress accounts or exposing long-lived API credentials.

YUI Preview Token

Issue time-limited preview tokens for headless WordPress setups. Open drafts directly in your frontend URL without long-lived credentials.

SzMake

In English:
No spam in the <a href='https://wordpress.org/plugins/contact-form-7/' rel="ugc">Contact Form 7</a>.Add anti-spambot functionality to the CF7.
It blocks spam without using CAPTCHA,blocked by Invisible internal token-code with ajax.
This plugin blocks 100% of spam post in the author of the environment.
There is no modification of display the contact form.(The added field hidden)
(but the message which is posted by spammers manually via browser is not blocked by this plugin)
This method is the same as the <a href='https://wordpress.org/plugins/sz-comment-filter/' rel="ugc">Sz Comment Filter</a> which is released ahead.
In Japanese:
このプラグインは<a href='https://wordpress.org/plugins/contact-form-7/' rel="ugc">Contact Form 7</a>へのスパムbotからの投稿をブロックするプラグインです。
このプラグインでは、見えない入力欄を用意して投稿時にjavascriptでCAPTCHA入力に変わる固有の確認トークン入力処理をで行うことでスパムBotからの投稿をブロックします。
作者の環境では、今のところこのプラグインで100％スパムBOT投稿がブロックできています。
利用ユーザーのコメントフォームの見え方は変わりません。(追加される入力欄は非表示でユーザーから見えません)
(残念ながらこのプラグインではブラウザを介した手入力によるスパム投稿はブロックできません)
この対策手法は先にリリースしている <a href='https://wordpress.org/plugins/sz-comment-filter/' rel="ugc">Sz Comment Filter</a> と同じ方法です。
<a href="http://wp.szmake.net/contact-from-7-add-spam-bot-filter/" title="Documentation in Japanese" rel="nofollow ugc">日本語の詳細説明ページはこちら</a>
<h4>IMPORTANT NOTE</h4>
This plugin works with ContactForm7 3.6+,or later versions.
This plug-in is not related to the developer of the “Contact Form 7”.
(ja)このプラグインはContact Form 7 バージョン3.6以降との組み合わせで動作します。
(ja)このプラグインの作者はContact Form 7プラグイン開発元とは関係ありません。ご注意下さい。
<h4>Translators</h4>
<ul>
<li>Japanese (ja)</li>
</ul>
<h3>Contact</h3>
email to contact[at]szmake.net
twitter @sxmtz

Contact Form 7 Anti Spambot

No spam in the Contact Form 7.Add anti-spambot functionality to the CF7,it blocks spam without using CAPTCHA.

YUI Preview Token vs Contact Form 7 Anti Spambot