CommentMate – Live Feedback & Copy Collection

CommentMate lets site administrators share a private review link and collect feedback directly on website pages. Every current feature is included free.

• Contextual comments, copy-ready text, administrator comments and threaded replies.
• Active and resolved feedback, image/PDF attachments and context screenshots.
• Image previews, original downloads and Save to Media Library.
• Maximum-width, quality and WebP controls for separate compressed downloads or saved copies. Originals are preserved; identical saved copies are reused.
• Done! Notify Admin completion notifications and optional daily/immediate notifications.
• Stop sharing revokes the link and reviewer sessions first. Then keep the review data or explicitly confirm deletion. Saved Media Library images, including compressed copies, remain.

Full review controls are desktop-first. Mobile includes touch creation and replies; desktop remains recommended for full review work. The sidebar is not a responsive-device emulator. CommentMate provides one site's shared review workspace for all site administrators. Multisite is not supported. Page groups can be collapsed. Private unfinished drafts remain only in the open tab; leaving or reloading loses them. Failed saves retain text, and failed files can be retried without reposting saved text. Administrators can repair a pin from a placement warning and review bounded notification failure details beneath Notifications. Mail handoff is not a delivery guarantee. Clicking away from a blank draft removes it silently. A draft with text or selected files opens a Remove / Publish / Edit comment popup and scrolls to its saved point. Escape returns to editing; Publish uses the current text and files. Failed saves keep the draft, and removing failed-file recovery keeps the published comment. Finish resolves the draft first; publishing does not send a completion notification. Desktop remains recommended. Physical iOS Safari/Android Chrome, real mobile keyboards and some builder/browser combinations remain unverified. Individual invitations/expiry, full search/filtering and Pro features are not included. Scrollbar boundary markers are omitted because accurate positions cannot be guaranteed. Requirements and safeguards Use HTTPS, PHP Sodium, InnoDB and writable durable private storage outside all public document roots. GD is required for image attachments and screenshots; WebP needs GD WebP support. PDF validation needs Fileinfo. ZIP review downloads need ZipArchive. The Advanced screen reports hosting checks; it cannot prove inbox delivery or external cache behavior. Private files default to a 100 MiB storage budget (configurable from 25 to 250 MiB by the owner under Advanced → Private storage). Individual uploads are limited to 5 MB; a message supports up to three images and one PDF. Feedback has a 25 MiB budget and 2,000 stored-record limit. Comments and their initial messages are separate records; this is not 2,000 standalone comments. Soft-deleted records count until full cleanup. These safeguards apply to everyone and cannot be unlocked by payment. PHP 8.1 remains the compatibility minimum. For supported hosting, use PHP 8.3 or newer (8.4/8.5 recommended for new hosting). PHP 8.1 is no longer supported by PHP; the Compatibility check recommends an upgrade without blocking compatible installations. Review downloads and administrator access Advanced → Data management → Download review data supplies readable comments and replies, structured review data and available private attachments. Media Library copies are referenced rather than copied into the download. Protect the downloaded file: it contains private feedback and is not a complete recovery backup. All site administrators can manage the shared review, downloads and notification settings. No individual ownership, transfer or recovery is required. Privacy and data retention Review content, names, page URLs, anchors, replies and audit events are stored in this site's database. Private files and screenshots are encrypted in an install-specific directory outside public web roots. Authentication uses a hashed share secret and hashed reviewer sessions; an encrypted copy of the active share secret lets the owner re-copy the link. Anyone given the active private link can join that site's review. Treat it as confidential. A screenshot may capture visible page content. Avoid personal or confidential information in review pages and attachments. Saving an image to the WordPress Media Library creates an ordinarily public media item, including any compressed copy. Stopping sharing revokes access but retains data unless the owner confirms cleanup. Deactivation retains data. WordPress Delete erases plugin data by default; the owner can turn off “Erase data when this plugin is deleted” first. Media Library items remain under either choice. Email uses the site's configured WordPress mail transport. Completion notifications are enabled on fresh installs to the site administrator; automatic daily/immediate alerts are off. Existing settings are preserved. Reviewers' names, page references, counts and feedback excerpts may be included in configured notifications. Confirm recipients before sharing. No PluginHub account, telemetry, external updater or external review service is required. This plugin's assets are served locally. Back up the database, private storage and the site's WordPress encryption/authentication material together. A database-only or ordinary wp-content-only backup may be insufficient. See Installation and FAQ before changing hosts or salts. Source and support Readable frontend source, package-lock.json, Vite configuration and standalone build instructions are included. See building.txt and third-party-notices.txt. PHP is supplied as readable source. No private development account is needed to rebuild. For help, contact https://pluginhub.com.au/contact/. Report security issues privately to info@pluginhub.com.au as described in SECURITY.md; do not post review links or private files publicly.

1.0.9

• Allow silent activation on HTTP and show scoped HTTPS setup guidance. Sharing and review sessions still require HTTPS.
• Use WordPress directory helpers for private storage, hosting checks and safe uninstall, including relocated public directories.
• Authenticate protected REST routes through explicit permission callbacks while preserving guest and administrator safeguards.

1.0.8

• Show complete replies in scrollable threads and keep mobile comment details beside their numbered pins.
• Improve mobile name editing, sidebar width and swipe gestures, mode selection and scroll containment.
• Refine narrow author names and crowded host headers; strengthen database input/query handling and directory readiness.

1.0.7

• Replace the unfinished-draft reminder with Remove / Publish / Edit, retain the chosen point, and protect draft publication and file recovery.

1.0.6

• Remove redundant new-link instructions. Show deletion completion without the old warning and refresh the admin screen on dismissal.

1.0.5

• Share review management across site administrators and simplify Review/Advanced guidance.
• Allow private-data cleanup to continue after saved images are edited or removed; preserve saved Media Library files.
• Refine collapsible sidebar groups, long-name wrapping and narrow card actions.
• Modernize the add-comment cursor, use its lower-left tail as the click point and mark the chosen spot with a blue dot while typing.

1.0.4

• Add touch creation/replies, keyboard-aware overlays and collapsible page groups; retain desktop-first guidance.
• Add guarded owner placement repair, tab-memory draft recovery and failed file retry without reposting text.
• Add private owner notification failure details and safe retries; lazy-load review modules with WordPress translations.
• Keep stable identifiers and the short CommentMate menu label; expand the display name.

1.0.3

• Add private review downloads, confirmed owner transfer/missing-owner recovery, feedback usage and bounded storage controls.
• Add first-review and full-backup guidance; retain PHP 8.1 compatibility with supported-hosting advice.
• Use WordPress-managed screen assets, correct file-feature requirements, refresh dependencies and prepare all interface text for translations.

1.0.2

• Restrict approval and reopening to the owner; reviewers can edit or delete their own comments from the popup.
• Add inline display-name editing and refine review/notification guidance and completion-button styling.

1.0.1

• Correct the notification introduction to distinguish completion notifications from optional automatic alerts.
• Align Keep review data and Delete review data with consistent spacing and wrapping; retain safe defaults and confirmation.

1.0.0

• Added optional confirmed cleanup after Stop sharing, bound to the stopped review.
• Preserved saved original and compressed Media Library images during cleanup.
• Added public source/build files and directory packaging; removed the external updater.
• Corrected PHP 8.1 return-type compatibility.

0.1.15

• Added owner commenting and improved narrow-sidebar controls and text copying.

0.1.14

• Added compressed image saving/downloads and Done! Notify Admin.

0.1.13

• Improved review setup and exit controls.