Draft2Live Connect
| 开发者 | draft2live |
|---|---|
| 更新时间 | 2026年5月26日 16:06 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 6.9 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Draft2Live Connect is the official bridge between your WordPress site and Draft2Live, an AI content generation platform that helps you research, plan, write and publish long-form SEO articles at scale.
Once the plugin is installed and your site is paired with your Draft2Live account, you can:
- Publish articles generated in Draft2Live straight to WordPress without leaving the dashboard
- Keep content in sync both ways — edits made in WordPress flow back to Draft2Live automatically
- Assign categories, tags, featured images and authors at publish time
- Schedule publications for a future date (handled by Draft2Live's unified scheduler, so it works exactly the same for WordPress and Drupal)
- Publish multilingual content and link translations automatically if your site uses Polylang or WPML
- Write SEO meta title / meta description / focus keyword through Yoast SEO or Rank Math when one of them is active
安装:
- From your WordPress admin, go to Plugins → Add New, search for "Draft2Live Connect" and click Install Now, then Activate. (Or upload the
draft2live-connectfolder to/wp-content/plugins/manually.) - Go to Settings → Draft2Live.
- Click Connect to Draft2Live. You'll be redirected to the standard WordPress Application Password approval screen — review it and click Yes, I approve.
- That's it. The site is now paired. You can start publishing from your Draft2Live dashboard.
屏幕截图:
常见问题:
Is the plugin free?
Yes. The plugin is 100% free and open source under the GPL v2 license. A Draft2Live account is required to generate content, and Draft2Live itself offers a free tier so you can try the full workflow end-to-end at no cost.
What data does the plugin send to Draft2Live?
Only the data needed to keep your articles in sync:
- When you publish from Draft2Live, the article content (title, HTML body, featured image, categories, tags) is received by this plugin from Draft2Live and saved as a normal WordPress post.
- When you edit, trash, untrash or delete a post that originated from Draft2Live, the plugin sends a webhook to Draft2Live with the post ID, title, new status and modification timestamp so Draft2Live's copy stays consistent. No personal information or visitor data is transmitted.
- All webhooks are signed with an HMAC-SHA256 signature using a secret that is generated during pairing and stored only on your site and on your Draft2Live account.
Do I need a Draft2Live account?
Yes — the plugin is the WordPress side of the Draft2Live platform. You can create a free account at draft2live.ai.
How do I disconnect my site?
The safest way is to go to Users → Profile → Application Passwords and revoke the "Draft2Live" entry. You can also deactivate and delete the plugin from Plugins. Both methods immediately stop all further communication with Draft2Live.
Does the plugin support Polylang or WPML?
Yes. If either plugin is active, Draft2Live will detect it automatically during site verification and offer you multilingual publishing: you can generate one article in multiple languages and publish them all in one click, linked as translations of each other. Cross-language linking uses the Polylang REST API or the WPML language field depending on which plugin is installed.
Does the plugin support Yoast SEO or Rank Math?
Yes. If Yoast SEO or Rank Math is active, the plugin detects it and Draft2Live will push a meta title, meta description and focus keyword to the appropriate post meta fields when you publish. If neither plugin is active, only standard WordPress post fields are written.
Can I use a custom post type?
Yes. The plugin supports publishing to any registered public post type, not just posts and pages.
Does two-way sync run on every save?
Only for posts that originated from Draft2Live (identified by a hidden post meta field the plugin writes on import). Posts you created manually in WordPress are never touched by the sync.
更新日志:
1.2.7
- Security: hardened remote image/video fetching against Server-Side Request Forgery (SSRF). User-supplied
featured_image_url(and other media URLs) are now validated with strict, defense-in-depth checks before download: HTTP/HTTPS only, the host is DNS-resolved and every resulting IP must be publicly routable (loopback, private, link-local, the 169.254.169.254 cloud-metadata address, CGNAT and reserved ranges are blocked), each redirect hop is re-validated, and the downloaded file is capped in size and confirmed to be an image/video by MIME type. Replaces the previouswp_http_validate_url()-only check.
- Re-publishing a previously unpublished article from Draft2Live now uses a dedicated
POST /draft2live/v1/posts/{id}/republishendpoint that simply flips the post status back topublish. The original slug, categories, tags, author and any edits made on the WordPress side are left untouched, and the unpublish → re-publish cycle no longer occasionally creates duplicate posts.
- Cleanup: orphan CSS fragments left in the body from earlier inline-FAQ releases (
<p>.draft2live-faq { … }, bare.faq-section { … }rules, legacy.faq-sectionwrappers, etc.) are now stripped automatically on every publish and update, so articles that already had leaking FAQ styles in their content get cleaned up the next time Draft2Live syncs them.
- FAQ block is now rendered server-side by the plugin via WordPress's
the_contentfilter using the bundled stylesheet — the HTML and styles no longer have to be injected intopost_contentfrom Draft2Live. Fixes the long-standing issue where<style>tags occasionally leaked into the article body as plain CSS text afterwp_kses/wptexturizeprocessed the content, and lets the user safely edit the article in WordPress without breaking the FAQ block. Localised FAQ heading (UK/EN/RU/PL/DE/FR/ES/IT/PT/NL — falls back to English).
- Featured image attachments are now saved with an SEO-friendly filename derived from the article title (transliterated for non-Latin languages) instead of the opaque storage filename Draft2Live used to send.
- Alt text on the featured image attachment is set to the article title automatically — different per language when multilingual translations are published — so screen readers and Google Images get a meaningful caption.
- Both the publish and update endpoints honour the new optional payload fields
featured_image_filenameandfeatured_image_altsent by Draft2Live; if absent, the plugin falls back to the previous behaviour.
- Fix: changing only the featured image on the WordPress side now propagates back to Draft2Live. The post's thumbnail id is part of the sync-loop hash, so a featured-image swap actually trips the on_post_save webhook (previously the unchanged title/content/status fooled the dedup into skipping the notification).
- Webhooks back to Draft2Live now also carry the post excerpt, the SEO meta description (Yoast / Rank Math / AIOSEO), the featured image URL, the post tags and the categories. Edits to any of these on the WordPress side now propagate back to the Draft2Live editor instead of getting silently dropped.
- Branded "update available" banner shown on every WordPress admin page (with the Draft2Live logo and an "Install update" button) so the admin spots the new version without going to Plugins → Updates.
- After WordPress finishes upgrading the plugin, the site sends a one-shot fire-and-forget notification to draft2live.ai so the platform admins can see the rollout reach real sites (used internally for monitoring; payload is just site URL + old/new version).
- Internal release pipeline test - no functional changes.
- Featured image can now be replaced (or removed) on the existing post via the update endpoint, not just at create time. Pass
featured_image_urlin the update payload — a non-empty URL replaces the thumbnail, an empty string clears it, omitting the key leaves the current thumbnail untouched.
- Fixed: status changes made in WordPress (e.g. publish → draft via Quick Edit) now reliably sync back to Draft2Live. Previously the first edit after a Draft2Live publish was swallowed by an over-eager sync-loop guard. The guard is now content-hash based and only suppresses WordPress's own internal save during plugin-driven updates.
- Strengthened REST API permissions:
/draft2live-postsnow requiresedit_others_posts,/posts/{id}/exportuses per-post permission check. - Removed
load_plugin_textdomain()— WordPress.org handles translations automatically since 4.6. - Updated plugin URL references.
- New
GET /wp-json/draft2live/v1/draft2live-postsendpoint that returns every WP post which originated from Draft2Live (has the_draft2live_article_idpostmeta). Used by the Draft2Live dashboard to re-link existing publications after a site has been disconnected and re-paired.
- Tidies the native WordPress Application Password approval screen when the application being authorized is Draft2Live: hides the long redirect-URL preview lines (which overflow on small windows) and puts the Approve / Deny buttons on a single row. Other plugins that use Application Passwords are not affected — the styles are gated to apps named "Draft2Live".
- Cleaner settings page: removed the right-hand sidebar (Application Passwords / Help links) since the disconnect card and the rest of the page already cover everything important.
- New "Disconnect from Draft2Live" button on the plugin settings page so the user can clear the local pairing state without going to Draft2Live.
- Added a Settings link to the plugin row on the Plugins → Installed Plugins screen.
- Added
/wp-json/draft2live/v1/disconnectREST endpoint so Draft2Live can clear the plugin's local pairing state when the user removes the site from their Draft2Live account. Without this, the plugin kept showing as connected after the matching site was deleted on the Draft2Live side.
- First public release on WordPress.org.
- Security hardening: tightened REST API permission callbacks per-route (read / publish / edit_post / delete_post / admin), per-post capability checks for update, delete and restore endpoints.
- Security: SSRF guard on remote media downloads — non-HTTP schemes and private/reserved IP ranges are rejected via
wp_http_validate_url(). - Security:
post_statusvalues are now whitelisted againstdraft,pending,publish,future,private. - Security: Schema.org JSON-LD output re-encoded with
JSON_HEX_*flags so stored content can't break out of the<script>block. - Bug fix: the two-way sync hooks were never firing because the
post_typedefault was missing from the settings defaults. Sync now works out of the box. - Yoast SEO meta fields are only written when Yoast is actually active.
- Added
.potfile in/languages/so the plugin is fully translatable. - Replaced Unicode icon glyph with a Dashicon.
- Moved inline admin CSS into the enqueued stylesheet.
- Bumped
Tested up toto 6.9.
- One-click pairing via the WordPress native Application Password authorize flow.
- New
/setupREST endpoint that Draft2Live calls at the end of the pairing handshake to push the site_id and webhook_secret automatically. - Hid the legacy Site ID / Webhook Secret / API URL form fields from the admin screen — these are now managed automatically by the pairing flow.
- Admin page now shows a single hero "Connect to Draft2Live" button.
- Initial version, distributed as a direct download from draft2live.ai.
- Publishing from Draft2Live to WordPress (title, content, featured image, categories, tags, FAQ).
- Two-way synchronization: edits in WordPress flow back to Draft2Live via signed webhooks.
- Settings page under Settings → Draft2Live.
- REST API endpoints under
/wp-json/draft2live/v1/.