GBPoster for Google Business Profile

GBPoster turns your WordPress posts into a steady stream of Google Business Profile (GBP) updates. It builds the queue, picks slots based on your cadence, formats the caption, prepares the featured image and the tracked link — then you click once to publish in GBP. Why semi-manual? Google deprecated the Local Posts API in August 2024. Direct API posting to the GBP Updates section is no longer available for the vast majority of accounts, and the third-party tools that still "auto-post" usually do so by running headless browsers, which violates Google's Terms of Service and risks getting your profile suspended. GBPoster takes the safer path: it automates the tedious 80% (scheduling, image, caption, tracked link, queue tracking) and leaves the final ~10-second "Publish" step to you, inside the official GBP interface. How the handoff works

1. New WordPress posts are added to the GBPoster queue automatically (configurable per post type and category).
2. The scheduler picks a posting slot using either time-of-day slots or a cooldown window.
3. When a slot is due, the next item appears in your Dashboard widget and on the GBPoster Queue screen.
4. Click Prepare & open GBP. GBPoster:
5. copies the formatted caption to your clipboard,
6. downloads the featured image to your computer,
7. opens your GBP composer in a new browser tab.
8. In GBP: paste the caption, drop in the image, set the call-to-action, click Publish.
9. Click Mark posted back in WordPress.

Features

• Custom queue with statuses: Pending → Ready → Prepared → Posted (or Skipped)
• Time-of-day slots OR cooldown-hours cadence, with optional weekend skipping
• Auto-queue on publish, filterable by post type and category
• Per-post opt-out checkbox in the editor sidebar
• Dashboard widget showing the next item ready to send
• UTM-tagged Learn-more links (utm_source / medium / campaign configurable)
• Featured image → GBP image, title + excerpt → caption, permalink → call-to-action
• No external services, no API keys, no recurring subscriptions
• Translation-ready (text domain: gbposter)

Disclaimer This plugin is not affiliated with, endorsed by, or sponsored by Google LLC. "Google" and "Google Business Profile" are trademarks of Google LLC. GBPoster does not communicate with any Google API; you complete the publishing step manually inside the official GBP interface in your own browser.

1.0.6

• Security: REST API permission_callbacks now perform per-resource checks. All item-by-id endpoints (/item/{id}, /item/{id}/prepared, /posted, /skipped, /reschedule) verify the current user can edit the related WP post (current_user_can('edit_post', $post_id)), not just edit_posts in general. /enqueue/{post_id} likewise. /next now walks ready items and only returns the first one the user has access to.

1.0.5

• REST: /gbposter/v1/item/{id} and /gbposter/v1/next responses now include prepared_at and posted_at timestamps. Helps client code (and end-to-end tests) verify queue-item lifecycle without a second DB lookup.

1.0.4

• Fix: corrected the Plugin URI to point to a working URL (https://defyn.com.au/).
• Fix: text domain renamed from "gbposter" to "gbposter-for-google-business-profile" to match the plugin slug, so translations register correctly via the WordPress.org translation tools.
• Security: $_POST input on the settings save handler is now sanitized at the input boundary with map_deep( ..., 'sanitize_text_field' ) before per-field re-sanitization in GBPoster_Settings::sanitize().
• Security: queue list query() rewritten so the ORDER BY column name uses the %i identifier placeholder in $wpdb->prepare(); the order direction is interpolated only from a strict 2-value (ASC|DESC) allowlist.

1.0.3

• Compliance: tightened phpcs:ignore annotations on the queue list-query (NotPrepared rule).
• Compliance: prefixed all top-level variables in uninstall.php.

1.0.2

• Compliance: rewrote all custom-table queries to use $wpdb->prepare() with %i identifier placeholder.
• Compliance: removed unnecessary load_plugin_textdomain() (WordPress auto-loads since 4.6).
• Compliance: removed Domain Path header (no /languages folder shipped).
• Compliance: bumped Tested up to: 6.9, Requires at least: 6.2 (for %i support).
• Polish: added translators comment for sprintf placeholder.

1.0.1

• Fix: settings save now redirects back to the Settings screen (was landing on admin-post.php).
• Fix: in cooldown mode, the first queued item is now scheduled for "now" rather than waiting one cooldown interval.
• Fix: editor "Add to GBP queue" button now uses a REST endpoint (avoids the nested-form HTML issue inside the post editor).

1.0.0

• Initial release.
• Custom queue table with five-status workflow.
• Time-of-day slot scheduling and cooldown mode.
• Auto-queue on publish with post-type and category filters.
• Dashboard widget and admin Queue screen with the "Prepare next" one-click handoff.
• Per-post opt-out meta box.
• REST API endpoints for the handoff flow (require edit_posts capability and a valid REST nonce).
• UTM tagging for the "Learn more" link.