GMB Poster
| 开发者 | defyndigital |
|---|---|
| 更新时间 | 2026年6月3日 09:11 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
GMB Poster turns your WordPress posts into a steady stream of Google Business Profile (GBP) updates. New posts join a queue, the scheduler picks a slot from your cadence, and at slot time GMB Poster either:
- Auto-publishes the post directly to your GBP location via the official Google Business Profile API (v2.0+), or
- Prepares the caption, image and tracked link and hands it off to you for a one-click publish in the GBP web interface (the original semi-manual mode).
- Create a free Google Cloud project, enable the My Business APIs, paste your OAuth Client ID + Secret into GMB Poster Settings. (Step-by-step guide is built into the setup wizard.)
- Click Connect Google account — Google's consent screen opens, you pick the Google account that manages your GBP, click Allow.
- Pick your GBP location from the dropdown.
- Flip the Auto-publish toggle on.
AUTH_KEY constant.
Semi-manual mode (original)
If you don't want to set up a Google Cloud project, the original semi-manual handoff still works:
- New WordPress posts are added to the GMB Poster queue automatically (configurable per post type and category).
- The scheduler picks a posting slot using either time-of-day slots or a cooldown window.
- When a slot is due, the next item appears in your Dashboard widget and on the GMB Poster Queue screen.
- Click Prepare & open GBP. GMB Poster:
- copies the formatted caption to your clipboard,
- downloads the featured image to your computer,
- opens your GBP composer in a new browser tab.
- In GBP: paste the caption, drop in the image, set the call-to-action, click Publish.
- Click Mark posted back in WordPress.
- Auto-publish to Google Business Profile via the official Google API (v2.0+), with a built-in setup wizard
- Per-install OAuth 2.0 credentials — your secret + refresh token are encrypted at rest in your WordPress database
- Semi-manual mode preserved as a fallback for installs that don't want a Google Cloud project
- Custom queue with statuses: Pending → Ready → Prepared → Posted (or Skipped / Failed)
- Time-of-day slots OR cooldown-hours cadence, with optional weekend skipping
- Auto-queue on publish, filterable by post type and category
- Per-post opt-out checkbox in the editor sidebar
- Dashboard widget showing the next item ready to send
- "Publish now" / "Retry publish" buttons per row when auto-publish is on
- UTM-tagged Learn-more links (utm_source / medium / campaign configurable)
- Featured image → GBP image, title + excerpt → caption, permalink → call-to-action
- Translation-ready
安装:
- Upload the
gbposterfolder to/wp-content/plugins/or install via Plugins → Add New → Upload. - Activate GMB Poster through the Plugins screen.
- Go to GMB Poster → Settings.
- Choose your cadence (slot times or cooldown hours) and which post types or categories should auto-queue.
- (Optional — for auto-publish) Open the Google Business Profile panel at the top of Settings and follow the 4-step wizard: create a free Google Cloud project, enable the My Business APIs, generate OAuth credentials, paste them in, click Connect Google account.
- Publish a WordPress post — it appears in GMB Poster → Queue. When its slot is due, GMB Poster either auto-publishes it (if connected) or surfaces it in your Dashboard widget for the manual handoff.
屏幕截图:
常见问题:
Does this plugin post to Google Business Profile automatically?
Yes, from v2.0.0 onward — if you connect your Google account through the built-in OAuth wizard. The plugin uses the official Google Business Profile API to create the post on your behalf. If you prefer not to set up OAuth, the original semi-manual mode is still available: GMB Poster prepares the image, caption and tracked link, opens GBP in your browser, and you publish with one click.
Why do I need to set up my own Google Cloud project for auto-publish?
Google requires every application that calls the Business Profile API to use its own OAuth client credentials. We don't ship a shared client because that would mean every install of this plugin would share the same OAuth secret — a security risk and against Google's terms. The setup is a one-time, ~10-minute process and the wizard walks you through it. There are no quotas, fees or recurring costs on Google's side for this volume.
Does this plugin send any data to Google or to third parties?
Only when you've enabled auto-publish. In that mode, for each scheduled post the plugin sends to Google: the caption text, the featured-image URL, the CTA text + URL, and the post's language. The OAuth handshake itself doesn't send any post data — only your consent to act on your account's behalf. In semi-manual mode no data leaves your server; opening GBP is a normal browser navigation. Full details in the "External services" section above.
Where are my Google credentials stored?
In your WordPress options table. The OAuth Client Secret and the refresh token are encrypted at rest using AES-256-CBC with a key derived from your site's AUTH_KEY constant. They never appear in any log, REST response, or admin screen.
What WordPress fields are used?
- Featured image → the GBP post image
- Title + excerpt (or first ~1400 characters of content if no excerpt) → the GBP caption
- Permalink → the "Learn more" link, with optional UTM tags
Can I skip a specific post?
Yes — the post editor sidebar includes a "Do not send this post to GBP" checkbox.
What if I miss a slot?
Items that pass their scheduled time stay in the "Ready" status — they don't expire. You'll see them next time you open WordPress.
Does it support multisite networks?
The plugin activates per-site. Each site in the network has its own queue and settings. Network-wide activation is not specifically tested in this release.
Does it work with the block editor (Gutenberg)?
Yes. The settings meta box appears in the editor sidebar in both classic and block editors.
更新日志:
2.0.0
- Major feature: auto-publish to Google Business Profile via the official API. Connect your Google account once via the built-in OAuth 2.0 wizard, pick your GBP location, flip the toggle on. Queued posts publish themselves at their scheduled slot — no more manual paste-and-click.
- Per-install OAuth credentials: each install uses its own Google Cloud project. The plugin never embeds a shared client. Client Secret + refresh token stored encrypted at rest (AES-256-CBC, key derived from
AUTH_KEY). - 4-step in-product setup wizard with copy-able redirect URI, step-by-step Google Cloud Console screenshots, and live connection status.
- New Settings panel: connection status card, location picker, auto-publish toggle, change-location and disconnect actions.
- New queue states:
Failed(red pill, persisted Google API error message, one-click Retry). - New per-row actions: Publish now (for ready items) and Retry publish (for failed items) when auto-publish is enabled.
- New REST endpoints (all
manage_options-gated except the OAuth callback which uses a state-nonce):/oauth/credentials,/oauth/start,/oauth/callback,/oauth/disconnect,/oauth/status,/locations,/location/select,/auto-publish,/publish/{id}. - Schema migration to v2: queue table adds
google_post_idanderror_messagecolumns. Runs automatically on update viadbDelta(). - Cron tick now publishes due items in batches of 5 (soft cap) so a transient API failure doesn't fire 100 calls back-to-back.
- Hardened OAuth callback: rejects requests with missing or invalid state nonces, surfaces Google's
?error=access_deniedto the admin in a styled HTML error page instead of a confusing "missing parameter" message. - Semi-manual mode preserved as a fallback. Existing installs that haven't connected Google see the queue and dashboard widget exactly as before.
- Branding: plugin renamed from "GBPoster for Google Business Profile" to "GMB Poster" (display name only). The plugin slug, folder name, class names, database table, and option keys are unchanged — existing installs upgrade silently with no data migration.
- Updated banner artwork to match the new name.
- Feature: "Connect to Google Business Profile" wizard. New button + status pill on the Settings screen replaces the bare URL text field. Opens a 2-step modal: click to open business.google.com in a new tab, paste the URL back (via clipboard or manual paste). Backend validates the URL pattern, strips tracking parameters, and stores the canonical URL. Power users can still edit the URL directly via the toggle.
- Feature: new REST endpoint POST /gbposter/v1/connect/save (manage_options only).
- Polish: connection status pill on Settings shows the GBP location ID when one is detected in the URL.
- Compatibility: tested with WordPress 7.0; bumped Tested up to: 7.0. No code changes — full Playwright suite (16/16) and Plugin Check pass on a clean WP 7 install.
- Security: REST API permission_callbacks now perform per-resource checks. All item-by-id endpoints (/item/{id}, /item/{id}/prepared, /posted, /skipped, /reschedule) verify the current user can edit the related WP post (current_user_can('edit_post', $post_id)), not just edit_posts in general. /enqueue/{post_id} likewise. /next now walks ready items and only returns the first one the user has access to.
- REST: /gbposter/v1/item/{id} and /gbposter/v1/next responses now include
prepared_atandposted_attimestamps. Helps client code (and end-to-end tests) verify queue-item lifecycle without a second DB lookup.
- Fix: corrected the Plugin URI to point to a working URL (https://defyn.com.au/).
- Fix: text domain renamed from "gbposter" to "gbposter-for-google-business-profile" to match the plugin slug, so translations register correctly via the WordPress.org translation tools.
- Security: $_POST input on the settings save handler is now sanitized at the input boundary with map_deep( ..., 'sanitize_text_field' ) before per-field re-sanitization in GBPoster_Settings::sanitize().
- Security: queue list query() rewritten so the ORDER BY column name uses the %i identifier placeholder in $wpdb->prepare(); the order direction is interpolated only from a strict 2-value (ASC|DESC) allowlist.
- Compliance: tightened phpcs:ignore annotations on the queue list-query (NotPrepared rule).
- Compliance: prefixed all top-level variables in uninstall.php.
- Compliance: rewrote all custom-table queries to use $wpdb->prepare() with %i identifier placeholder.
- Compliance: removed unnecessary load_plugin_textdomain() (WordPress auto-loads since 4.6).
- Compliance: removed Domain Path header (no /languages folder shipped).
- Compliance: bumped Tested up to: 6.9, Requires at least: 6.2 (for %i support).
- Polish: added translators comment for sprintf placeholder.
- Fix: settings save now redirects back to the Settings screen (was landing on admin-post.php).
- Fix: in cooldown mode, the first queued item is now scheduled for "now" rather than waiting one cooldown interval.
- Fix: editor "Add to GBP queue" button now uses a REST endpoint (avoids the nested-form HTML issue inside the post editor).
- Initial release.
- Custom queue table with five-status workflow.
- Time-of-day slot scheduling and cooldown mode.
- Auto-queue on publish with post-type and category filters.
- Dashboard widget and admin Queue screen with the "Prepare next" one-click handoff.
- Per-post opt-out meta box.
- REST API endpoints for the handoff flow (require
edit_postscapability and a valid REST nonce). - UTM tagging for the "Learn more" link.