Mapsemble

From your Mapsemble account. Styling, clustering, filters and layout are configured in the Mapsemble map builder. This plugin decides only where the locations come from, and renders the content cards when they come from this site.

Editors, by default. Maintaining locations is content work, so it has its own capability (edit_mapsemble_map_data) that the administrative ones deliberately do not imply — the person adding locations does not need the screen holding your API credentials. Administrators hold both.

Yes. Copy templates/card.php from the plugin into your theme as mapsemble/card.php and adjust it. Developers can also use the mapsemble_card_html, mapsemble_card_css_urls and mapsemble_card_data filters.

Yes. Choose the "Custom fields (latitude/longitude meta keys)" location source and name the two meta keys — that covers Metabox.io, Pods, imported data and hand-rolled meta. An ACF Google Map field has its own named source. For computed cases, the mapsemble_post_coordinates filter remains. After switching sources, run "Reindex locations" on the map.

Yes. The widget's interface strings ("Filters", "Search", "Sort by", …) run through the plugin's mapsemble text domain, so a .po file for your language translates them; English sites send nothing extra. Developers can add or override strings with the mapsemble_widget_translations filter.

A map whose locations live in Mapsemble works on a local site with no extra setup: nothing on the Mapsemble side ever fetches from your server. A map built from this site's content does not, because the Mapsemble service has to reach your feed. Expose the site through a tunnel and define MAPSEMBLE_REMOTE_BASE_URL in wp-config.php; the plugin then hands Mapsemble that address instead of your local one. Two more constants exist for people running the Mapsemble service itself locally. MAPSEMBLE_APP_BASE points the plugin at another Mapsemble host; TLS is still verified against it. MAPSEMBLE_SSL_VERIFY set to false switches that verification off — define it only for a local stack whose certificate the WordPress container does not trust, never on a public site. The sample map is the exception: it always loads from app.mapsemble.com whatever MAPSEMBLE_APP_BASE says. A stack that publishes its own copy can point it elsewhere with the mapsemble_sample_app_base filter.

Yes — define MAPSEMBLE_CLIENT_ID and MAPSEMBLE_CLIENT_SECRET in wp-config.php and the settings fields become read-only. One caveat: credentials set that way never pass through the settings form, which is what normally clears the cached access token and plan details. After changing them, delete the mapsemble_token, mapsemble_token_failed, mapsemble_remote_maps, mapsemble_feature_flags and mapsemble_backoff transients — from code, \Mapsemble\Api\Client::forget_account_caches() drops exactly that set, as the settings form and the connect flow do — or the plugin keeps answering for the previous account for up to fifteen minutes.

The feed is a standard WordPress meta query and is comfortable up to roughly ten thousand geo-tagged posts. Beyond that, use a persistent object cache. The entropy sort option additionally needs MySQL 8 or MariaDB 10.2 for its window function; on older databases it degrades to a stable per-map random order. The filter option pickers group over meta values, capped at ten options per lookup.

For site-fed maps only: mapsemble/v1/features (the GeoJSON feed), mapsemble/v1/feature (one rendered card) and mapsemble/v1/filter/options (values for a mapped filter). All serve published, geo-tagged content that the map's own conditions admit — a post excluded by an always-on filter answers 404 exactly like a missing one. Maps whose locations live in Mapsemble answer 404 on all three. Responses carry Cache-Control: public, max-age=60 and an ETag; the cache is refreshed when a served post, its terms, or the map's settings change, and developers can tune or disable it with the mapsemble_feed_cache_ttl filter.

The editor shows a chosen map live in a frame served by this site to a request that carries no login cookie — the block editor isolates itself in Chromium browsers, and the frame's request goes out without cookies. Anything that turns such requests away before WordPress parses them keeps the preview out: a maintenance or "members only" plugin that redirects logged-out visitors on init, or HTTP basic auth in front of a staging site. The published page is unaffected; the map still renders there.