Proofing Pins
| 开发者 |
lovedeep5
punjabideveloper |
|---|---|
| 更新时间 | 2026年5月31日 15:32 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Proofing Pins lets clients and reviewers click anywhere on your site's frontend to drop a comment pinned to that exact spot. Each pin is captured with a viewport screenshot so developers see what the reviewer saw. All comments live in a focused Proofing dashboard in wp-admin — no more "the button under the banner thing" emails.
Watch the 2-minute tutorial:
https://www.youtube.com/watch?v=8UJX0GmM79k
Core features
- Pin-point comments: reviewers click, type, submit — pin is saved with a screenshot that has the pin baked into the image at the click location.
- Modern capture: uses the html-to-image library (SVG foreignObject renderer) for reliable screenshots even on Elementor or block-theme pages.
- Responsive anchoring: pins are stored against the clicked element (selector + percentage-within-element), so they follow the element across viewport sizes.
- Threaded replies: native WordPress comments attached to each pin for discussion between reviewers and developers.
- Admin dashboard: list + grid views, status workflow (Open / In Progress / Resolved / Archived), bulk actions.
- Guest comments: optional — let logged-out visitors leave pins with a one-time name/email prompt (cookie-remembered for 30 days), with honeypot + per-IP rate limiting.
- AI suggestions (optional, BYO key): bring your own OpenAI, Anthropic, Google Gemini, or OpenRouter API key. Each pin gets a one-paragraph suggestion on what to change.
- Elementor-aware Apply button: when the AI proposes an allowlisted change (heading text, button text, color), a before/after preview appears with an "Apply to Elementor" button. Applies the change to the live page, saves a WordPress revision, one-click revert available.
- Microsoft Teams notifications (optional): post pin activity directly to a Teams channel using a Workflow webhook. Pick which events you want — new pins, replies, and per-status transitions (Open / In Progress / Resolved / Archived). Each notification is an Adaptive Card with the comment, author, page, status, and (where small enough) the screenshot. Webhook URL is stored encrypted at rest; one-click "Send test message" verifies the wire.
- Generic webhook notifications (optional): post the same pin activity as plain JSON to any HTTPS endpoint of your choice. Works with Zapier, n8n, Make, Power Automate, IFTTT, or any custom HTTP receiver. Each
pin_createdpayload includes the screenshot URL, so downstream tools (image search, OCR, Trello cards, etc.) can attach the visual right away. Same encryption + test-message verification as the Teams integration.
- The plugin does not send any data to third parties by default.
- The AI feature is opt-in. You provide your own API key; requests go directly from your WordPress server to the provider you configure (OpenAI, Anthropic, Google, or OpenRouter). No data is sent to the plugin author. When enabled, each new pin's comment text, captured element HTML, and metadata are sent to the configured provider so it can generate a suggestion — consult your provider's privacy policy.
- The Microsoft Teams integration is opt-in. You provide your own Teams Workflow webhook URL; notifications are posted directly from your WordPress server to that webhook (typically a Microsoft-hosted Azure Logic Apps endpoint). No data is sent to the plugin author. Payloads include the pin comment, author name, page URL, status, and a heavily compressed thumbnail when one fits — see "External Services" below for the exact contract.
- The Generic Webhook integration is opt-in. You provide your own HTTPS endpoint; JSON payloads are posted directly from your WordPress server to that endpoint. The destination is entirely controlled by you; the plugin contacts no specific third-party service for this feature. No data is sent to the plugin author. Payloads include the pin comment, author name, author email (when available), page URL, status, and the screenshot URL — see "External Services" for the exact contract.
- Screenshots are stored locally in your WordPress uploads folder — never uploaded elsewhere.
- Guest identities (name + email) are stored in a cookie (
proopin_guest_identity) for 30 days only on the visitor's own browser. - When guest commenting is enabled, the plugin stores a short hash of each guest submitter's IP address (first 16 characters of the MD5 hash) for the sole purpose of rate-limiting abusive submissions. Raw IP addresses are never stored.
安装:
- Upload the
proofing-pinsfolder to/wp-content/plugins/or install through the WordPress Plugins screen. - Activate the plugin through the Plugins screen in WordPress.
- Visit Proofing → Settings to configure the floating-button position, brand color, and guest-comments toggle.
- (Optional) Visit Proofing → AI Integration to enable AI suggestions — enter your provider API key and pick a model.
- (Optional) Visit Proofing → Integrations → Microsoft Teams to enable Teams notifications — paste your Workflow webhook URL and pick which events you want.
- (Optional) Visit Proofing → Integrations → Webhook to enable generic webhook notifications — paste any HTTPS endpoint URL (Zapier / n8n / Make / Power Automate / IFTTT / custom) and pick which events you want.
屏幕截图:
常见问题:
Does this work with Elementor?
Yes. The plugin detects Elementor widgets, links directly to them in the editor, and (when AI is configured) can propose and 1-click apply text / color changes to heading, button, and text-editor widgets.
Does it work with block themes?
Yes. Pin capture and rendering work with Twenty Twenty-Four / Twenty Twenty-Five and other block themes.
Do I need an AI subscription?
No. AI suggestions are entirely optional. The pin-and-comment workflow works without them.
Who can leave pins?
By default, any logged-in user with the proopin_create_pin capability. You can enable guest pins in Settings; guests see a one-time name/email prompt before posting.
How are API keys stored?
Encrypted at rest with AES-256-CBC using a key derived from AUTH_KEY. The stored setting row is non-autoloaded. The raw key is never returned by the REST API — only a masked preview.
更新日志:
0.1.3
- New: Generic Webhook integration. Posts the same pin events as the Teams integration, but as plain JSON to any HTTPS endpoint (Zapier, n8n, Make, Power Automate, IFTTT, or custom receivers).
pin_createdpayloads include the screenshot URL. Opt-in, off by default; URL stored encrypted at rest; per-event toggles; one-click "Send test message". - Change: AI Integration and Teams Integration are no longer separate submenus. They now live as tabs under a single Proofing → Integrations page, alongside the new Webhook tab. Existing settings carry over untouched.
- New: "Report a bug" link in the dashboard header (opens the plugin's GitHub Issues tracker in a new tab) so users can flag problems without leaving wp-admin.
- Polish: refreshed the admin UI on the Integrations and Settings screens — modern underline tabs, more generous spacing under the tab nav, refined card shadows, modern form-field styling with proper focus rings, and a lifted page heading. No HTML structure changes; existing layouts unchanged.
- New: tutorial video link in the admin dashboard header (opens on YouTube in a new tab) so first-time users can find the walkthrough without leaving wp-admin.
- New: tutorial video auto-embedded on the WordPress.org plugin listing page.
- New: Microsoft Teams integration. Post pin activity (new pin, replies, status changes) to a Teams channel via a Workflow webhook. Opt-in, off by default; webhook URL stored encrypted at rest; per-event toggles; one-click "Send test message".
- Security: tighten REST API permission callbacks.
GET /pins/{id}now requires the caller to be a manager or the pin's author;GET /pinsrequires non-managers to scope the listing to a singlepage_urland never returns archived pins to non-managers;POST /pins/{id}/repliesis restricted to logged-in users with the create capability (guests can no longer reply). - Security: apply identical honeypot + per-IP rate-limit + identity sanitization to any guest-driven write request.
- Security: guest rate-limit no longer trusts client-supplied
X-Forwarded-For(spoofable — would let attackers bypass rate-limits and inflatewp_optionswith throw-away transient rows). OnlyREMOTE_ADDRis used by default; sites behind a trusted reverse proxy can hook the newproofingpins_guest_ipfilter to use their proxy's real-client-IP header. - Cleanup: deleting a pin now also clears any pending AI-suggestion cron event scheduled for that pin (no more orphan cron rows).
- Cleanup: uninstall now also clears pending AI cron events and sweeps the plugin's transients (per-IP rate-limit + cached provider model lists), in addition to deleting pin posts, screenshots, thumbnails, replies, settings, and capabilities.
- Rename: all internal identifiers (option names, capabilities, post type, post statuses, post meta keys, transients, comment type, script handles, JS globals, CSS classes, cookies, query parameters) migrated from the
pp_/pp-/PP_prefix to the longerproopin_/proopin-/PROOPIN_prefix to satisfy the WordPress.org 4-character-minimum prefix requirement and prevent collisions with other plugins.
- Initial release.
- Pin capture via html-to-image with element-anchored responsive positioning.
- Admin dashboard (list/grid), status workflow, bulk actions.
- Guest comments with identity cookie + rate limit + honeypot.
- AI suggestions (OpenAI / Anthropic / Gemini / OpenRouter) with dynamic model discovery.
- Elementor-aware suggestions and 1-click Apply / Revert for allowlisted widget settings.