Secure Draft Preview Links
| 开发者 | savedprompt |
|---|---|
| 更新时间 | 2026年5月27日 19:02 |
| PHP版本: | 8.0 及以上 |
| WordPress版本: | 6.9 |
| 版权: | GPL-2.0-or-later |
| 版权网址: | 版权信息 |
详情介绍:
Secure Draft Preview Links lets you generate a cryptographically secure, unguessable link for any draft post so that people without a WordPress account can read it before it goes live.
How it works
- Open any draft post or page in the editor.
- Check Enable public preview in the Publish panel (Classic Editor) or Status & Visibility panel (Block Editor).
- Copy the generated link and share it with anyone.
- The recipient can view the draft without logging in.
- Uncheck the box or set the expiry to Expired to revoke access immediately.
- Works with both the Classic Editor and the Block Editor (Gutenberg).
- Checkbox to enable / disable preview — shown even on auto-draft posts (disabled with a "save first" hint).
- When a post is published the checkbox automatically disables and shows "Not available for published posts".
- Preview URL displayed in a monospace code box — horizontally scrollable, click to select all.
- Copy button and Open preview button inline with the URL box.
- Generate new link button — invalidates the old link immediately, with a confirmation step before firing.
- Stop sharing confirmation bar — shown when unchecking the checkbox, requires explicit confirmation before removing the link.
- Expiry selector with four options:
- 48 hours — default, shows exact time remaining (e.g. "Expires on: Apr 29 · 14:32 (4h 12m remaining)").
- Always available — link never expires.
- Custom time — set Days, Hours, and Minutes; live "Expires on:" display updates as you type; shows error if all fields are cleared without saving.
- Expired (disable now) — immediately invalidates the link without deleting the token.
- Expiry settings auto-save on change with a "Expiry setting saved." confirmation message.
- Block Editor: snackbar notices for every action (enable, disable, copy, generate new link).
- Block Editor: Open public preview item added to the Preview dropdown (WordPress 6.7+).
- Dedicated Preview Links menu item in the WordPress admin sidebar.
- Two tabs: Active and Expired, each showing a count badge.
- Paginated table — 20 items per page, with top and bottom pagination controls.
- Per-row columns: Post title, Post type, Exact expiry time, Preview URL, Share buttons, Actions.
- Copy URL and Open preview icon buttons inline with the URL.
- Share buttons: Facebook, X (Twitter), LinkedIn, Email — captions include the post title and expiry time (omitted for never-expires links).
- Regenerate button — generates a new token with a confirmation dialog; old link stops working immediately.
- Stop Sharing button — removes the token with a confirmation dialog.
- Edit Post link opens in a new tab.
- Confirmation dialogs use an inline modal (no browser
confirm()) with clear messaging about consequences. - Toast notifications slide up from the bottom-right on every action.
- Tokens are 64-character cryptographically random hex strings generated with
random_bytes(). - Token validation uses
hash_equals()to prevent timing attacks. - Expired links return a 410 Gone HTTP response.
- Invalid tokens return a 403 Forbidden HTTP response.
- Preview link is automatically removed when a post is published, made private, or trashed.
- All AJAX endpoints are protected with nonces and capability checks.
- No data is exposed to unauthenticated users beyond the post content itself.
- Public Preview badge shown next to post titles that have an active preview link.
- Public Preview filter view in the post list table to quickly find all posts with active links.
- Works with all viewable public post types (posts, pages, and custom post types).
- Pagination links on multi-page posts are rewritten to include the preview token.
- Token meta is registered with the REST API for block editor compatibility.
- No external dependencies — pure PHP, jQuery (Classic Editor), and WordPress's own React/wp-components (Block Editor).
安装:
- Upload the
secure-draft-preview-linksfolder to/wp-content/plugins/. - Activate the plugin through the Plugins screen in WordPress.
- Open any draft post or page in the editor.
屏幕截图:
常见问题:
Does this work for custom post types?
Yes. The panel appears on all viewable public post types automatically.
What happens when the link expires?
Visitors see a "Preview Link Expired" page with a 410 HTTP status. The token remains stored so you can see it in the Preview Links page, but it no longer grants access.
Can I share the link with multiple people?
Yes — the link is not tied to any specific user or session.
What happens when the post is published?
The preview token is automatically deleted and visitors are redirected to the live permalink.
Is the preview link secure?
Yes. Each token is a 64-character cryptographically random hex string generated with random_bytes(). It is validated using hash_equals() to prevent timing attacks.
Can I set a custom expiry time?
Yes. Choose Custom time from the expiry dropdown and enter Days, Hours, and Minutes. The link will stop working after that duration. You can also choose Always available for a link that never expires.
How do I revoke access immediately?
Either uncheck Enable public preview (and confirm in the dialog), or select Expired (disable now) from the expiry dropdown. Both invalidate the link instantly.
Can I regenerate the link without disabling it?
Yes. Click Generate new link — after confirming, a new token is created and the old link stops working immediately. The expiry settings are preserved.
Where can I see all my preview links?
Go to Preview Links in the WordPress admin sidebar. It shows all active and expired links across all post types, with share buttons and management actions.
更新日志:
1.0.0
- Initial release.
- Secure token generation using
random_bytes()withhash_equals()validation. - Works with Classic Editor and Block Editor (Gutenberg).
- Custom expiry: 48 hours (default), always available, custom Days/Hours/Minutes, or expire immediately.
- Live "Expires on:" display with exact time remaining.
- Regenerate and stop-sharing actions with inline confirmation dialogs.
- Preview Links admin page with Active/Expired tabs, pagination, and social share buttons (Facebook, X, LinkedIn, Email).
- Auto-removal on publish, private, or trash.
- "Public Preview" badge and filter view in the post list table.
- Pagination support for multi-page posts.
- Block Editor: snackbar notices, Preview dropdown menu item (WP 6.7+).
- Disabled state with contextual hints for published posts and unsaved drafts.