WPGraft – Copy any web page into your page builder

Description

wpgraft copies a section of any public web page and rebuilds it inside your own
page builder — Elementor, the block editor (Gutenberg), Divi, Bricks, Beaver
Builder, Breakdance or Oxygen — not as an embedded screenshot, not as a block of
pasted HTML, but as the builder’s own elements, with the styles written into the
builder’s own fields. Once it lands you edit it the way you edit anything else
you built by hand.

This plugin is the WordPress half of that. The copying happens in the wpgraft
browser extension; this plugin receives the result, shows it in a panel inside
the editor, inserts it into the page you have open, and pulls the images it needs into
your Media Library.

Supported editors

• Block editor (WordPress core)
• Elementor — both the classic (v3) and the atomic (v4) document models
• Bricks
• Divi 5
• Beaver Builder
• Breakdance
• Oxygen 6 and Oxygen Classic

What the plugin itself does

• Adds a wpgraft panel inside the editor listing sections waiting to be inserted.
• Inserts a section into the open document using each builder’s own data
  structures, so the result is editable natively — no shortcode, no iframe, no
  “do not edit this block” wrapper.
• Imports the images a section needs into the Media Library and rewrites the
  references to point at your own copies, so the layout does not break when the
  source site changes.
• Loads a copied page’s typeface from Google Fonts by name (or the closest Google
  font when the original is not there) instead of copying the source site’s font
  files. The exceptions are fonts the copy itself embeds: icon fonts, and the
  embedded faces of a block-editor copy, which are stored in your uploads.
• Registers REST routes under wpgraft/v1, each one gated on both a capability
  check and the wp_rest nonce.

What it will never insert

The plugin has no code editor, no CSS box and no field where anyone types code.
What arrives is a page description the conversion service produced; before any
of it is stored the plugin removes every script element, event-handler
attribute and PHP open tag, and empties every JavaScript field a builder element
may have. Every stylesheet in it is parsed and rebuilt from an allowlist: a
declaration is kept only when its property is a standard CSS property and its
value is made of standard CSS values and functions, a selector only when it is
made of selector syntax, an at-rule only when it is one of a short list
(@media, @supports, @font-face, @keyframes, …), and url() only for
http(s), image and font addresses. Everything else is dropped and reported, and
no markup character survives in a stored stylesheet. That happens for every
user, administrators included, because the content was copied off somebody
else’s page. On top of that, page-level CSS is only stored
for users who hold edit_css or unfiltered_html — the capability WordPress
itself requires for Additional CSS — and raw-HTML builder elements are only
kept for users who hold unfiltered_html; everyone else gets the section with
those parts removed and a warning saying so. Styles are written into each
builder’s own fields, so you edit them where you edit everything else.

What it does not do

No account to connect here, no licence key, no options page to fill in — the
settings screen is a status readout and nothing else. Nothing in this plugin is
metered, counted, time-limited or held back for a paid plan: there is no licence
check anywhere in the code, no usage counter and no upgrade prompt. It inserts
whatever the extension hands it, on any site, for as long as you keep it
installed. It reads no visitor data and writes nothing to your pages that you
did not insert yourself. What it stores: the queue of sections waiting to be
inserted (per user, removed on insert or discard), the images and embedded
fonts a copy brings (Media Library and uploads), and the styling of inserted
copies in post meta and the builder’s own settings.

Requires a paid wpgraft plan (an external service)

This plugin is free software and always will be, but on its own it does nothing:
sections reach it from the wpgraft browser extension, and the extension converts
a captured page through the wpgraft conversion service. That service is paid:
copying requires a wpgraft account with a paid plan — Pro monthly, Pro yearly or
Lifetime. There is no free tier and no trial. Plans and prices are at
https://wpgraft.com/#pricing. The plan is checked there — in the browser
extension and on our server, before anything reaches WordPress — never by this
plugin. See the section below for exactly what is sent where.

Not affiliated with Elementor, Bricks, Elegant Themes (Divi), Beaver
Builder, Soflyy (Oxygen, Breakdance) or any other builder vendor. Those names
appear here to describe compatibility, and they belong to their owners.

Bundled resources. The plugin ships the Cooper Hewitt typeface
(assets/fonts/), used only for the wordmark on its own settings screen, under
the SIL Open Font License 1.1 — the full text is in
assets/fonts/LICENSE-OFL.txt. Everything else in the plugin is GPLv2 or later.

External services

This plugin is a companion to the wpgraft browser extension and the wpgraft
conversion service, operated by wpgraft (https://wpgraft.com).

1. The wpgraft conversion service — used by the extension, not by this plugin.
When you copy a section, the browser extension sends the captured HTML and CSS
of the page you chose to https://wpgraft.com/api/convert, together with your
account token, and receives the builder document that this plugin then inserts.
That request is made by the extension in your browser. This plugin does not make
it and does not hold your account credentials. Sections picked in the wpgraft
section Library (https://wpgraft.com/library) arrive the same way, through the
extension. The service is paid: it converts only for accounts with a paid
wpgraft plan (Pro monthly, Pro yearly or Lifetime); there is no free tier.

• Plans and prices: https://wpgraft.com/#pricing

• Terms: https://wpgraft.com/terms

• Privacy policy: https://wpgraft.com/privacy

2. Downloading the assets a copied section uses. When a section references
images, your WordPress site downloads them from the URLs the
capture recorded — usually the site you copied from — and stores them in your
Media Library. That traffic goes from your server to that site directly; it
does not pass through wpgraft. Only users who can already upload files can
trigger it. A file is accepted by its own bytes, not its name: raster images,
web fonts, and SVG — every SVG is rebuilt by a sanitizer that removes scripts,
event handlers and external references before it is stored. An image that is
not imported (the import was switched off, or it failed) keeps its original
address, so your visitors’ browsers load it from the site it was copied from.

3. The quality rating — only if you fill it in and press the button. After a
copy is inserted, the panel asks how it turned out: a score from 1 to 5, an
optional comment, and a tick-box that decides whether the copy itself is sent
back to wpgraft so the fault can be reproduced and fixed. Pressing the button
sends the score, the comment, the tick, your site’s HOSTNAME and this plugin’s
version to https://wpgraft.com/api/feedback, from your browser, using a
single-use ticket that came with the copy. No account credential of yours and no
WordPress credential is involved, and the request carries no cookie. The
tick-box is ticked by default and the button says what will be sent (“Send
rating & copy” or “Send rating only”). The reply is a short thank-you message,
and for a 5 it may carry a link to leave a review.

Nothing is sent unless you press that button. Dismissing the card sends nothing.
Unticking the box sends the score and the comment and no page content at all.
The HTML and CSS of the copy do not come from your site — this plugin never had
them — they are uploaded separately by the browser extension, from the account
that made the copy, and only for ratings you consented to.

• Terms: https://wpgraft.com/terms
• Privacy policy, section 5.10: https://wpgraft.com/privacy#what-we-collect

4. Google Fonts, for the typeface a copied page uses. When a copy names a
font, the page it was inserted into links a stylesheet from
https://fonts.googleapis.com, so your visitors’ browsers load that font from
Google. Only Google Fonts URLs are accepted. A site that wants no third-party
requests can drop them with the wpgraft_capture_font_links filter.

• Google Fonts terms: https://developers.google.com/fonts/terms
• Google Fonts privacy: https://developers.google.com/fonts/faq/privacy
• Google privacy policy: https://policies.google.com/privacy

This build of the plugin’s PHP contacts wpgraft.com for nothing at all —
updates come from WordPress.org like any other plugin here, and your server
makes no request to us. The one request above is made by your browser, from the
editor screen, when you press the button on the rating card.