Title: HiveKit External API Page Content Author: Corrado Fiore Published: October 13, 2026 Last modified: October 13, 2026 --- Search plugins ![](https://ps.w.org/hivekit-external-api-page-content/assets/banner-772x250.png? rev=3744499) ![](https://ps.w.org/hivekit-external-api-page-content/assets/icon-256x256.png?rev =3744499) # HiveKit External API Page Content By [Corrado Fiore](https://profiles.wordpress.org/corradofiore/) [Download](https://downloads.wordpress.org/plugin/hivekit-external-api-page-content.1.3.0.zip) * [Details](https://wordpress.org/plugins/hivekit-external-api-page-content/#description) * [Reviews](https://wordpress.org/plugins/hivekit-external-api-page-content/#reviews) * [Installation](https://wordpress.org/plugins/hivekit-external-api-page-content/#installation) * [Development](https://wordpress.org/plugins/hivekit-external-api-page-content/#developers) [Support](https://wordpress.org/support/plugin/hivekit-external-api-page-content/) ## Description External API Page Content lets you create any number of configurable page-to-API mappings. No page purpose or endpoint is hard-coded. Each mapping contains: * an optional administrative label * a WordPress page * an external API URL * payload format: auto-detect, HTML, or Markdown * its own cache TTL * optional HTTP request headers, entered one per line * enabled/disabled status The endpoint must return the document directly in the HTTP response body. JSON/XML wrappers are not expected. Features: * Repeatable mappings: add or remove as many mappings as needed. * Uses the WordPress HTTP API (`wp_safe_remote_get`). * Auto-detects HTML vs Markdown, or lets you force the format per mapping. * Sanitizes output before rendering. * Caches successful responses with a configurable TTL per mapping. * Keeps the last successful API response per mapping as an outage fallback. * Falls back to the original WordPress editor content if the API has never succeeded. * Does not read PHP constants and does not store secrets, so it cannot be used to send `wp-config.php` values such as database credentials to a remote server. * Includes a per-mapping Test API button that shows the raw response payload, HTTP status, content type, size, and detected format without changing the cache. * Supports per-mapping request headers using a simple `Header-Name: value` textarea. * Offers filters for advanced request/header customization. ### Upgrading from 1.0 Version 1.1 automatically converts the old fixed-slot settings into ordinary mappings. After migration there is no special handling for any page purpose. Version 1.3.0 removed the per-mapping token constant setting. The plugin no longer reads any PHP constant, so an administrator account cannot use it to send `wp-config. php` values such as database credentials to a remote URL. If you relied on that setting, add the header with the `hivekit_eapc_request_args` filter (see Authentication below), or type it into the mapping’s Request headers field. ### Request headers Each mapping has a Request headers textarea. Enter one header per line: ``` X-API-Key: abc123 X-Tenant: customer-a Accept-Language: en ``` Header names are validated and control characters are removed from values. Malformed lines are ignored. Explicit mapping headers take precedence over the plugin’s default headers when the same header name is supplied. Header values entered here are stored in the WordPress options database, so anyone who can read the database can read them. For secrets, the filter shown under Authentication is preferable because it keeps the value in your own code. The Test API button uses the request headers currently entered in the mapping, including unsaved changes. ### Authentication The plugin does not read PHP constants and does not store secrets. It therefore cannot be used to send a value from `wp-config.php`, such as `DB_PASSWORD` or `AUTH_KEY`, to a remote server. Add an Authorization header from your own code with the `hivekit_eapc_request_args` filter, from a small site-specific plugin or your theme: ``` add_filter( 'hivekit_eapc_request_args', function( $args ) { $args['headers']['Authorization'] = 'Bearer ' . MY_CONTENT_API_TOKEN; return $args; } ); ``` The filter receives `( $request_args, $url, $page_id, $mapping_id, $mapping )`, so a token can be limited to one mapping: ``` add_filter( 'hivekit_eapc_request_args', function( $args, $url, $page_id, $mapping_id, $mapping ) { if ( 'm2' === $mapping_id ) { $args['headers']['Authorization'] = 'Bearer ' . MY_LEGAL_API_TOKEN; } return $args; }, 10, 5 ); ``` Any other header works the same way: ``` add_filter( 'hivekit_eapc_request_args', function( $args, $url, $page_id, $mapping_id, $mapping ) { if ( 'Policy API' === $mapping['label'] ) { $args['headers']['X-API-Key'] = 'replace-me'; } return $args; }, 10, 5 ); ``` The Test API button runs the same filter, so a test sends exactly the headers a real fetch would. Cached responses are not keyed by filtered arguments, so rotating a token does not by itself refresh cached content. Clear the cache after changing a token. ### Security * URLs are restricted to public HTTP/HTTPS endpoints and fetched with `wp_safe_remote_get()`. * HTML responses are sanitized using WordPress KSES rules for post content. * Markdown is converted to HTML and sanitized before display. * Script tags and other unsafe HTML are removed by default. * The plugin never reads PHP constants, so it cannot expose `wp-config.php` secrets such as database credentials or authentication salts. * Secrets are not written to the plugin settings. Values typed into a mapping’s Request headers field are stored in the site options table. If you intentionally need additional HTML tags/attributes, use the `hivekit_eapc_allowed_html` filter. ### Markdown support The bundled dependency-free Markdown renderer is intentionally small and supports the common constructs typically used in content/legal documents: * headings * paragraphs * blockquotes * horizontal rules * fenced code blocks * ordered and unordered lists * links * inline code * bold, emphasis, and strikethrough It is not a full CommonMark implementation. If your source documents depend on advanced Markdown features such as tables, nested lists, footnotes, or reference-style links, replace/extend the renderer through the `hivekit_eapc_markdown_html` filter or integrate a full Markdown parser. ### Filters ``` hivekit_eapc_should_replace_content ``` Controls whether content replacement occurs. Receives the page ID and full mapping. ``` hivekit_eapc_request_args ``` Changes WordPress HTTP request arguments before the API request. Receives URL, page ID, stable mapping ID, and full mapping. ``` hivekit_eapc_allowed_html ``` Changes the WordPress KSES allowlist for HTML responses. ``` hivekit_eapc_markdown_html ``` Changes rendered/sanitized Markdown HTML. ``` hivekit_eapc_rendered_content ``` Changes the final HTML before caching/output. Receives the stable mapping ID and full mapping. ### External requests and privacy This plugin does not send any data to the plugin author or to WordPress.org. For every enabled mapping, the plugin performs a server-side HTTP request to the exact URL entered on the settings screen and replaces the body of the mapped page with the response. You choose those endpoints, so review the privacy policy and terms of use of each API you connect before enabling a mapping. Requests use the WordPress HTTP API (`wp_safe_remote_get`) and accept only public HTTP/HTTPS URLs. Redirects are limited to 3, the response body is capped at 2 MB and the request times out after 8 seconds. ### Source code and support Development happens at https://github.com/corradofiore/wp-external-api-page-content Bug reports and feature requests are welcome there. The distributed plugin contains the same unminified source as the repository, so no build step is required to review the code. ## Screenshots [⌊The settings screen. Every mapping is configured independently: label, WordPress page, API endpoint, payload format, cache lifetime and request headers.⌉⌊The settings screen. Every mapping is configured independently: label, WordPress page, API endpoint, payload format, cache lifetime and request headers.⌉[ The settings screen. Every mapping is configured independently: label, WordPress page, API endpoint, payload format, cache lifetime and request headers. ## Installation 1. Upload and activate the plugin. 2. Go to External API Content in the admin menu. 3. Click Add mapping. 4. Select a WordPress page and enter its API URL. 5. Choose Auto-detect, HTML, or Markdown. 6. Optionally add request headers, one per line in `Header-Name: value` format. 7. Set the mapping’s cache TTL. 8. Optionally click Test API to inspect the endpoint response before saving. 9. Save settings. Repeat for as many pages as required. The original content stored in each WordPress page is not overwritten. It acts as an emergency fallback. ## FAQ ### What happens when the external API is unavailable? The last successful response for that mapping is served instead. If the API has never returned a usable response, the normal WordPress page content is shown unchanged. ### How do I authenticate to the API? Add an `Authorization` header with the `hivekit_eapc_request_args` filter, so the token stays in your own code and never reaches the database. If you instead type a header into a mapping’s Request headers field, its value is stored in the site options table. The plugin never reads PHP constants, so it cannot expose `wp-config. php` secrets. ### Does this plugin send data to the plugin author? No. Requests go only to the API URLs you configure yourself. ### Can several pages use the same API? Yes. Every mapping is independent and keeps its own cache TTL, request headers and payload format. ### Which Markdown features are supported? Headings, paragraphs, blockquotes, horizontal rules, fenced code blocks, ordered and unordered lists, links, inline code, bold, emphasis and strikethrough. Tables and nested lists are not supported; see the Markdown support section above. ### Does it work on multisite? Settings are stored per site. After a network activation, configure each site through the External API Content screen. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “HiveKit External API Page Content” is open source software. The following people have contributed to this plugin. Contributors * [ Corrado Fiore ](https://profiles.wordpress.org/corradofiore/) [Translate “HiveKit External API Page Content” into your language.](https://translate.wordpress.org/projects/wp-plugins/hivekit-external-api-page-content) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/hivekit-external-api-page-content/), check out the [SVN repository](https://plugins.svn.wordpress.org/hivekit-external-api-page-content/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/hivekit-external-api-page-content/) by [RSS](https://plugins.trac.wordpress.org/log/hivekit-external-api-page-content/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.3.0 * Renamed the plugin to HiveKit External API Page Content. Every option, hook, filter and constant now uses the `hivekit_eapc_` prefix, and settings saved by earlier versions are migrated automatically. * Removed the per-mapping Bearer token constant setting. The plugin no longer reads any PHP constant, so an administrator cannot use it to send `wp-config.php` values such as database credentials to a remote URL. Add an Authorization header with the `hivekit_eapc_request_args` filter instead. * Added per-mapping HTTP request headers textarea. * Headers use one `Header-Name: value` entry per line and apply to both live fetches and Test API requests. * Explicit mapping headers override the plugin’s default headers when names conflict. * Header changes are included in cache/fallback identity to avoid reusing content from a different request context. #### 1.2.0 * Added a per-mapping Test API button to inspect the raw API payload. * Test results include HTTP status, Content-Type, response size, and resolved HTML/ Markdown format. * Tests use the current unsaved mapping values and do not populate or alter the normal content cache. * Non-2xx responses still display their returned payload for diagnostics. #### 1.1.0 * Replaced the fixed page slots with an arbitrary repeatable mapping list. * Added per-mapping labels, cache TTL, enabled status, and configurable Bearer- token constant names. * Generalized cache/fallback storage and filter context around stable mapping IDs. * Added automatic migration from version 1.0 settings. #### 1.0.0 * Initial release. ## Meta * Version **1.3.0** * Last updated **2 days ago** * Active installations **Fewer than 10** * WordPress version ** 6.8 or higher ** * Tested up to **7.1.3** * PHP version ** 8.3 or higher ** * Tags * [api](https://wordpress.org/plugins/tags/api/)[content](https://wordpress.org/plugins/tags/content/) [html](https://wordpress.org/plugins/tags/html/)[markdown](https://wordpress.org/plugins/tags/markdown/) [remote](https://wordpress.org/plugins/tags/remote/) * [Advanced View](https://wordpress.org/plugins/hivekit-external-api-page-content/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/hivekit-external-api-page-content/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/hivekit-external-api-page-content/reviews/) ## Contributors * [ Corrado Fiore ](https://profiles.wordpress.org/corradofiore/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/hivekit-external-api-page-content/)