PreviewFlow

Description

Stop publishing early just to show a client. PreviewFlow turns any draft, pending, scheduled or private content into a private, shareable link you can send like a document link — and take back the moment you want to.

No client accounts. No staging server. No temporary logins to clean up afterwards. You stay in control of who sees unfinished work, for how long, and on what terms.

The problem it solves

Reviewing unpublished content in WordPress has always been awkward. The built-in preview only works for someone already logged in, so agencies and freelancers end up doing one of four bad things: publishing a page early and hoping nobody notices, standing up a staging site for a single review, emailing screenshots that go stale immediately, or creating a throwaway user account that lingers for years as a security liability.

PreviewFlow replaces all four with one secure link.

How it works

1. Write your post, page or product and save it as a draft.
2. Open the Client Preview panel in the editor and create a link.
3. Choose how long it should last, and add a password if you want one.
4. Send the link. Your client opens it and sees the finished page.
5. Revoke it in one click when the review is done.

Secure by design

Every preview link is a 43-character random token — roughly 256 bits of entropy, drawn from the platform’s cryptographic random source. It is not a guessable post ID or a predictable slug.

• Expiry — one hour, six hours, 24 hours, three days, seven days, 30 days, a custom date and time, or never.
• Instant revoke — kill a link and the very next request is refused.
• Optional password — hashed with WordPress’ own password hashing, with attempt rate limiting to stop brute forcing.
• Never indexed — noindex is sent in both the page markup and the HTTP response headers, so a preview cannot leak into search results.
• Never cached — preview responses are excluded from page caches, so a cached copy can never outlive a link you revoked.
• No login required — and no account is ever created for a reviewer.

What your client sees

A real page, rendered by your real theme — not a screenshot and not a stripped back approximation. On top of it PreviewFlow adds:

• A draft watermark so nobody mistakes work in progress for a live page. Choose a corner badge, a full width bar or a diagonal overlay, and set the text, colour, position and opacity.
• A device switcher so the reviewer can check desktop, tablet and mobile. The page loads at the real device width, so your responsive breakpoints fire properly instead of being scaled down.
• A small preview toolbar showing what they are looking at and how long the link lasts.

When a link runs out, they get a friendly message you write yourself, not a confusing 404.

Built for people who ship websites

• Freelancers — share a design before it goes live, get sign-off faster.
• Agencies — one link per client, each with its own expiry and password. Revoke them all when the project ends.
• Marketing teams — circulate a campaign page internally before launch.
• Store owners — show a new product or landing page to a supplier or a partner before it hits the shop.
• Developers — hand a stakeholder a working page without giving them wp-admin.

Works with what you already use

PreviewFlow does not render pages itself — it lets the page render normally and adds an access layer on top. That means it works with:

• Any post type, including custom post types and WooCommerce products
• Any theme, classic or block
• Any builder — the block editor, Elementor, Bricks, Divi, Beaver Builder, Oxygen, Breakdance, Kadence, GenerateBlocks, Spectra and others
• Any caching setup — WP Rocket, LiteSpeed Cache, W3 Total Cache, WP Super Cache, NitroPack, Cache Enabler, WP Fastest Cache, Autoptimize and CDN edge caches are all told not to store preview responses

Know what happened

• A dashboard listing every link with its status, expiry, creator and view count, filterable by active, expired or revoked, with bulk revoke and delete.
• An activity screen with a 14-day chart and the full view history, filterable by time window, device and link.
• Per link view counts and unique visitor numbers, so you know whether the client actually opened it before you chase them.

Privacy first

View tracking is optional and can be switched off entirely. When it is on, PreviewFlow never stores a raw IP address. Visitors are identified by a one-way hash of their IP and browser, salted with your site’s own keys, which cannot be reversed and is not portable to another site. History is pruned automatically on a schedule you choose, and there is a one-click button to delete all of it for a privacy request.

Nothing is sent anywhere. There is no external service, no phone-home, no account to create, and no third-party requests — the plugin bundles its own fonts and assets.

Tools for agencies

• Export and import settings as JSON, so a new client site can be configured in seconds instead of clicked through.
• Reset to defaults without touching your links.
• Clear view history in one click.
• A status panel that checks permalinks, WP-Cron, HTTPS and any detected caching plugin, and warns you when something would undermine previews.

Everything in the free plugin

There is no trial, no feature nagging and no artificial limit. Unlimited preview links, unlimited expiry options, unlimited passwords, and no upsell banners in your dashboard. Everything described above is in this plugin.