{"id":307552,"date":"2026-05-27T11:03:17","date_gmt":"2026-05-27T11:03:17","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/public-post-preview-extended\/"},"modified":"2026-05-27T11:02:45","modified_gmt":"2026-05-27T11:02:45","slug":"secure-draft-preview-links","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/secure-draft-preview-links\/","author":23492041,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.0","stable_tag":"1.0.0","tested":"6.9.4","requires":"6.5","requires_php":"8.0","requires_plugins":null,"header_name":"Secure Draft Preview Links","header_author":"savedprompt","header_description":"Share draft posts with anyone via a secure, time-limited preview link. Works with both the Block Editor and Classic Editor.","assets_banners_color":"416acb","last_updated":"2026-05-27 11:02:45","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/wordpress.org\/plugins\/secure-draft-preview-links\/","header_author_uri":"https:\/\/profiles.wordpress.org\/savedprompt\/","rating":0,"author_block_rating":0,"active_installs":0,"downloads":29,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"savedprompt","date":"2026-05-27 11:02:45"}},"upgrade_notice":{"1.0.0":"

Initial release.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3550514,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3550514,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3550514,"resolution":"1544x500","location":"assets","locale":"","width":1543,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3550514,"resolution":"772x250","location":"assets","locale":"","width":771,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3550514,"resolution":"1","location":"assets","locale":"","width":2949,"height":1584},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3550514,"resolution":"2","location":"assets","locale":"","width":2864,"height":1504},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3550514,"resolution":"3","location":"assets","locale":"","width":2864,"height":1504},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3550514,"resolution":"4","location":"assets","locale":"","width":2864,"height":1504},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3550514,"resolution":"5","location":"assets","locale":"","width":2864,"height":1504}},"screenshots":{"1":"Block Editor \u2014 Enable public preview checkbox in the Status & Visibility panel with URL code box and expiry settings.","2":"Classic Editor \u2014 Enable public preview checkbox in the Publish meta box.","3":"Preview Links admin page \u2014 Active tab with paginated table and share buttons.","4":"Preview Links admin page \u2014 Expired tab.","5":"Confirmation dialog before generating a new link."}},"plugin_section":[],"plugin_tags":[4665,2475,259178,5677,138],"plugin_category":[56],"plugin_contributors":[264624],"plugin_business_model":[],"class_list":["post-307552","plugin","type-plugin","status-publish","hentry","plugin_tags-draft","plugin_tags-preview","plugin_tags-preview-link","plugin_tags-public","plugin_tags-share","plugin_category-social-and-sharing","plugin_contributors-savedprompt","plugin_committers-savedprompt"],"banners":{"banner":"https:\/\/ps.w.org\/secure-draft-preview-links\/assets\/banner-772x250.png?rev=3550514","banner_2x":"https:\/\/ps.w.org\/secure-draft-preview-links\/assets\/banner-1544x500.png?rev=3550514","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/secure-draft-preview-links\/assets\/icon-128x128.png?rev=3550514","icon_2x":"https:\/\/ps.w.org\/secure-draft-preview-links\/assets\/icon-256x256.png?rev=3550514","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/secure-draft-preview-links\/assets\/screenshot-1.png?rev=3550514","caption":"Block Editor \u2014 Enable public preview checkbox in the Status & Visibility panel with URL code box and expiry settings."},{"src":"https:\/\/ps.w.org\/secure-draft-preview-links\/assets\/screenshot-2.png?rev=3550514","caption":"Classic Editor \u2014 Enable public preview checkbox in the Publish meta box."},{"src":"https:\/\/ps.w.org\/secure-draft-preview-links\/assets\/screenshot-3.png?rev=3550514","caption":"Preview Links admin page \u2014 Active tab with paginated table and share buttons."},{"src":"https:\/\/ps.w.org\/secure-draft-preview-links\/assets\/screenshot-4.png?rev=3550514","caption":"Preview Links admin page \u2014 Expired tab."},{"src":"https:\/\/ps.w.org\/secure-draft-preview-links\/assets\/screenshot-5.png?rev=3550514","caption":"Confirmation dialog before generating a new link."}],"raw_content":"\n

Secure Draft Preview Links<\/strong> lets you generate a cryptographically secure, unguessable link for any draft post so that people without a WordPress account can read it before it goes live.<\/p>\n\n

How it works<\/h4>\n\n
    \n
  1. Open any draft post or page in the editor.<\/li>\n
  2. Check Enable public preview<\/strong> in the Publish panel (Classic Editor) or Status & Visibility panel (Block Editor).<\/li>\n
  3. Copy the generated link and share it with anyone.<\/li>\n
  4. The recipient can view the draft without logging in.<\/li>\n
  5. Uncheck the box or set the expiry to Expired<\/strong> to revoke access immediately.<\/li>\n<\/ol>\n\n

    Editor features<\/h4>\n\n
      \n
    • Works with both the Classic Editor<\/strong> and the Block Editor<\/strong> (Gutenberg).<\/li>\n
    • Checkbox to enable \/ disable preview \u2014 shown even on auto-draft posts (disabled with a \"save first\" hint).<\/li>\n
    • When a post is published the checkbox automatically disables and shows \"Not available for published posts\".<\/li>\n
    • Preview URL displayed in a monospace code box \u2014 horizontally scrollable, click to select all.<\/li>\n
    • Copy<\/strong> button and Open preview<\/strong> button inline with the URL box.<\/li>\n
    • Generate new link<\/strong> button \u2014 invalidates the old link immediately, with a confirmation step before firing.<\/li>\n
    • Stop sharing<\/strong> confirmation bar \u2014 shown when unchecking the checkbox, requires explicit confirmation before removing the link.<\/li>\n
    • Expiry selector with four options:\n\n
        \n
      • 48 hours<\/strong> \u2014 default, shows exact time remaining (e.g. \"Expires on: Apr 29 \u00b7 14:32 (4h 12m remaining)\").<\/li>\n
      • Always available<\/strong> \u2014 link never expires.<\/li>\n
      • Custom time<\/strong> \u2014 set Days, Hours, and Minutes; live \"Expires on:\" display updates as you type; shows error if all fields are cleared without saving.<\/li>\n
      • Expired (disable now)<\/strong> \u2014 immediately invalidates the link without deleting the token.<\/li>\n<\/ul><\/li>\n
      • Expiry settings auto-save on change with a \"Expiry setting saved.\" confirmation message.<\/li>\n
      • Block Editor: snackbar notices for every action (enable, disable, copy, generate new link).<\/li>\n
      • Block Editor: Open public preview<\/strong> item added to the Preview dropdown (WordPress 6.7+).<\/li>\n<\/ul>\n\n

        Preview Links admin page<\/h4>\n\n
          \n
        • Dedicated Preview Links<\/strong> menu item in the WordPress admin sidebar.<\/li>\n
        • Two tabs: Active<\/strong> and Expired<\/strong>, each showing a count badge.<\/li>\n
        • Paginated table<\/strong> \u2014 20 items per page, with top and bottom pagination controls.<\/li>\n
        • Per-row columns: Post title, Post type, Exact expiry time, Preview URL, Share buttons, Actions.<\/li>\n
        • Copy URL<\/strong> and Open preview<\/strong> icon buttons inline with the URL.<\/li>\n
        • Share buttons<\/strong>: Facebook, X (Twitter), LinkedIn, Email \u2014 captions include the post title and expiry time (omitted for never-expires links).<\/li>\n
        • Regenerate<\/strong> button \u2014 generates a new token with a confirmation dialog; old link stops working immediately.<\/li>\n
        • Stop Sharing<\/strong> button \u2014 removes the token with a confirmation dialog.<\/li>\n
        • Edit Post<\/strong> link opens in a new tab.<\/li>\n
        • Confirmation dialogs use an inline modal (no browser confirm()<\/code>) with clear messaging about consequences.<\/li>\n
        • Toast notifications slide up from the bottom-right on every action.<\/li>\n<\/ul>\n\n

          Security<\/h4>\n\n
            \n
          • Tokens are 64-character cryptographically random hex strings generated with random_bytes()<\/code>.<\/li>\n
          • Token validation uses hash_equals()<\/code> to prevent timing attacks.<\/li>\n
          • Expired links return a 410 Gone<\/strong> HTTP response.<\/li>\n
          • Invalid tokens return a 403 Forbidden<\/strong> HTTP response.<\/li>\n
          • Preview link is automatically removed when a post is published, made private, or trashed.<\/li>\n
          • All AJAX endpoints are protected with nonces and capability checks.<\/li>\n
          • No data is exposed to unauthenticated users beyond the post content itself.<\/li>\n<\/ul>\n\n

            Post list table<\/h4>\n\n
              \n
            • Public Preview<\/strong> badge shown next to post titles that have an active preview link.<\/li>\n
            • Public Preview<\/strong> filter view in the post list table to quickly find all posts with active links.<\/li>\n<\/ul>\n\n

              Technical<\/h4>\n\n
                \n
              • Works with all viewable public post types (posts, pages, and custom post types).<\/li>\n
              • Pagination links on multi-page posts are rewritten to include the preview token.<\/li>\n
              • Token meta is registered with the REST API for block editor compatibility.<\/li>\n
              • No external dependencies \u2014 pure PHP, jQuery (Classic Editor), and WordPress's own React\/wp-components (Block Editor).<\/li>\n<\/ul>\n\n\n
                  \n
                1. Upload the secure-draft-preview-links<\/code> folder to \/wp-content\/plugins\/<\/code>.<\/li>\n
                2. Activate the plugin through the Plugins<\/strong> screen in WordPress.<\/li>\n
                3. Open any draft post or page in the editor.<\/li>\n<\/ol>\n\n\n
                  \n

                  Does this work for custom post types?<\/h3><\/dt>\n

                  Yes. The panel appears on all viewable public post types automatically.<\/p><\/dd>\n

                  What happens when the link expires?<\/h3><\/dt>\n

                  Visitors see a \"Preview Link Expired\" page with a 410 HTTP status. The token remains stored so you can see it in the Preview Links page, but it no longer grants access.<\/p><\/dd>\n

                  Can I share the link with multiple people?<\/h3><\/dt>\n

                  Yes \u2014 the link is not tied to any specific user or session.<\/p><\/dd>\n

                  What happens when the post is published?<\/h3><\/dt>\n

                  The preview token is automatically deleted and visitors are redirected to the live permalink.<\/p><\/dd>\n

                  Is the preview link secure?<\/h3><\/dt>\n

                  Yes. Each token is a 64-character cryptographically random hex string generated with random_bytes()<\/code>. It is validated using hash_equals()<\/code> to prevent timing attacks.<\/p><\/dd>\n

                  Can I set a custom expiry time?<\/h3><\/dt>\n

                  Yes. Choose Custom time<\/strong> from the expiry dropdown and enter Days, Hours, and Minutes. The link will stop working after that duration. You can also choose Always available<\/strong> for a link that never expires.<\/p><\/dd>\n

                  How do I revoke access immediately?<\/h3><\/dt>\n

                  Either uncheck Enable public preview<\/strong> (and confirm in the dialog), or select Expired (disable now)<\/strong> from the expiry dropdown. Both invalidate the link instantly.<\/p><\/dd>\n

                  Can I regenerate the link without disabling it?<\/h3><\/dt>\n

                  Yes. Click Generate new link<\/strong> \u2014 after confirming, a new token is created and the old link stops working immediately. The expiry settings are preserved.<\/p><\/dd>\n

                  Where can I see all my preview links?<\/h3><\/dt>\n

                  Go to Preview Links<\/strong> in the WordPress admin sidebar. It shows all active and expired links across all post types, with share buttons and management actions.<\/p><\/dd>\n\n<\/dl>\n\n\n

                  1.0.0<\/h4>\n\n
                    \n
                  • Initial release.<\/li>\n
                  • Secure token generation using random_bytes()<\/code> with hash_equals()<\/code> validation.<\/li>\n
                  • Works with Classic Editor and Block Editor (Gutenberg).<\/li>\n
                  • Custom expiry: 48 hours (default), always available, custom Days\/Hours\/Minutes, or expire immediately.<\/li>\n
                  • Live \"Expires on:\" display with exact time remaining.<\/li>\n
                  • Regenerate and stop-sharing actions with inline confirmation dialogs.<\/li>\n
                  • Preview Links admin page with Active\/Expired tabs, pagination, and social share buttons (Facebook, X, LinkedIn, Email).<\/li>\n
                  • Auto-removal on publish, private, or trash.<\/li>\n
                  • \"Public Preview\" badge and filter view in the post list table.<\/li>\n
                  • Pagination support for multi-page posts.<\/li>\n
                  • Block Editor: snackbar notices, Preview dropdown menu item (WP 6.7+).<\/li>\n
                  • Disabled state with contextual hints for published posts and unsaved drafts.<\/li>\n<\/ul>","raw_excerpt":"Share draft posts with anyone via a secure, time-limited preview link \u2014 no login required.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/307552","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=307552"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/savedprompt"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=307552"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=307552"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=307552"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=307552"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=307552"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=307552"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}