{"id":11195,"date":"2026-05-27T19:29:52","date_gmt":"2026-05-27T11:29:52","guid":{"rendered":"https:\/\/aeosub.com\/secure-draft-preview-links\/"},"modified":"2026-05-27T19:29:52","modified_gmt":"2026-05-27T11:29:52","slug":"secure-draft-preview-links","status":"publish","type":"post","link":"https:\/\/aeosub.com\/zh\/secure-draft-preview-links\/","title":{"rendered":"Secure Draft Preview Links"},"content":{"rendered":"
\"Secure<\/div>\n
\n\n\n\n\n\n\n\n
Developer<\/th>\nsavedprompt<\/a><\/td>\n<\/tr>\n
Version<\/th>\nv1.0.0<\/td>\n<\/tr>\n
Active Installs<\/th>\n0 +<\/td>\n<\/tr>\n
Requires \/ Tested<\/th>\n6.5 \/ 6.9.4<\/td>\n<\/tr>\n
Last Updated<\/th>\n2026-05-27 11:02am GMT<\/td>\n<\/tr>\n
Official Link<\/th>\nView Details \u2192<\/a><\/td>\n<\/tr>\n<\/table><\/div>\n
Share draft posts with anyone via a secure, time-limited preview link \u2014 no login required.<\/div>\n

Secure Draft Preview Links<\/strong> lets you generate a cryptographically secure, unguessable link for any draft post so that people without a WordPress account can read it before it goes live.<\/p>\n

How it works<\/h4>\n
    \n
  1. Open any draft post or page in the editor.<\/li>\n
  2. Check Enable public preview<\/strong> in the Publish panel (Classic Editor) or Status & Visibility panel (Block Editor).<\/li>\n
  3. Copy the generated link and share it with anyone.<\/li>\n
  4. The recipient can view the draft without logging in.<\/li>\n
  5. Uncheck the box or set the expiry to Expired<\/strong> to revoke access immediately.<\/li>\n<\/ol>\n

    Editor features<\/h4>\n
      \n
    • Works with both the Classic Editor<\/strong> and the Block Editor<\/strong> (Gutenberg).<\/li>\n
    • Checkbox to enable \/ disable preview \u2014 shown even on auto-draft posts (disabled with a “save first” hint).<\/li>\n
    • When a post is published the checkbox automatically disables and shows “Not available for published posts”.<\/li>\n
    • Preview URL displayed in a monospace code box \u2014 horizontally scrollable, click to select all.<\/li>\n
    • Copy<\/strong> button and Open preview<\/strong> button inline with the URL box.<\/li>\n
    • Generate new link<\/strong> button \u2014 invalidates the old link immediately, with a confirmation step before firing.<\/li>\n
    • Stop sharing<\/strong> confirmation bar \u2014 shown when unchecking the checkbox, requires explicit confirmation before removing the link.<\/li>\n
    • Expiry selector with four options:\n
        \n
      • 48 hours<\/strong> \u2014 default, shows exact time remaining (e.g. “Expires on: Apr 29 \u00b7 14:32 (4h 12m remaining)”).<\/li>\n
      • Always available<\/strong> \u2014 link never expires.<\/li>\n
      • Custom time<\/strong> \u2014 set Days, Hours, and Minutes; live “Expires on:” display updates as you type; shows error if all fields are cleared without saving.<\/li>\n
      • Expired (disable now)<\/strong> \u2014 immediately invalidates the link without deleting the token.<\/li>\n<\/ul>\n<\/li>\n
      • Expiry settings auto-save on change with a “Expiry setting saved.” confirmation message.<\/li>\n
      • Block Editor: snackbar notices for every action (enable, disable, copy, generate new link).<\/li>\n
      • Block Editor: Open public preview<\/strong> item added to the Preview dropdown (WordPress 6.7+).<\/li>\n<\/ul>\n

        Preview Links admin page<\/h4>\n
          \n
        • Dedicated Preview Links<\/strong> menu item in the WordPress admin sidebar.<\/li>\n
        • Two tabs: Active<\/strong> and Expired<\/strong>, each showing a count badge.<\/li>\n
        • Paginated table<\/strong> \u2014 20 items per page, with top and bottom pagination controls.<\/li>\n
        • Per-row columns: Post title, Post type, Exact expiry time, Preview URL, Share buttons, Actions.<\/li>\n
        • Copy URL<\/strong> and Open preview<\/strong> icon buttons inline with the URL.<\/li>\n
        • Share buttons<\/strong>: Facebook, X (Twitter), LinkedIn, Email \u2014 captions include the post title and expiry time (omitted for never-expires links).<\/li>\n
        • Regenerate<\/strong> button \u2014 generates a new token with a confirmation dialog; old link stops working immediately.<\/li>\n
        • Stop Sharing<\/strong> button \u2014 removes the token with a confirmation dialog.<\/li>\n
        • Edit Post<\/strong> link opens in a new tab.<\/li>\n
        • Confirmation dialogs use an inline modal (no browser confirm()<\/code>) with clear messaging about consequences.<\/li>\n
        • Toast notifications slide up from the bottom-right on every action.<\/li>\n<\/ul>\n

          Security<\/h4>\n
            \n
          • Tokens are 64-character cryptographically random hex strings generated with random_bytes()<\/code>.<\/li>\n
          • Token validation uses hash_equals()<\/code> to prevent timing attacks.<\/li>\n
          • Expired links return a 410 Gone<\/strong> HTTP response.<\/li>\n
          • Invalid tokens return a 403 Forbidden<\/strong> HTTP response.<\/li>\n
          • Preview link is automatically removed when a post is published, made private, or trashed.<\/li>\n
          • All AJAX endpoints are protected with nonces and capability checks.<\/li>\n
          • No data is exposed to unauthenticated users beyond the post content itself.<\/li>\n<\/ul>\n

            Post list table<\/h4>\n
              \n
            • Public Preview<\/strong> badge shown next to post titles that have an active preview link.<\/li>\n
            • Public Preview<\/strong> filter view in the post list table to quickly find all posts with active links.<\/li>\n<\/ul>\n

              Technical<\/h4>\n
                \n
              • Works with all viewable public post types (posts, pages, and custom post types).<\/li>\n
              • Pagination links on multi-page posts are rewritten to include the preview token.<\/li>\n
              • Token meta is registered with the REST API for block editor compatibility.<\/li>\n
              • No external dependencies \u2014 pure PHP, jQuery (Classic Editor), and WordPress’s own React\/wp-components (Block Editor).<\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"

                Share draft posts with anyone via a secure, time-limited preview link \u2014 no login required.<\/p>","protected":false},"author":1,"featured_media":9317,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[252],"tags":[836,1744,2274,2275,2276,555],"class_list":["post-11195","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-trends","tag-draft","tag-preview","tag-preview-link","tag-public","tag-share","tag-wordpress-plugin"],"_links":{"self":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/posts\/11195","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/comments?post=11195"}],"version-history":[{"count":0,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/posts\/11195\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/media\/9317"}],"wp:attachment":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/media?parent=11195"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/categories?post=11195"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/tags?post=11195"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}