Erdo Draft Links

Share draft posts with anyone via a secure, temporary link — no WordPress login required.

WordPress.org Listing · Changelog · Installation · Report a Bug

---

Erdo Draft Links lets you generate a secure, token-based URL for any draft, private, or published post or page. Share it with clients, reviewers, or collaborators — they can read the content without needing a WordPress account.

Think of it like Google Docs' "Anyone with the link can view" — but for WordPress.

Screenshots

Block Editor sidebar	Classic Editor meta box

How it works

1. Open any post or page in the editor (Block Editor or Classic Editor).
2. Click "Generate Draft Link" in the sidebar panel or meta box.
3. Choose an expiry: 24 hours, 48 hours, 7 days, never, or a custom date & time.
4. Share the link. Recipients can view the content — no login needed.

Features

• Works with both the Block Editor (Gutenberg) and the Classic Editor
• Supports posts, pages, and any custom post type — toggle them on in Tools → Erdo Draft Links → Settings, or via a filter for developers
• Multiple labeled links per post — e.g. "Client A" and "Designer", each with its own expiry, revocable independently
• WP-CLI support — wp erdo-draft-links generate|revoke|list for scripting and automation
• Secure 32-character cryptographic tokens — brute-force resistant
• Configurable expiry: 24 hours, 48 hours, 7 days, no expiry, or a custom date & time
• View count tracking per link, with an email notification the first time a link is opened
• Visitors can leave name + feedback on the preview — collected in a "Feedback" tab in the admin and emailed to you
• Reply to feedback directly from the admin — visitors see your reply the next time they open the preview
• Revoke any link at any time
• Tokens are stored hashed in the database — raw tokens are never stored after the redirect
• Two-step flow: token URL → cookie → clean permalink (token never appears in browser history)
• No external API calls, no phone-home, no subscriptions
• Translation-ready (English default, Turkish included)

Who is this for?

• Freelancers and agencies — send a client a draft post to review before it's published, without handing out a WordPress login
• Editorial teams — let outside reviewers or stakeholders read a draft without granting WordPress access
• Anyone sharing private or scheduled content — a scoped, revocable link instead of changing post status or creating a temporary account

Installation

1. Upload the erdo-draft-links folder to /wp-content/plugins/, or install directly from Plugins → Add New by searching "Erdo Draft Links"
2. Activate through the Plugins menu
3. Open any post or page and find the Erdo Draft Links panel in the editor sidebar or meta box

Full FAQ and changelog are on the WordPress.org plugin page.

Try it instantly (no install)

Runs entirely in your browser, no server or account needed.

Developer notes

Site admins can enable other public post types under Tools → Erdo Draft Links → Settings — no code needed. Developers can also add support via the erdo_draft_links_supported_post_types filter, which takes precedence over the Settings tab:

add_filter( 'erdo_draft_links_supported_post_types', function( $types ) {
    $types[] = 'product';
    return $types;
} );

WP-CLI

wp erdo-draft-links generate <post_id> [--label=<label>] [--expiry=<24h|48h|7d|never>]
wp erdo-draft-links revoke <link_id>
wp erdo-draft-links list [--post_id=<id>] [--status=<all|active|expired|revoked>] [--format=<table|csv|json|yaml|count>]

assets/js/build/{classic,sidebar}.js are compiled output — if you edit assets/js/src/, run npm install && npm run build (uses @wordpress/scripts) to regenerate them and their *.asset.php dependency manifests before committing.

See readme.txt for the full WordPress.org-facing description, FAQ, and changelog.

Contributing

Issues and pull requests are welcome — see CONTRIBUTING.md. This repository mirrors the plugin shipped on WordPress.org; releases are cut from the Stable tag in readme.txt.

Security

• Raw token: 32-char alphanumeric via wp_generate_password( 32, false, false ).
• Stored hash: HMAC-SHA256(raw, AUTH_KEY) — the raw token is never stored.
• Cookie value: a second HMAC-SHA256 derivation, distinct from both the raw token and its stored hash.
• Preview cookies only ever expand visibility to the single post_id they were issued for.

If you find a security issue, please open an issue or contact the author directly rather than disclosing it publicly.

License

GPLv2 or later — see LICENSE.