Share a draft without giving anyone an account
Set up preview links WordPress content can be shared through safely: a token-only URL, an optional password and view limit, automatic noindex, and a link that quietly redirects to the real address the moment the post goes live.
- Multiple links per post, each independently revocable.
- Optional password and view limit, checked every time it's opened.
- Enforced noindex — search engines never see unpublished content.
- Auto-redirects to the live URL once the post is actually published.
Preview links WordPress: what does the module actually do?
This is what preview links WordPress content gets with TheOneWP: TOWP_Preview_Links issues a token-only URL for a draft, pending, future or private post, with an optional label, lifetime, password and view limit. Opening the link runs the same checks every time — token validity, expiry, view count, password — before the post is injected into the request for exactly that one visit, with search-engine indexing blocked and comments and pings forced off. Once the post is actually published, the same link stops previewing and redirects to the real address instead of breaking.
Sharing a draft usually means creating an account for someone
Letting a client, a proofreader, or a stakeholder see unpublished content before it goes live usually means either creating them a WordPress account or emailing a screenshot that goes stale the moment anything changes.
A shared login is a shared login forever
An account created just to preview one post tends to outlive that post, with no easy way to know who still has access to what.
A generic "preview" link risks getting indexed
Some sharing approaches leave draft content reachable by anyone who finds the link, including search engines that were never supposed to see it.
A link with exactly the access you gave it
The module checks the same conditions every time a link is opened, not just when it was issued.
No account, just a token
Anyone with the link can view the post; nobody needs credentials on the site itself.
Optional password and view limit
Add either, both, or neither — checked on every single open, not only the first.
Invisible to search engines
Enforced two separate ways, so unpublished content shared this way is never indexed by accident.
The complete preview links WordPress feature set
Every capability below is present in the class's issuing, serving, or admin AJAX methods.
Password and view limit, independently
A link can carry a hashed password, a maximum view count, both, or neither — re-checked on every open, not cached from the first visit.
Six expiry options
One hour, one day, three days, one week, one month, or never — chosen per link, not fixed site-wide.
One post, as many links as needed
A separate, independently labeled and revocable link for the client, the proofreader, or anyone else — taking one away never disturbs the others.
Redirects once the post is live
Publishing the post turns the same link into a 302 redirect to its real permalink instead of leaving it to error out.
Comments and pings disabled on a preview
Nobody viewing through a preview link can act on the content — it's a reading copy, not an interactive one.
List table and the editor's Publish panel
Create a link from a row action next to the post, or from a button right in the editor while writing it.
Share preview links WordPress content in four steps
Match the lifetime and access controls to who is actually receiving the link.
Open the panel from the row action or the editor
Available for draft, pending, future or private posts of the enabled types.
Set a label, lifetime, and optional password or view limit
A clear label like "For the client" makes managing several links at once easy later.
Send the link
It carries only a token — safe to paste into an email or a message with nothing else about the site exposed.
Revoke it when it's no longer needed
Each link is independent, so revoking one never affects any others issued for the same post.
Where a preview link replaces an account nobody needed
The module fits any situation where someone outside the site needs to see something before it's public.
Client sign-off before publishing
Share a draft for approval without creating a WordPress login the client will never use again.
External proofreading or legal review
A password-protected, time-limited link for a reviewer who only needs access for a day or two.
Embargoed or scheduled announcements
Let a partner or press contact preview a future-dated post ahead of its scheduled publish time.
Sharing that cleans up after itself
Every design choice in the verified code favors an access grant that ends cleanly rather than lingering.
Scoped to exactly one request
The verified implementation avoids changing anything beyond the single visit it's handling.
A request-scoped visibility exception
The post is injected into the query for this one request only, through a filter added and used just for it — not a global rule left switched on.
A rolling 100-view log per link
Older view records are trimmed automatically so the log never grows without bound.
Daily cleanup of dead links
A scheduled task removes links that can no longer work, on top of cleanup triggered by a post's own status changes or deletion.
Checked again on every single open
Nothing about a link's validity is assumed to still be true just because it was true when it was issued.
Constant-time token comparison
Even after an exact-match database lookup, the token is compared again with hash_equals() before the decision is made.
Post status re-checked at serve time
Content moved to trash or any status a link was never valid for is denied immediately, even if the link itself was never manually revoked.
Passwords hashed, never stored typed
A set password goes through wp_hash_password(); the acceptance cookie is itself a hash, compared with hash_equals().
Forced noindex, two different ways
An X-Robots-Tag header and WordPress's own wp_robots_no_robots filter both apply — one alone would be one point of failure.
Built on core WordPress request handling
The supplied code intercepts the request early enough to work with WordPress's normal routing, rather than around it. No compatibility claim beyond the verified implementation is assumed.
parse_request
Runs early enough to take over before WordPress would otherwise resolve the URL to a 404.
posts_pre_query
Hands the post directly to the main query for this one request, since the normal visibility rules would otherwise exclude a draft from a logged-out visitor entirely.
transition_post_status / deleted_post
Both trigger cleanup automatically, alongside the daily scheduled purge of expired links.
TheOneWP versus common alternatives
Compare a real preview links WordPress implementation with sharing a guest account or WordPress's own default post preview link.
| Capability | TheOneWP Preview Links | Other common solutions |
|---|---|---|
| Access method | A token-only link, no account needed | Often a shared login that outlives its purpose |
| Multiple recipients | Independent, individually revocable links per post | Usually one link or one account shared by everyone |
| Search engine safety | Enforced noindex, two separate ways | WordPress's own preview links carry no such guarantee |
| After publishing | Redirects to the live URL automatically | A stale link is often left broken |
| Link-preview bots | HEAD requests don't count against a view limit | Rarely accounted for, can burn single-use links |
| Administration | Available right in the list table and the editor | May require a separate plugin and its own screen |
Share access that matches the risk
A few habits keep preview links from becoming a loose end.
Label every link clearly
"For the client" or "For legal review" makes managing several links for one post far easier later.
Add a password for anything sensitive
A link alone is unguessable, but a password adds a second layer for content that genuinely needs it.
Set a lifetime instead of defaulting to never
A link with a real expiry needs no manual cleanup later.
Revoke a link the moment it's no longer needed
Don't wait for it to expire on its own if the reason for sharing it has already passed.
Avoid assumptions the code does not support
The module has a defined, verified scope — a few assumptions outside it cause confusion.
Expecting a link to work on already-published content
Preview links exist for draft, pending, future and private posts — once a post is live, its own permalink is the address to share.
Expecting comments to work on a preview
Comments and pings are deliberately forced off — a preview is a reading copy, not an interactive page.
Assuming a revoked link's view history stays around
Revoking a link deletes its view log along with it — export anything needed from the log before revoking.
Preview Links FAQ
These answers come directly from the verified class and its serving logic.
What does the actual preview link look like — does it reveal anything about the post?
No. The URL carries only a random token — home_url( '/' ) with a query argument — so a forwarded link says nothing about the post's title, ID, or that anything else on the site even exists.
How long is the token, and can it be guessed?
32 characters, generated with wp_generate_password() and lowercased, with visually ambiguous characters excluded so a link read aloud or retyped still works. It is checked with hash_equals() — a constant-time comparison — not a regular string match.
Can I set a password and a view limit on the same link?
Yes, independently. A link can have a password, a maximum number of views, both, or neither — and multiple links can exist for the same post at once, each with its own settings.
What happens to a preview link once the post is actually published?
It stops previewing and instead redirects (302) to the real, live URL. The link doesn't break — it just starts pointing at the address that now matters.
Can search engines index content shared through a preview link?
No. Every preview response sends an X-Robots-Tag: noindex, nofollow header and applies WordPress's own wp_robots_no_robots filter — enforced two separate ways, not just one.
Does opening a link in a chat app's or email client's preview feature burn a single-use view?
No. Those tools send a HEAD request to build their own link preview, and record_view() explicitly skips counting a HEAD request — a single-use link survives being pasted into a message before the actual recipient opens it.
Is my IP address logged when I open a preview link?
Not as an IP address. hash_ip() stores a one-way hash instead, the same privacy pattern used by Redirect Manager's own access log.
Where can preview links actually be created?
From a row action next to a draft, pending, future, or private post in the list table, or from a button inside the editor's own Publish panel — both trigger the same dialog and the same underlying issue() method.
Stop creating accounts for one preview.Send a link that expires on its own.
Use preview links WordPress content can be shared through confidently: token-only URLs, enforced noindex, and access that ends exactly when you say it should.