Secure Role-Restricted Draft Previews
Generate secure, expiring preview URLs for drafts with role/user restrictions. Compatible with FSE, Block Themes, and Classic Themes.
Consider an alternative
Secure Role-Restricted Draft Pr… shows warning signs in 2026 — compare the alternatives below before installing. Was last updated 1 year ago, and scores 30/100 on our health check.
- Small user base (<10 active installs)
- Very few reviews so far
- No update in over a year
- Only tested up to WordPress 6.8 (latest is 7.1)
How does it stack up?
Side-by-side on installs, updates, ratings & support
Daily downloads
Download spikes usually follow a new release — each site that auto-updates counts as a download.
Rankings
Where Secure Role-Restricted Draf… stands todayWordPress.org search rankings
Live position in the plugin search, top 100| Keyword | Position |
|---|---|
| access-control | >100 |
| drafts | >100 |
| preview | >100 |
| roles | >100 |
| security | >100 |
About Secure Role-Restricted Draft Previews
From the official readme · v1.0.1Description
Why this plugin?
WordPress core preview links work well for editors, and Public Post Preview shares via anonymous nonces.
This plugin adds a missing middle ground: draft previews that are secured by authentication and access control
lists (ACLs) — role-based, user-specific, or per-email tokens — plus analytics and a one-click revoke-all.
Universal Compatibility
Works seamlessly with:
* Full Site Editing (FSE) themes
* Block themes (modern WordPress)
* Classic PHP-based themes
* All page builders including Elementor, WPBakery, Divi, etc.
* WooCommerce product drafts
* Any CSS framework including Tailwind CSS v4+
Key features
- Create expiring preview links (default 72h; configurable).
- Restrict by roles, specific users, or per-email tokens (no login for recipients).
- Require HTTPS for previews (on by default).
- Per-link analytics: allowed/denied events, hashed IP, user agent (privacy-friendly).
- Meta box in the editor (Post/Page by default; filterable) to generate, copy, and revoke.
- “Revoke All” for a post.
- Everything prefixed (
srpl_), sanitized, and aligned with WordPress coding standards.
How it works
Each generated link has a unique token, TTL, and ACL:
- Role-based Access: Requires login. Only users with allowed roles can view the preview.
- User-based Access: Requires login. Only specific user IDs can access the preview.
- Email Token Access: No login required. Recipients receive unique URLs with email verification tokens.
When a link is visited, SRPL validates the token, expiry, and ACL, then renders the draft with your theme’s header/footer. Events are logged (when enabled) to a small custom table (wp_srpl_events) with hashed IP for privacy.
Privacy
- IPs are hashed using
hash_hmac(sha256, ip, wp_salt('auth')). - You can disable analytics entirely under Settings → Secure Previews.
Developer Friendly
- Fully documented filters and actions
- Clean, object-oriented codebase
- PSR-4 autoloading
- Extensive inline documentation
Developer Documentation
Filters
srpl_supported_post_types– Modify post types that support preview linkssrpl_default_ttl_hours– Change default expiration time (in hours)srpl_force_ssl– Control whether previews are forced to use HTTPSsrpl_analytics_enabled– Enable or disable analytics collection
Functions
LinkManager::create($post_id, $args)– Create a new preview linkLinkManager::revoke($link_id)– Revoke a specific linkLinkManager::revoke_all_for_post($post_id)– Revoke all links for a postLinkManager::find_by_token($token)– Find a link by its token
Database Structure
- Post Meta for Links: _srpl_token, _srpl_mode, _srpl_roles, _srpl_users, _srpl_emails, _srpl_expires, _srpl_revoked, _srpl_hits, _srpl_last_access
- Analytics Table: wp_srpl_events (link_id, post_id, user_id, outcome, ip_hash, ua, created_at)
License
This plugin is free software, licensed under the GPL v2 or later.
Installation
- Upload the plugin folder to
/wp-content/plugins/or install from WP.org. - Activate the plugin through the ‘Plugins’ menu in WordPress.
- Go to any Post/Page editor → sidebar meta box “Secure Preview Links”.
- Generate a link (choose Mode + TTL). Copy the URL (for email mode, copy the per‑email URLs shown).
- Optional: configure defaults in Settings → Secure Previews.
Frequently asked questions
Is this the same as Public Post Preview?
No. That plugin makes anonymous, expiring links. SRPL requires login for role/user modes and supports per‑email tokens. It also offers per‑link analytics and revoke‑all functionality.
Can I restrict by custom roles?
Yes. All editable roles are available. You can also filter supported post types via srpl_supported_post_types.
Does it support Custom Post Types?
Yes. Add your CPT slug to the srpl_supported_post_types filter: add_filter('srpl_supported_post_types', function($post_types) { $post_types[] = 'product'; // Add custom post type return $post_types; });
Is this plugin compatible with Full Site Editing (FSE), Block Themes, and Classic Themes?
Yes! Our plugin works seamlessly with: * Full Site Editing (FSE) themes * Block themes (modern WordPress) * Classic PHP-based themes * All page builders including Elementor, WPBakery, Divi, etc. * WooCommerce product drafts * Any CSS framework including Tailwind CSS v4+ The preview functionality renders drafts exactly as they would appear on your live site, regardless of your theme or page builder.
Will this leak draft content to search engines?
No. Links are opaque tokens; access is gated and previews are not discoverable by search engines.
How are analytics stored?
A lightweight table wp_srpl_events stores link id, post id, hashed IP, UA, user id (if logged), outcome, and timestamp. You can disable this in settings.
Can I change the default expiration time?
Yes, use the srpl_default_ttl_hours filter: add_filter('srpl_default_ttl_hours', function($hours) { return 168; // 1 week });
How secure are the preview links?
Very secure. Links use cryptographically strong tokens that are non-guessable. Email tokens are deterministic but secure, using your site’s nonce salt.
Changelog
Updated plugin assets for WordPress.org directory. All persistent data is stored in the WordPress database or in a subfolder of the uploads directory. No plugin-folder writes. No code editing required.
1.0.1
- Updated plugin assets for WordPress.org directory.
1.0.0
- Initial release.
Screenshots
For developers
Is this your plugin? Show off the numbers.
Add a live badge to your site, docs or GitHub README. It updates on its own — no account needed.
Best Secure Role-Restricted Draft… alternatives
All access-control plugins →
FAQ
Secure Role-Restricted Draft Previe…: quick answers
Straight answers, pulled from live WordPress.org data.
Live data from WordPress.org · checked Oct 15, 2026
Is Secure Role-Restricted Draft Pr… free?
Yes. Secure Role-Restricted Draft Pr… is free to download and use from the official WordPress.org plugin directory.
Is Secure Role-Restricted Draft Pr… safe to use in 2026?
Secure Role-Restricted Draft Pr… shows warning signs in 2026 — compare the alternatives below before installing. Was last updated 1 year ago, and scores 30/100 on our health check.
How many websites use Secure Role-Restricted Draft Pr…?
Secure Role-Restricted Draft Pr… is active on <10 WordPress websites and has been downloaded 471 times since it launched in September 2025. It was downloaded 46 times in the last 30 days.
Does Secure Role-Restricted Draft Pr… work with WordPress 7.1?
Secure Role-Restricted Draft Pr… is officially tested up to WordPress 6.8.11, while the latest release is 7.1.3. It may still work, but try it on a staging site first.
What PHP version does Secure Role-Restricted Draft Pr… need?
Secure Role-Restricted Draft Pr… requires PHP 8.1 or higher. Most hosts run PHP 8.x today, so it works on any modern WordPress hosting.
When was Secure Role-Restricted Draft Pr… last updated?
The latest version, 1.0.1, was released on October 2, 2025 (1 year ago).
Who makes Secure Role-Restricted Draft Pr…?
Secure Role-Restricted Draft Pr… is developed and maintained by Pixy Puala.
What are the best alternatives to Secure Role-Restricted Draft Pr…?
The most popular alternatives to Secure Role-Restricted Draft Pr… are PublishPress Capabilities:… (100K+ installs), Content Control (40K+ installs) and Restrict User Access (10K+ installs).
Powered by PageForge
Want thousands of pages that rank like these? Build them in an afternoon.
This directory runs on the same engine as PageForge. Turn any spreadsheet, CSV or API into thousands of fast, SEO-ready WordPress pages — with schema, internal links and AI-written copy baked in.
- CSV, Google Sheets & API data sources
- AI content, schema & internal links per page
- Works with Elementor, Gutenberg, Yoast & Rank Math
- Free on WordPress.org — no credit card
