---
title: Secure Preview
description: Secure Preview shares unpublished posts through protected links and per-reviewer invites.
url: https://developers.wpengine.com/docs/newsroom/mediapress/secure-preview/
image: https://developers.wpengine.com/og/docs/newsroom/mediapress/secure-preview.png
---

# Secure Preview

Secure Preview lets editorial users share an unpublished post with people who do not have CMS access, through a protected preview page.

There are two ways to share:

- A **shared link** (`/secure-preview/{token}/{post_id}`), optionally protected with a password and/or an expiry date.
- A **personal invite** (`/secure-preview/invite/{token}/{post_id}`) emailed to a specific reviewer. Invite links are single-use by default and track when the reviewer first opened the preview.

The package owns preview access and invites only. When the Reviews package is also active, the review form appears on the preview page: reviews hooks the `mediapress_secure_preview_page_loaded` action to render it, and Secure Preview grants the invited reviewer permission to submit through the reviews hooks.

## Filters/Actions

### PHP

#### Filters

##### `mediapress_secure_preview_supported_post_types`

Defines the post types that can be shared with a secure preview.

**Default Value**

`[ 'post', 'page' ]`

**Parameters**

| Name       | Type  | Description              |
| ---------- | ----- | ------------------------ |
| post_types | array | Array of post type slugs |

**Usage**

```php
add_filter( 'mediapress_secure_preview_supported_post_types', 'my_plugin_add_preview_support' );
function my_plugin_add_preview_support( array $post_types ): array {
  $post_types[] = 'my_custom_post_type';
  return $post_types;
}
```

##### `mediapress_secure_preview_invite_subject`

Filters the subject line of the reviewer invite email.

**Default Value**

`[Site name] Review request: {post title}`

**Parameters**

| Name    | Type    | Description               |
| ------- | ------- | ------------------------- |
| subject | string  | The default email subject |
| post    | WP_Post | The post being shared     |

**Usage**

```php
add_filter( 'mediapress_secure_preview_invite_subject', 'my_plugin_invite_subject', 10, 2 );
function my_plugin_invite_subject( string $subject, WP_Post $post ): string {
  return sprintf( 'Please review "%s"', $post->post_title );
}
```

##### `mediapress_secure_preview_invite_body`

Filters the plain-text body of the reviewer invite email.

**Default Value**

The rendered `invite-email.php` template.

**Parameters**

| Name | Type    | Description            |
| ---- | ------- | ---------------------- |
| body | string  | The default email body |
| post | WP_Post | The post being shared  |
| url  | string  | The invite preview URL |

**Usage**

```php
add_filter( 'mediapress_secure_preview_invite_body', 'my_plugin_invite_body', 10, 3 );
function my_plugin_invite_body( string $body, WP_Post $post, string $url ): string {
  return "Please review {$post->post_title}:\n{$url}";
}
```

#### Actions

##### `mediapress_secure_preview_page_loaded`

Fires when a valid secure preview page is served, for both shared and invite links. Lets other packages augment the preview page; the Reviews package hooks this to render the review form.

**Parameters**

| Name    | Type                       | Description                                                                   |
| ------- | -------------------------- | ----------------------------------------------------------------------------- |
| post_id | int                        | The post being previewed                                                      |
| invite  | array\<string,mixed>\|null | The invite record (including its plaintext `token`), or null on a shared link |

**Usage**

```php
add_action( 'mediapress_secure_preview_page_loaded', 'my_plugin_on_preview', 10, 2 );
function my_plugin_on_preview( int $post_id, ?array $invite ): void {
  if ( null === $invite ) {
    // Shared-link preview.
    return;
  }


  // Invited-reviewer preview; $invite['email'] and $invite['token'] are available.
}
```

## Was this helpful?

Thanks for the feedback!

```json
{"@context":"https://schema.org","@graph":[{"@type":"WebSite","@id":"https://developers.wpengine.com/#website","name":"WP Engine Product Documentation","url":"https://developers.wpengine.com/","description":"Resources for developing, deploying, and scaling on WP Engine.","inLanguage":"en-US","keywords":["API documentation","product documentation","headless WordPress","managed WordPress hosting"],"publisher":{"@id":"https://wpengine.com/#organization"}}]}
```