How To Share A Draft Page In WordPress

You send the client a preview link. They open it and get a login screen.

Core WordPress ships no way to share a draft page with someone who isn’t logged in, which catches out almost everyone the first time.

Learning how to share a draft page in WordPress comes down to one thing: generating a public preview link that carries a signed token anyone can open.

What follows covers:

• The built-in Preview button, and exactly where it stops working
• Public Post Preview, plus the code snippet alternative
• Elementor and Divi quirks that break shared pages
• Why a link returns a 404, and how to expire one on purpose

Every method here maps to a real workflow: client review, internal editing, or full site sign-off.

What Is a WordPress Draft Preview Link

A WordPress draft preview link is a URL that renders unpublished content on the front end without publishing it. Core preview links only work for logged-in users with edit access. Public preview links carry a signed token so logged-out visitors open the same draft.

The core preview URL is built from the post ID plus a query string: ?p=123&preview=true for posts, ?pageid=123&preview=true for pages.

Autosaved changes add two more parameters, previewid and previewnonce, which point the renderer at the unsaved revision instead of the stored draft.

That nonce is the whole story. Strip it out and WordPress runs a capability check, finds no logged-in user, and returns your 404 page instead.

WordPress core sets noncelife to 86,400 seconds by default. The WordPress developer documentation notes the real lifespan lands between 12 and 24 hours, because verification checks the current tick and the one before it.

What a shared preview link does not do:

• It does not publish the page or change poststatus
• It does not appear in your XML sitemap
• It does not let the recipient edit anything
• It does not survive once the page goes live (the parameters resolve to the permalink)

Draft vs Pending Review vs Private vs Scheduled

Four post status values sit in the poststatus column of the database table that holds your pages, and they behave differently when you try to share them.

Private is not a sharing method. It requires a logged-in account with readprivatepages, which puts it closer to hiding a page from visitors than to handing someone a review link.

How to Share a Draft Page Using the Built-In Preview Link

Open the draft, click Preview in the block editor toolbar, then pick Preview in new tab. The URL that opens is tied to your session. Core WordPress ships no way to give that link to a logged-out person.

The three-step version, for the block editor:

1. Open the draft under Pages > All Pages
2. Click Preview in the top toolbar (the eye icon on smaller screens)
3. Choose Preview in new tab

Copy that URL, send it to a client, and they get a login redirect or a 404. Not a bug. WordPress is doing exactly what it was built to do.

Running the Classic Editor instead? The button lives in the Publish meta box and reads Preview Changes. Same limitation, different placement. Teams that want the newer Preview dropdown behavior need to switch the block editor back on first.

WordPress 6.7 reworked that dropdown, which matters for the plugins covered next.

Which Plugins Generate Public Preview Links for Drafts

Public Post Preview is the standard answer, with 100,000+ active installs on WordPress.org and a 48-hour default link life. It adds a checkbox in the Status & Visibility panel that produces a tokenized URL anyone can open, no account required.

Public Post Preview is maintained by Dominik Schilling, a WordPress core contributor. It was previously maintained by Matt Martz and originated as an idea from Jonathan Dingman, which explains why a plugin this small has survived since 2009.

Current versions require WordPress 6.5 and PHP 8.0, and the December 2024 release extended the Preview dropdown for WordPress 6.7 and added a Public Preview column to the post list.

Public Post Preview Setup Walkthrough

Five clicks, start to finish:

1. Install and activate from Plugins > Add New
2. Open a page saved as a draft (the checkbox hides on published content)
3. Tick Enable public preview in the sidebar
4. Save the draft
5. Copy the URL that appears under the checkbox

The generated link appends a query string that looks like &ppp=123abc12. Drop that fragment and the URL fails back to a 404.

Need longer than 48 hours? Go to Settings > Reading > Public Post Preview and raise the expiration time.

When a Code Snippet Beats a Plugin

The pppnoncelife filter changes link duration without touching settings, which is handy when the expiry needs to differ per environment.

“ addfilter( 'pppnoncelife', function() { return 60 60 24 * 7; // 7 days } ); `

Drop it into a snippets plugin or the theme functions file. Agency installs with a hard plugin cap, or hosts where plugin installs are blocked outright, make this the only route.

The tradeoff: snippets break quietly across major releases. Plugins get patched.

How to Share a Draft With Someone Who Has a WordPress Account

Account-based access is the right answer for internal teams. Editors and Administrators open any draft straight from the Pages list. Contributors and Authors cannot, because the capability that grants cross-author access is not part of their role.

WordPress documentation lists the Contributor default set as exactly three capabilities: read, editposts, and deleteposts.

Missing from that set: editothersposts, editpages, and uploadfiles. A Contributor cannot touch the Pages post type at all, which surprises people who assign the role to a client.

For review handoffs inside the team, switch the status to Pending Review and reassign the Author dropdown. The reviewer finds it filtered under Pending in the Pages list.

One multisite gotcha worth knowing: an account on one subsite carries nothing to another. Each site in the network keeps its own capability mapping.

How to Share a Draft Page Built in Elementor, Divi, or Another Page Builder

Builder pages need the same public preview link, plus a CSS check. Elementor and Divi store generated stylesheets per post, and a logged-out visitor hitting an unbuilt CSS file sees raw content with no layout.

HTTP Archive data published by GravityKit in April 2026 puts Elementor on 32.67% of WordPress sites, ahead of the block editor at 20.62%, wpBakery at 8.52%, and Divi at 5.72%. Odds are good your draft sits inside one of them.

Elementor: the editor’s own preview runs through elementor-preview and is not the link you share. Use the public preview URL, then confirm the post CSS file exists.

Divi: the Visual Builder holds unsaved state in the browser. Save the draft before generating any link, or the recipient sees the last saved version.

Bricks and Beaver Builder: both render fine on tokenized preview URLs once their cached CSS has been rebuilt.

When the shared page loads unstyled, work through it in this order:

1. Regenerate builder CSS (Elementor > Tools > Regenerate Files)
2. Clear the page cache
3. Reopen the link in a private window

Why a Draft Preview Link Shows a 404 or Login Screen

Six causes account for nearly every failure: an expired token, a caching layer serving a stale response, a security firewall stripping the query string, a coming soon plugin intercepting the request, a changed permalink structure, or testing the link while still logged in.

Expired token. Past 48 hours, the nonce stops validating and the page reverts to a 404. Regenerating the link fixes it. Broader token validation failures across the admin point at the same mechanism.

Cached 404. A 2025 market roundup cited by SQ Magazine found 82.4% of WordPress sites run at least one caching plugin, with LiteSpeed Cache leading at roughly 2.6 million active installs. WP Rocket, W3 Total Cache (900,000+ installs), and host-level caching at Kinsta, WP Engine, and SiteGround all cache the first response they see.

Exclude preview URLs from cache rules, then purge. Cloudflare needs its own page rule for the same reason.

Firewall blocking. Wordfence sits on more than 5 million sites and blocked 1.6 million attacks in a single 48-hour window in October 2025, per its own threat intelligence reporting. Aggressive rule sets sometimes treat a tokenized query string as an injection attempt.

Coming soon mode. SeedProd passed 1 million active installs, and its redirect fires before the preview handler does. If your site keeps showing a coming soon page, that plugin is intercepting the request.

Permalink changes. Rewriting the URL structure invalidates links already sent. Rewrite rules that stopped resolving produce the same symptom, and a settings re-save flushes them.

Test every link in an incognito window. Testing while logged in proves nothing, since your session authorizes the request regardless of the token. Persistent failures that survive all six checks usually trace back to a deeper 404 problem on the site.

How to Password Protect or Restrict a Shared Draft

WordPress has no native password option for drafts. The Visibility panel offers Password Protected, but it applies to published content only. Access control on a shared draft comes from link expiry, link revocation, or server-level restriction.

What works:

• Short expiry windows (drop pppnoncelife to 24 hours for client work)

• Unchecking the public preview box, which kills the token instantly
• Per-link plugins that track view counts and let you cut one recipient off
• HTTP auth at the server for anything on staging

What does not work: setting the page to Private and expecting an outsider to open it. That path restricts the site to logged-in users rather than granting a one-off view.

My rule after a client forwarded a preview URL into a public Slack channel: expire the link the day the review closes. Takes one click and removes the entire question.

How to Share a Full Site Draft Instead of a Single Page

Preview links cover one page. Theme changes, new templates, and global styling need a staging environment or a local tunnel, because a single tokenized URL renders the draft inside whatever the live site currently looks like.

Kinsta applies an X-Robots-Tag: noindex, nofollow, nosnippet, noarchive header to every staging and temporary URL, and its documentation states those headers cannot be removed without adding a custom domain.

No host staging? WP Staging carries 195,000+ active installations and builds a copy inside your existing hosting account.

Local development route: LocalWP (owned by WP Engine, free) spins up a WordPress install in roughly forty seconds and includes a Live Link tunnel that hands the client a temporary preview URL.

Live Link runs on ngrok underneath. Developers who want a fixed subdomain skip the built-in version and run ngrok directly, then define WPHOME and WPSITEURL in wp-config.php so WordPress stops redirecting to the local hostname.

Coming soon route: keep the site live but gated, then hand out a bypass link. Worth knowing how to switch maintenance mode back off before launch day, since a forgotten gate outlasts the review every time.

Pick staging over a preview link when the change touches anything global:

• Theme or child theme edits
• Plugin additions and removals
• Header, footer, or template parts
• Anything you would otherwise test by taking the site offline

Agencies running a portfolio of client installs tend to standardize on one staging host for exactly this reason. Mixed environments turn every review into a support question.

How Preview Links Affect Search Engines and Indexing

Drafts carry a poststatus of draft, not publish, so WordPress excludes them from the XML sitemap and from every archive query. Google has no crawl path to a draft unless someone publishes the preview URL somewhere crawlable.

Three discovery routes exist for any URL: a sitemap entry, an internal link, or an external link. Drafts have none of the first two.

That leaves the third, and it is the one people create by accident. A preview URL pasted into a public forum thread, a shared Google Doc set to “anyone with the link”, or an open Slack channel that gets archived to the web becomes a crawlable path.

What core does not do: WordPress does not attach a noindex directive to preview responses by default. The Robots API added in 5.7 hooks wprobotsnoindex, wprobotsnoindexembeds, and wprobotsnoindexsearch to the wprobots filter. Preview is not on that list.

Yoast SEO and Rank Math both write their robots meta from the post’s own settings, which means a draft inherits whatever the post type default says. Neither plugin treats preview traffic as a special case.

Practical handling, in order of effort:

1. Expire the link when the review closes
2. Keep preview URLs out of anything publicly archived
3. Check Search Console for stray preview parameters after launch

A draft with no inbound links behaves the same way pages with no internal links pointing at them behave. Invisible until something points at it.

How to Collect Feedback on a Shared Draft

Sharing the draft is half the job. Feedback arriving as an email thread with three screenshots and a phrase like “the middle bit looks off” costs more time than the edit itself.

Inside WordPress:

• PublishPress Statuses adds custom pre-publish steps beyond core’s two options, Draft and Pending Review
• PublishPress Planner adds editorial comments and notifications tied to each post
• SureFeedback (formerly ProjectHuddle) keeps annotation self-hosted on your own install

On the live preview URL:

Atarim lets reviewers click anywhere on the rendered page and drop a comment against that element. Its WordPress.org listing puts it on 120,000+ websites and designs, mostly agency work.

Ruttl handles the same job with CSS-level edit suggestions, which suits teams where the reviewer is also half a developer.

MarkUp.io claims annotation cuts review cycles by 80%, and it covers more than 30 file types, so PDFs and images from the same project land in one place.

None of these replace the record of what actually changed. Revisions live under the editor sidebar, and comparing two saves side by side is the fastest way to roll back an edit you regret after a round of feedback.

My preference, stated without much justification: pinned comments beat email every time, even on a two-page review. Threads lose context. Pins do not.

Draft Sharing Methods Compared

Five methods cover every scenario. The right pick depends on one question: does the reviewer already have an account on this site?

External client, one page: Public Post Preview. Nothing else matches the effort-to-result ratio.

Internal editor: an Editor account plus Pending Review status. No tokens to regenerate, no expiry to explain.

Developer QA: LocalWP Live Link, or ngrok with a reserved subdomain if the same reviewer checks in daily.

Whole site review: staging, with HTTP auth on top of whatever noindex header the host applies.

One habit worth building regardless of method: put the expiry date in the message you send. “This link works until Thursday” prevents the follow-up email three weeks later asking why the page went blank.

FAQ on How To Share A Draft Page In WordPress

Can I share a WordPress draft without giving someone a login?

Yes, but not with core alone. Install Public Post Preview, tick Enable public preview in the sidebar, save the draft, then copy the generated URL. Logged-out visitors open it with no account needed.

Why does my preview link ask people to log in?

The URL you copied from the browser bar carries no token. WordPress runs a capability check, finds no session, and redirects. Only a tokenized public preview link works for outside reviewers.

How long does a public preview link last?

48 hours by default with Public Post Preview. Change it under Settings > Reading > Public Post Preview, or with the pppnoncelife filter. Core WordPress nonces run shorter, between 12 and 24 hours.

Can I share a scheduled post the same way?

Yes. Scheduled content sits at poststatus future, which the plugin treats like a draft. Private pages are the exception, since they need a logged-in account with read access.

Does a shared draft show up in Google?

No sitemap entry, no internal links, no crawl path. The one real risk is pasting the preview URL somewhere public, like an open forum thread or an indexed shared document.

Why does my preview link return a 404?

Six usual suspects: expired token, cached response, security firewall stripping the query string, a coming soon plugin redirecting, changed permalink structure, or the recipient opening a truncated URL that lost the token.

Do Elementor pages work with public preview links?

They do, once the generated CSS file exists. Unstyled output means the builder stylesheet was never rebuilt. Regenerate files, clear the page cache, then retest in a private browsing window.

How do I stop someone from viewing a draft I already shared?

Uncheck Enable public preview. That kills the token instantly and the old URL falls back to a 404. Re-ticking the box generates a fresh link with a new nonce.

Can a Contributor share a draft page?

No. Contributors hold three capabilities: read, editposts, deleteposts. They cannot touch the Pages post type at all. Assign Editor, or generate the preview link yourself and send it on.

What if I need to share the whole site, not one page?

Use staging at Kinsta, WP Engine, SiteGround, or Cloudways, or a LocalWP Live Link tunnel. Add HTTP auth on top, since a preview link only renders one page inside the current theme.

Conclusion

Knowing how to share a draft page in WordPress is really one decision: does the reviewer have an account, or not?

With an account, assign Editor and switch the status to Pending Review. Without one, the preview nonce does the work, and Public Post Preview generates it in two clicks.

Test every link in an incognito window before you send it. Your own session hides every failure you would otherwise catch.

Three habits save the most time:

• Exclude preview URLs from page cache rules
• Regenerate builder CSS before sharing an Elementor or Divi layout
• Revoke the token once the review closes

For theme edits or template changes, skip the link entirely and clone to staging.