Add secret preview link to bypass maintenance mode without login

Impact: 65 · Confidence: 90 · Complexity: 40

Description

Problem: Site owners building or updating a site in maintenance mode need to share live site previews with clients, reviewers, or stakeholders who do not have a WordPress user account.

Desired Behavior: Provide an option in LightStart settings to generate a unique secret preview URL/token (e.g. https://example.com/?preview_token=xyz123). Visiting this URL sets a temporary session cookie allowing the user to view the live site frontend without requiring a WordPress login.

Acceptance Criteria:

• Admin can enable 'Secret Preview Link' and generate/regenerate a unique secret token in LightStart settings.
• Anyone visiting the secret link gains temporary frontend access to the site while maintenance mode remains active for all other visitors.
• Admin can revoke or regenerate the secret link at any time to invalidate existing preview sessions.

Customer Context

Submitted via uninstall feedback (1 submission, product active for 1 hour). The user uninstalled because they were unable to send a secret link to allow non-logged-in external clients/users to preview the live site during maintenance.

Root Cause Analysis

Site owners need a way to grant non-authenticated external stakeholders (e.g. clients, reviewers) temporary view access to the live frontend during maintenance without creating WordPress accounts or publicly exposing pages via path/IP exclusions. Current product access control is strictly tied to logged-in WP roles, search engine bots, or IP/URL path exclusions.

Reasoning

The user uninstalled the plugin because they could not share a preview of the website with non-logged-in stakeholders while maintenance mode was active. Documentation review confirms LightStart only supports access via WordPress user roles, search bot bypass, or IP/path exclusion (which opens the page publicly to everyone). No secret shareable preview link/token mechanism currently exists. GitHub issue search revealed related requests for password protection (#405), but no open issue for secret bypass URLs.

Source: automated uninstall feedback — wp-maintenance-mode, 2026-08-28
Generated by feature-request-triage workflow (ID: feature-request-triage_6a926784b29896.13974900)

Start by tracing the LightStart settings and the existing maintenance-mode access checks. Define how token generation, temporary preview sessions, and revocation should fit those flows; done means the acceptance criteria work for non-logged-in visitors without changing access for other visitors.