I've got another question for you guys!

I need the following thing:

  1. User creates post (automatically sets it to pending for approval)
  2. Send the user an email with a confirmation link
  3. The User clicks the link
  4. The posts will be set to approved and will be posted automatically

How can this be created? Are there hooks in Wordpress available to create such a confirmation link?

1 Answer 1


You need a function that hook into post status transitions and send and email containing a link with some verification variables and a function that takes that variables, check them and if all ok update posts status.

Following code I think is self-explanatory, and comments give additional help:

add_action('new_to_pending', 'send_approve_link');
add_action('draft_to_pending', 'send_approve_link');
add_action('auto-draft_to_pending', 'send_approve_link');
add_action('init', 'approve_post');

function set_html_content_type() { return 'text/html'; }

function send_approve_link( $post ) {
  // get author of post
  $author = new WP_User($post->post_author);
  // create a key for security check and save as meta
  $check = md5( $author->user_email . $post->ID  );
  update_post_meta( $post->ID, '_approve_key', $check);
  // set the content for the email
  $content = '<p>Please click following link to allow the publishing of your post: &quot;';
  $content .= esc_html( get_the_title($post->ID) ) . '&quot;</p>';
  // create an url vor verify link with some variables: key, post id, and email
  $url = add_query_arg( array('email'=>$author->user_email,'approve'=>$post->ID), site_url() );
  $content .= '<p><a href="' . $url . '">Click to Confirm</a></p>';
  $from = get_bloginfo('name');
  $from_email = get_option('admin_email');
  $headers = 'From: ' . $from . ' <' . $from_email . '>' . "\r\n";
  // sending email in html format
  add_filter( 'wp_mail_content_type', 'set_html_content_type' );
  wp_mail( $author->user_email, 'Confirm your Post', $content, $headers);
  remove_filter( 'wp_mail_content_type', 'set_html_content_type' );

function approve_post( ) {
  if ( isset($_GET['approve']) && isset($_GET['email']) ) {
    // have we all variable needed?
    if ( empty($_GET['approve']) || ! filter_var($_GET['email'], FILTER_VALIDATE_EMAIL) ) return;
    // get post
    $post = get_post($_GET['approve']);
    // this post has an author?
    if ( ! isset($post->post_author) ) return;
    // is the post already published?
    if ( $post->post_status == 'publish' ) {
      wp_redirect( get_permalink($post->ID) );
    } elseif ( $post->post_status != 'pending' ) { // was the post deleted by admin?
    // get the author
    $author = new WP_User($post->post_author);
    // check author variable
    if ( ! isset($author->user_email) ) return;
    // verify email
    if ( $_GET['email'] != $author->user_email ) return;
    // verify key
    $key = get_post_meta( $post->ID, '_approve_key', true);
    if ( $key != md5( $author->user_email . $post->ID ) ) return;
    // ok, update status
    $post_data = array('ID' => $post->ID, 'post_status' => 'publish');
    $update = wp_update_post($post_data);
    // update failed...
    if ( ! $update ) return;
    // delete verify key
    delete_post_meta($post->ID, '_approve_key');
    // work finished, view the post
    wp_redirect( get_permalink($post->ID) );

Thats, all. Please note code is untested.

  • Perhaps change $check = md5( $post->post_title ); to $check = md5( time() ); because post_title CAN potentially be the same...
    – user23654
    Commented Sep 5, 2013 at 13:30
  • yes, but $_GET['approve'] contain the post id, and that is unique. And then even if the key is the same for all posts, that's not important... Moreover md5(time()) is not verificable on apprroving. @splashingpixels
    – gmazzap
    Commented Sep 5, 2013 at 13:39
  • I understand however for the sake of being technical, using something more unique there would be better.
    – user23654
    Commented Sep 5, 2013 at 13:43
  • Authors never see the key, (they don't know the key exists at all) and they cannot send a key in the url or in other ways, so even if key is the same for all posts and all users make no difference: the scope is reached. After that, for more security and semplicity in verification the key should be related to post, and not be an arbitrary unique key. Hovewer, I just changed the key now using author email + post id: not to be unique, but to give admin the ability to edit title. As side effect it is also unique and you can be glad of that, don't you? @splashingpixels
    – gmazzap
    Commented Sep 5, 2013 at 14:07
  • Yes now I am happy.. :)
    – user23654
    Commented Sep 5, 2013 at 14:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.