CommentMate – Live Feedback & Copy Collection

CommentMate lets site administrators share a private review link and collect feedback directly on website pages. Every current feature is included free.

• Contextual comments, copy-ready text, administrator comments and threaded replies.
• Active and resolved feedback, image/PDF attachments and context screenshots.
• Image previews, original downloads and Save to Media Library.
• Maximum-width, quality and WebP controls for separate compressed downloads or saved copies. Originals are preserved; identical saved copies are reused.
• Done! Notify Admin completion notifications and optional daily/immediate notifications.
• Stop sharing revokes the link and reviewer sessions first. Then keep the review data or explicitly confirm deletion. Saved Media Library images, including compressed copies, remain.

Full review controls are desktop-first. Mobile includes touch creation and replies; desktop remains recommended for full review work. The sidebar is not a responsive-device emulator. CommentMate provides one site’s shared review workspace for all site administrators. Multisite is not supported.

Page groups can be collapsed. Private unfinished drafts remain only in the open tab; leaving or reloading loses them. Failed saves retain text, and failed files can be retried without reposting saved text. Administrators can repair a pin from a placement warning and review bounded notification failure details beneath Notifications. Mail handoff is not a delivery guarantee.

Clicking away from a blank draft removes it silently. A draft with text or selected files opens a Remove / Publish / Edit comment popup and scrolls to its saved point. Escape returns to editing; Publish uses the current text and files. Failed saves keep the draft, and removing failed-file recovery keeps the published comment. Finish resolves the draft first; publishing does not send a completion notification.

Desktop remains recommended. Physical iOS Safari/Android Chrome, real mobile keyboards and some builder/browser combinations remain unverified. Individual invitations/expiry, full search/filtering and Pro features are not included. Scrollbar boundary markers are omitted because accurate positions cannot be guaranteed.

Requirements and safeguards

Use HTTPS, PHP Sodium, InnoDB and writable durable private storage outside all public document roots. GD is required for image attachments and screenshots; WebP needs GD WebP support. PDF validation needs Fileinfo. ZIP review downloads need ZipArchive. The Advanced screen reports hosting checks; it cannot prove inbox delivery or external cache behavior.

Private files default to a 100 MiB storage budget (configurable from 25 to 250 MiB by the owner under Advanced → Private storage). Individual uploads are limited to 5 MB; a message supports up to three images and one PDF. Feedback has a 25 MiB budget and 2,000 stored-record limit. Comments and their initial messages are separate records; this is not 2,000 standalone comments. Soft-deleted records count until full cleanup. These safeguards apply to everyone and cannot be unlocked by payment.

PHP 8.1 remains the compatibility minimum. For supported hosting, use PHP 8.3 or newer (8.4/8.5 recommended for new hosting). PHP 8.1 is no longer supported by PHP; the Compatibility check recommends an upgrade without blocking compatible installations.

Review downloads and administrator access

Advanced → Data management → Download review data supplies readable comments and replies, structured review data and available private attachments. Media Library copies are referenced rather than copied into the download. Protect the downloaded file: it contains private feedback and is not a complete recovery backup.

All site administrators can manage the shared review, downloads and notification settings. No individual ownership, transfer or recovery is required.

Privacy and data retention

Review content, names, page URLs, anchors, replies and audit events are stored in this site’s database. Private files and screenshots are encrypted in an install-specific directory outside public web roots. Authentication uses a hashed share secret and hashed reviewer sessions; an encrypted copy of the active share secret lets the owner re-copy the link. Anyone given the active private link can join that site’s review. Treat it as confidential.

A screenshot may capture visible page content. Avoid personal or confidential information in review pages and attachments. Saving an image to the WordPress Media Library creates an ordinarily public media item, including any compressed copy. Stopping sharing revokes access but retains data unless the owner confirms cleanup. Deactivation retains data. WordPress Delete erases plugin data by default; the owner can turn off “Erase data when this plugin is deleted” first. Media Library items remain under either choice.

Email uses the site’s configured WordPress mail transport. Completion notifications are enabled on fresh installs to the site administrator; automatic daily/immediate alerts are off. Existing settings are preserved. Reviewers’ names, page references, counts and feedback excerpts may be included in configured notifications. Confirm recipients before sharing. No PluginHub account, telemetry, external updater or external review service is required. This plugin’s assets are served locally.

Back up the database, private storage and the site’s WordPress encryption/authentication material together. A database-only or ordinary wp-content-only backup may be insufficient. See Installation and FAQ before changing hosts or salts.

Source and support

Readable frontend source, package-lock.json, Vite configuration and standalone build instructions are included. See building.txt and third-party-notices.txt. PHP is supplied as readable source. No private development account is needed to rebuild.

For help, contact https://pluginhub.com.au/contact/. Report security issues privately to info@pluginhub.com.au as described in SECURITY.md; do not post review links or private files publicly.