WP Manifestindependent plugin directory
manifest / seo / hrefmaster

HrefMaster

The definitive hreflang tags manager for WordPress — meta boxes, bulk editor, validation tools, WooCommerce support, and HTML lang attribute control.

by MENJ · github.com/menj/hrefmaster · website

★ 0stars
0forks

Install

No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:

wp plugin install https://github.com/menj/hrefmaster/archive/refs/heads/main.zip
Readme github.com/menj/hrefmaster ↗

The definitive hreflang tags manager for WordPress.

HrefMaster is a free, open-source plugin that handles every aspect of hreflang implementation: per-page meta boxes, bulk editing with cluster apply, comprehensive validation, multisite sync, configuration export/import, WooCommerce support, and per-page HTML language attribute control.

Features

Feature Description
Meta Boxes Add hreflang tags to posts, pages, custom post types, and taxonomy terms from the editor. Live tag counter warns at Google's 100-alternate-URL limit.
Bulk Editor Paginated (25/50/100 per page) table with server-side search, inline editing, CSV export, CSV import, and one-click save.
Apply Language Cluster Add a language to all posts at once by entering a base URL — the plugin appends each post's path automatically. Merge or Overwrite mode.
Front Page & Blog Page Hreflang tags on static front pages, "Your latest posts" homepages, and separate blog pages.
Single URL Validation Fetches any URL and checks: language codes, x-default presence, x-default reachability, self-referencing tag, duplicates, HTTP redirects, and canonical conflicts.
Bulk Validation Scans all tagged content with optional reciprocal link checking. Results persist across page navigation.
Duplicate URL Detection Scans site-wide for alternate URLs claimed by more than one post, which sends contradictory signals to Google.
Persistent Validation Log Bulk validation results are saved automatically and displayed on return. Clear at any time.
CSV Export / Import Export all hreflang tag data to CSV; import from CSV with per-row validation and deduplication.
Config Export / Import Download all plugin settings as JSON for backup; restore from a previously exported file on any site.
Multisite Sync Network Admin page to copy hreflang data from one site to other network sites, matched by slug and post type.
Post List Column Hreflang column in Posts/Pages list shows tag count (✓ N) or a dash (—) at a glance.
HTML Lang Attribute Override <html lang=""> per post/page for maximum SEO control.
WooCommerce Output hreflang tags on the main shop page alongside product pages (opt-in).
Rank Math Sitemap Inject <xhtml:link> hreflang entries into Rank Math's XML sitemaps (requires Rank Math SEO; opt-in).
Colour Schemes Four built-in admin themes: Ocean, Slate, Emerald, Midnight.
Secure Nonces on every form and AJAX endpoint, SSRF protection on all outbound fetches, BCP 47 regex on all meta key writes, XSS protocol blocking in JS, capability checks throughout, full input sanitisation and output escaping.

Security

HrefMaster has been through a comprehensive security audit. Key measures:

  • Nonce verification on all form submissions (post meta, term meta, settings) and every AJAX endpoint.
  • wp_unslash() on every $_POST and $_GET read before sanitisation.
  • SSRF protection on all URL-fetching endpoints — blocks non-HTTP(S) schemes and internal/reserved IP ranges (localhost, 127.x, 10.x, 172.16-31.x, 192.168.x, 169.254.x).
  • XSS protocol blocking in client-side JS — safeHref() rejects javascript:, data:, vbscript:, blob: protocols. External links use rel="noopener noreferrer".
  • BCP 47 meta key injection prevention — language codes validated against a strict regex on all save paths before use as hreflang-{code} meta keys.
  • Object type whitelisting in all bulk save/delete handlers — only 'post' and 'term' accepted.
  • Capability checks (manage_options, edit_post, manage_categories) on every admin action and AJAX handler.
  • Full output escaping — esc_html(), esc_attr(), esc_url() throughout all PHP templates.
  • CSRF protection on notice dismiss URLs via dedicated nonce.

Requirements

  • WordPress 5.0+
  • PHP 7.4+
  • WooCommerce (optional — for shop page support)
  • Rank Math SEO (optional — for XML sitemap integration)

Installation

  1. Download the latest release: hrefmaster-3.6.1.zip.
  2. In WordPress, go to Plugins → Add New → Upload Plugin.
  3. Upload the zip and activate.
  4. Navigate to HrefMaster in the admin sidebar.
  5. Select content types on the Dashboard tab, then start tagging.

Alternatively, extract the zip to /wp-content/plugins/hrefmaster/ and activate from the Plugins screen.

Upgrading from HREFLANG Tags Lite

HrefMaster automatically detects and migrates settings from the legacy plugin (HREFLANG Tags Lite / HREFLANG Tags by DCGWS). A one-time database migration (introduced in 3.5.0) also corrects any meta keys stored with underscores (hreflang-ms_MY) to the correct hyphenated BCP 47 format (hreflang-ms-MY).

See upgrading.md for full details.

File Structure

hrefmaster/
├── assets/
│   ├── css/
│   │   └── hrefmaster-admin.css      — Admin styles with CSS custom properties
│   └── js/
│       ├── hrefmaster-admin.js        — Main admin interactivity
│       └── hrefmaster-notify.js       — Notice dismissal handler
├── includes/
│   ├── functions.php                  — Helper functions (get_items, dedup, csv builder)
│   ├── notices.php                    — Admin notices
│   └── variables.php                  — Language list builder (149 locales)
├── tabs/
│   ├── dashboard.php                  — Content type picker + quick stats
│   ├── bulk-editor.php                — Paginated bulk editor + Apply Language Cluster
│   ├── validation-tool.php            — Single URL + bulk validation + duplicate URL check
│   └── settings.php                   — Colour scheme, toggles, config export/import
├── languages/                         — Translation files (.po / .mo)
├── hrefmaster.php                     — Plugin bootstrap and header
├── hrefmaster-init.php                — All hooks, AJAX handlers, meta boxes, multisite sync
├── hrefmaster-admin.php               — Admin page tab router
├── uninstall.php                      — Clean removal of all plugin data
├── changelog.md                       — Full version history
├── readme.txt                         — WordPress.org readme
├── readme.md                          — This file
└── upgrading.md                       — Migration guide from legacy plugin

Contributing

Contributions are welcome. Please open an issue or pull request on GitHub at https://github.com/menj.

License

GPLv2 or later. See LICENSE.

Support the Project

If HrefMaster is useful to you, consider supporting its development:

HrefMaster 3.6.1 — built from the ground up for reliability, security, and simplicity.