WP Manifestindependent plugin directory
manifest / updates / auto-copy-posts-for-wordpress

Auto Copy Posts for WordPress WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

A WordPress plugin that can duplicate posts from one WordPress site to another

★ 0stars
47release downloads
1.9.2latest · 1 year ago

Install

Download auto-copy-posts-for-wordpress.zip From the 1.9.2 release on GitHub, Sep 25, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/nickstewart95/auto-copy-posts-for-wordpress/releases/download/1.9.2/auto-copy-posts-for-wordpress.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

banner

A simple WordPress plugin that can sync posts from one WordPress site to another using the REST API.

How it works

There is an action, auto_copy_posts_sync, that will query a WordPress site, auto_copy_posts_site_url, and loop thru chunks, auto_copy_posts_post_per_page of posts. Each chunk gets an event, fetch_posts, to avoid query too many posts at once on the source site.

Inside of fetch_posts, each post gets sent to an event, create_post, that will actually create or update the post locally. This is also in a job to prevent any server stress when creating too many posts at once.

Installation

Drop the plugin folder in your WordPress plugins folder and run composer install inside the plugin folder to install the required libraries.

To customize the plugin, please make use of the plugin settings or the filters.

The plugin settings can be found by going to Settings -> Sync Post Settings. Note that filters will override settings.

An example filter:

add_filter('auto_copy_posts_site_url', function () {
    return 'https://yokoco.com/';
});

The daily sync event will automatically be created when the plugin is loaded.

If you do not want to wait, you can use the ActionScheduler plugin to manually run this event or run do_action('auto_copy_posts_sync') to start a sync.

Clicking into an individual post (that is a copied post) will display a metabox that will allow you to manually since that one one post.

Uninstall

If you deactive and delete the plugin, the plugin settings and scheduled actions will be removed and deleted. In order to prevent breaking the synced posts, the auto_copy_posts_registered_taxonomies setting does not get deleted, that way the custom taxonomy that have been synced do not break.

To reapply those taxonomies outside of the plugin, copy the following code to your theme's functions.php

add_action('init', function() {
    $registered_taxonomies = get_option(
        'auto_copy_posts_registered_taxonomies',
        [],
    );

    if (empty($registered_taxonomies)) {
        return;
    }

    foreach ($registered_taxonomies as $taxonomy) {
        $pretty_name = str_replace('-', ' ', $taxonomy['name']);
        $pretty_name = ucwords($pretty_name);

        $args = [
            'hierarchical' => true,
            'show_ui' => true,
            'show_admin_column' => true,
            'has_archive' => true,
            'labels' => [
                'name' => $pretty_name,
                'singular_name' => $pretty_name,
            ],
        ];

        register_taxonomy(
            $taxonomy['name'],
            [$taxonomy['post_type_single']],
            $args,
        );
    }
});

Dev Guide

Errors are logged to error.log inside the plugin folder

Filters

auto_copy_posts_sync_schedule - The cron schedule for how often the sync runs, default value is 0 4,14 * * *;

auto_copy_posts_site_url - The url of the WordPress site posts are being syncd from

auto_copy_posts_post_per_page - The number of posts being grabbed at a time, default value is 10

auto_copy_posts_author_id - The author ID copied posts are associated with, default value is 1

auto_copy_posts_log_errors - If errors should be logged, default value is true

auto_copy_posts_post_images - If relative images are found in the post if they should be downloaded and made relative, default value is false

auto_copy_posts_post_title_matching - If a post has the same title as a post being synced over, skip it

Actions

auto_copy_posts_sync - Starts the sync

auto_copy_posts_delete_synced_posts - Deletes posts that have been synced over

Scheduled Events

auto_copy_posts_fetch_posts - Fetches posts per page and then creates events for each

auto_copy_posts_create_post - Creates/updates individual posts

auto_copy_posts_delete_post - Deletes individual posts

auto_copy_posts_sync_single_post - Syncs a single post

Meta Data

auto_copy_posts_original_id - The post ID from the source site, prepended with the top level domain it came from

auto_copy_posts_original_modification_date - The last modified date from the source site

auto_copy_posts_original_url - The post URL from the source site

auto_copy_posts_last_synced_date_gtm -The last time the post was synced over

Option Data

auto_copy_posts_registered_taxonomies - Contains the taxonomy data from copied posts so they can be recreated

Todo

May or may not get to these todo items, more so if I have time and noticed I should add something or make it better

  • [x] Meta box in post editor showing that the post has been copied
  • [x] Handle featured image
  • [x] Handle taxonomy and categories
  • [ ] Handle taxonomy and category parents (not looking at parents, will need to do some sorta recursive behavior)
  • [x] Better error handling and logging
  • [x] Refactor REST related code into an API class
  • [x] Refactor events related code into an Events class
  • [x] Add filters to support multiple post types
  • [ ] Implement coding standards (had issues with the WordPress standards not ignoring the filename rule)
  • [x] Add timestamp when sync for post is completed
  • [x] Add functionality to sync an individual posts
  • [x] Rename the plugin for production use
  • [x] Branding
  • [ ] Space the jobs out (currently all the jobs just sorta fire)
  • [ ] Add job progress indicator
  • [x] Remove related events when plugin is uninstalled
  • [x] Copy over media
  • [x] Add option to match on title
  • [ ] Add test coverage
  • [ ] Clean up completed action scheduler history

Credits

Releases

11 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.9.2 latest
Sep 25, 2025 1 year ago
auto-copy-posts-for-wordpress.zip
11
Sep 22, 2025 1 year ago
auto-copy-posts-for-wordpress.zip
6
Jul 15, 2025 1 year ago
auto-copy-posts-for-wordpress.zip
1
Mar 3, 2025 1 year ago
auto-copy-posts-for-wordpress.zip
4
Feb 12, 2025 1 year ago
auto-copy-posts-for-wordpress.zip
2
Feb 11, 2025 1 year ago
tag only
—
Jul 8, 2024 2 years ago
auto-copy-posts-for-wordpress.zip
3
May 9, 2024 2 years ago
auto-copy-posts-for-wordpress.zip
5
Mar 18, 2024 2 years ago
plugin.zip
4
Mar 18, 2024 2 years ago
plugin.zip
3
Mar 2, 2024 2 years ago
sync-posts-for-wordpress.zip
8
B grade

Security

Auto Copy Posts for WordPress 1.9.2 · audited by WP Registry

Medium-severity findings.

1 medium 1 low
Audited release
1.9.2
Findings
2
Worst severity
medium
Content hash
5804e7f410d14e7b27dd5c0c…

Findings

  • medium Any logged-in user can write plugin custom-post-type options via options.php

    missing_capability

    saveUnregisteredSettings() runs on admin_init whenever $pagenow is options.php and $_POST is non-empty. Its option_page guard uses '!isset(...) && ... !==', which never rejects a set value. It runs before options.php's own capability and nonce checks, and it update_option()s every POSTed key containing 'auto_copy_posts_custom_post_type_' (sanitize_text_field values). A Subscriber can therefore alter the remote-to-local post type mapping, content/featured-image fields and the registered CPT names that drive future syncs.

    src/AutoCopy.php:412-447, 1238-1260

    Recommendation

    Check current_user_can('manage_options') and verify the settings nonce (check_admin_referer('auto_copy_posts_wordpress-options')), fix the && to ||, and register these settings via register_setting instead.

  • low Unauthenticated trigger of single-post re-sync on wp_loaded

    missing_auth

    checkForManualSync() runs on wp_loaded for every request and schedules an auto_copy_posts_sync_single_post job for the raw $_GET['post'] value whenever ?auto_copy_posts_syncing is present. There is no authentication or nonce. Anyone can force re-sync jobs and remote API requests (job flooding). Content comes only from the admin-configured remote site.

    src/AutoCopy.php:775-808

    Recommendation

    Restrict to is_admin() requests by users with edit_post on the target, and add a nonce.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.