Content Workflow Manager

Content Workflow Manager is a production-ready WordPress plugin that adds a role-based content review and approval workflow for multi-author sites such as news portals, blogs, and editorial platforms.

The plugin introduces clear states for content (Draft → Under Review → Approved → Published), ensuring that Authors cannot publish directly and that Editors/Admins retain full control over what goes live.

Features

• Custom workflow statuses

  • under_review – posts awaiting editorial review.
  • approved – posts approved by Editors/Admins and ready to be published.

• Role-based approval flow

  • Authors can submit posts for review but cannot publish.
  • Editors and Administrators can approve, reject, and publish posts.

• Post edit screen metabox

  • For Authors: "Submit for Review" button.
  • For Editors/Admins: "Approve" and "Reject" actions, plus optional rejection reason field.
  • Shows the current workflow status at a glance.

• Dashboard widget

  • "Posts Pending Review" widget on the WordPress dashboard.
  • Lists recent posts in the under_review state with links and authors.

• Secure, extensible architecture

  • Object-oriented design with small, focused classes.
  • Capability checks via current_user_can() for every action.
  • Nonces for all mutating actions from the admin UI.
  • Filter hooks to customize supported post types and review statuses.

Installation

1. Upload the plugin

   • Copy the content-workflow-manager folder into your wp-content/plugins directory, or
   • Zip the folder and upload it from Plugins → Add New → Upload Plugin.

2. Activate the plugin

   • Go to Plugins → Installed Plugins.
   • Find Content Workflow Manager and click Activate.

3. Check user roles and capabilities

   • Authors should have edit_posts but not publish_posts.
   • Editors and Administrators have publish_posts and edit_others_posts by default in WordPress.

4. Verify the workflow UI

   • As an Author, edit or create a post: you should see a Content Workflow metabox with a Submit for Review button.
   • As an Editor/Admin, edit a post in the under_review state: you should see Approve and Reject buttons in the same metabox.
   • Check the WordPress dashboard: you should see the Posts Pending Review widget.

Workflow Explanation

The high-level workflow is:

1. Drafting (Author)

   • An Author creates or edits a post in the normal Draft state.

2. Submit for Review (Author)

   • From the Content Workflow metabox, the Author clicks Submit for Review.
   • The plugin verifies capabilities and then changes the post status to under_review using wp_update_post().

3. Review (Editor/Admin)

   • Editors/Admins see all posts in the under_review state in the Posts Pending Review dashboard widget.
   • On the post edit screen, the workflow metabox shows the current status and displays Approve and Reject actions.

4. Approve (Editor/Admin)

   • Clicking Approve changes the post status to approved via wp_update_post().
   • You can then publish the post using WordPress' normal publishing controls (e.g., changing from approved to publish).

5. Reject (Editor/Admin)

   • Clicking Reject moves the post back to draft.
   • An optional rejection reason can be entered and is stored in post meta (_cwm_rejection_reason).

This ensures that Authors cannot bypass editorial review, while Editors/Admins remain in control of approvals and publication.

Security Considerations

Content Workflow Manager is designed with WordPress security best practices in mind:

• Capability checks

  • All important operations are guarded with current_user_can() checks, for example:
    • Authors must be able to edit_post but not publish_posts to submit a post for review.
    • Editors/Admins must be able to publish_posts to approve or reject posts.

• Nonces and intent verification

  • Every form in the workflow metabox includes a WordPress nonce.
  • Server-side handlers validate these nonces using check_admin_referer() before performing any action.

• Input sanitization

  • Textual inputs (like the optional rejection reason) are sanitized with wp_strip_all_tags() before being stored as post meta.
  • Post IDs are normalized via absint() and resolved using get_post().

• Restricted dashboard access

  • The Posts Pending Review widget is only shown to users who can manage or moderate content (e.g., edit_others_posts or publish_posts).

• No data loss on deactivation

  • Deactivating the plugin does not delete posts or metadata.
  • You may remove data manually or via a custom uninstaller if required for your environment.

Hooks, Filters, and WordPress APIs Used

WordPress Hooks and Filters

• Actions

  • init – used to register custom post statuses.
  • plugins_loaded – used by the main plugin bootstrap to initialize core components.
  • add_meta_boxes – registers the Content Workflow metabox on supported post types.
  • admin_post_cwm_submit_for_review – handles the Submit for Review form submission.
  • admin_post_cwm_approve_post – handles the Approve action.
  • admin_post_cwm_reject_post – handles the Reject action.
  • wp_dashboard_setup – registers the Posts Pending Review dashboard widget.

• Filters

  • display_post_states – adds "Under Review" and "Approved" labels in the posts list table.
  • cwm_metabox_post_types – allows developers to extend the workflow metabox to additional post types.
  • cwm_pending_review_statuses – allows customization of which statuses are considered "pending review".

WordPress Core APIs

• Post and status APIs

  • register_post_status() – registers the under_review and approved statuses.
  • wp_insert_post() – used to programmatically create posts in the under_review state.
  • wp_update_post() – used to transition posts between statuses while triggering core hooks.

• Capability and user APIs

  • current_user_can() – verifies permissions for submit/approve/reject actions.
  • is_user_logged_in() – ensures only authenticated users can act on posts.

• Security APIs

  • wp_nonce_field() – adds nonces to forms.
  • check_admin_referer() – validates nonces for admin actions.
  • wp_safe_redirect() – safely redirects after actions.
  • wp_die() – used for safe error handling in admin requests.

• Query and UI APIs

  • WP_Query – used in the dashboard widget to list posts pending review.
  • wp_add_dashboard_widget() – registers the dashboard widget.
  • add_meta_box() – registers the workflow metabox.
  • submit_button() – renders standard WordPress admin buttons.

Extensibility

Developers can integrate or customize Content Workflow Manager using several extension points:

• Extend the metabox to custom post types via the cwm_metabox_post_types filter.
• Adjust which statuses are treated as "pending review" via cwm_pending_review_statuses.
• Build custom admin screens or REST endpoints that leverage the CWM_Workflow methods such as:
  • submit_for_review( $post )
  • approve( $post )
  • reject( $post, $args )
  • create_under_review_post( $post_data )

For production environments, you can further tailor capabilities, add custom notifications (e.g., emails or Slack), or integrate with existing editorial tools while reusing the core workflow logic provided by this plugin.