WP Manifestindependent plugin directory
manifest / social / wp-bluesky-autopost-per-author

Wilcosky Bluesky Auto-Poster WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA-

Let each author at your WordPress website connect to their Bluesky account. When they publish a post, it is sent to their Bluesky account.

★ 1stars
5release downloads
1.2.0latest · 7mo ago

Install

Download wp-bluesky-autopost-per-author.zip From the 1.1 release on GitHub, Apr 12, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/zerosonesfun/wp-bluesky-autopost-per-author/releases/download/1.1/wp-bluesky-autopost-per-author.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Bluesky Auto-Poster per Author

Let each author at your WordPress website connect to their Bluesky account. When they publish a post, it is sent to their Bluesky account. (There is a 1 to 2+ minute delay depending on if a token is expired and/or something like the image upload fails at first.)

Plugin Overview

This plugin allows each WordPress author to connect their Bluesky account using their handle and password. It then automatically posts published posts to their Bluesky account.

How It Works

1. Connecting Bluesky Account

Each author can connect their Bluesky account by using the provided shortcode [bsky_connect]. This renders a connection form for the author to connect or disconnect their Bluesky account.

2. Scheduling Auto-Post

When a post is published, the plugin schedules an auto-post to Bluesky with a delay of 1 minute using the wilcosky_bsky_schedule_auto_post function.

3. Auto-Posting to Bluesky

The wilcosky_bsky_auto_post function is triggered to perform the following steps:

  1. Check Post Status: Ensure the post is published and not already posted.
  2. Retrieve Post and User Meta: Get the post details and user meta information.
  3. Check Open Graph Data: Retrieve Open Graph data (title, description, and image) from the post link.
  4. Upload Image (if available): If an Open Graph image is found, upload it to Bluesky.
  5. Prepare Post Data: Prepare the data for posting, including text and embed (if image is uploaded).
  6. Post to Bluesky: Attempt to post the data to Bluesky.
  7. Token Handling: If the token is expired, the refresh token is used. If the refresh token is also expired, re-authentication is performed.

4. Retry Mechanism

If the initial posting attempt fails:

  1. First Attempt: The plugin will try to post again after a short delay.
  2. Second Attempt: If the first retry fails, it will attempt again.
  3. Third Attempt: As a foolproof mechanism, a third attempt will be made.

5. Frontend Log

Authors can view a log of their auto-post attempts, including any errors or successful posts, directly from the frontend.

6. Disconnecting Bluesky Account

Authors can disconnect their Bluesky account using the disconnect form rendered by the [bsky_connect] shortcode. This will remove all stored session tokens and credentials.

7. Uninstalling the Plugin

When the plugin is uninstalled, it will clean up all relevant data, including user metadata and post metadata, and clear any scheduled events related to auto-posting to Bluesky.

File Structure

  • wp-bluesky-autopost-per-author.php: The main plugin file containing all the functionality.

Installation

  1. Upload the plugin files to the /wp-content/plugins/wp-bluesky-autopost-per-author directory, or install the plugin through the WordPress plugins screen directly.
  2. Activate the plugin through the 'Plugins' screen in WordPress.
  3. Add the [bsky_connect] shortcode to a page or post where authors can connect their Bluesky accounts.
  4. Important: Add the following line to your wp-config.php file, replacing 'randomkeyhere' with a long random key:
     define('WILCOSKY_BSKY_ENCRYPTION_KEY', 'randomkeyhere');

Usage

  • Connecting Account: Authors can connect their Bluesky account via the [bsky_connect] shortcode form.
  • Auto-Posting: The plugin automatically handles auto-posting when a post is published.
  • Disconnecting Account: Authors can disconnect their Bluesky account via the [bsky_connect] shortcode form.
  • Viewing Log: Authors can view the log of their auto-post attempts from the frontend.

License

This plugin is licensed under the GPL3 license.

Support

For support, contact Billy Wilcosky.

Releases

13 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.2.0 latest
Mar 20, 2026 7mo ago
tag only
—
1.1
Apr 12, 2025 1 year ago
wp-bluesky-autopost-per-author.zip
5
1.0
Apr 8, 2025 1 year ago
tag only
—
Apr 8, 2025 1 year ago
tag only
—
Apr 8, 2025 1 year ago
tag only
—
Apr 7, 2025 1 year ago
tag only
—
Apr 6, 2025 1 year ago
tag only
—
0.9
Apr 6, 2025 1 year ago
tag only
—
0.8
Apr 6, 2025 1 year ago
tag only
—
0.6
Apr 5, 2025 1 year ago
tag only
—
0.5
Apr 5, 2025 1 year ago
tag only
—
0.4
Apr 5, 2025 1 year ago
tag only
—
0.3
Apr 5, 2025 1 year ago
tag only
—
A- grade

Security

Wilcosky Bluesky Auto-Poster 1.1 · audited by WP Registry

Low-severity findings only.

1 low
Audited release
1.1
Findings
1
Worst severity
low
Content hash
f3280ff654b42b54ab689396…

Findings

  • low Persists Bluesky password in user meta (encrypted)

    insecure_config

    Login AJAX (logged-in + nonce) stores Bluesky password encrypted in usermeta. Key must be in wp-config. Risk is credential retention on DB/key leak, not auth bypass.

    wp-bluesky-autopost-per-author.php:247-256

    Recommendation

    Prefer app passwords; avoid long-term password storage; keep refresh tokens only.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.