內容簡介
HiveKit External API Page Content 外掛允許使用者建立可配置的頁面與 API 的對應關係，無需硬編碼頁面目的或端點。此外掛支援多種格式的回應，並提供快取及回退機制，提升網站的靈活性與穩定性。
【主要功能】
• 支援多個可配置的頁面與 API 對應
• 自動偵測 HTML 或 Markdown 格式
• 可設定每個對應的快取 TTL
• 提供測試 API 按鈕顯示原始回應
• 支援自訂 HTTP 請求標頭
• 回退至原始 WordPress 編輯內容
外掛標籤
開發者團隊
② 後台搜尋「HiveKit External API Page Content」→ 直接安裝（推薦）
原文外掛簡介
External API Page Content lets you create any number of configurable page-to-API mappings. No page purpose or endpoint is hard-coded.
Each mapping contains:
an optional administrative label
a WordPress page
an external API URL
payload format: auto-detect, HTML, or Markdown
its own cache TTL
optional HTTP request headers, entered one per line
enabled/disabled status
The endpoint must return the document directly in the HTTP response body. JSON/XML wrappers are not expected.
Features:
Repeatable mappings: add or remove as many mappings as needed.
Uses the WordPress HTTP API (wp_safe_remote_get).
Auto-detects HTML vs Markdown, or lets you force the format per mapping.
Sanitizes output before rendering.
Caches successful responses with a configurable TTL per mapping.
Keeps the last successful API response per mapping as an outage fallback.
Falls back to the original WordPress editor content if the API has never succeeded.
Does not read PHP constants and does not store secrets, so it cannot be used to send wp-config.php values such as database credentials to a remote server.
Includes a per-mapping Test API button that shows the raw response payload, HTTP status, content type, size, and detected format without changing the cache.
Supports per-mapping request headers using a simple Header-Name: value textarea.
Offers filters for advanced request/header customization.
Upgrading from 1.0
Version 1.1 automatically converts the old fixed-slot settings into ordinary mappings. After migration there is no special handling for any page purpose.
Version 1.3.0 removed the per-mapping token constant setting. The plugin no longer reads any PHP constant, so an administrator account cannot use it to send wp-config.php values such as database credentials to a remote URL. If you relied on that setting, add the header with the hivekit_eapc_request_args filter (see Authentication below), or type it into the mapping’s Request headers field.
Request headers
Each mapping has a Request headers textarea. Enter one header per line:
X-API-Key: abc123
X-Tenant: customer-a
Accept-Language: en
Header names are validated and control characters are removed from values. Malformed lines are ignored. Explicit mapping headers take precedence over the plugin’s default headers when the same header name is supplied.
Header values entered here are stored in the WordPress options database, so anyone who can read the database can read them. For secrets, the filter shown under Authentication is preferable because it keeps the value in your own code.
The Test API button uses the request headers currently entered in the mapping, including unsaved changes.
Authentication
The plugin does not read PHP constants and does not store secrets. It therefore cannot be used to send a value from wp-config.php, such as DB_PASSWORD or AUTH_KEY, to a remote server.
Add an Authorization header from your own code with the hivekit_eapc_request_args filter, from a small site-specific plugin or your theme:
add_filter( 'hivekit_eapc_request_args', function( $args ) {
$args['headers']['Authorization'] = 'Bearer ' . MY_CONTENT_API_TOKEN;
return $args;
} );
The filter receives ( $request_args, $url, $page_id, $mapping_id, $mapping ), so a token can be limited to one mapping:
add_filter( 'hivekit_eapc_request_args', function( $args, $url, $page_id, $mapping_id, $mapping ) {
if ( 'm2' === $mapping_id ) {
$args['headers']['Authorization'] = 'Bearer ' . MY_LEGAL_API_TOKEN;
}
return $args;
}, 10, 5 );
Any other header works the same way:
add_filter( 'hivekit_eapc_request_args', function( $args, $url, $page_id, $mapping_id, $mapping ) {
if ( 'Policy API' === $mapping['label'] ) {
$args['headers']['X-API-Key'] = 'replace-me';
}
return $args;
}, 10, 5 );
The Test API button runs the same filter, so a test sends exactly the headers a real fetch would.
Cached responses are not keyed by filtered arguments, so rotating a token does not by itself refresh cached content. Clear the cache after changing a token.
Security
URLs are restricted to public HTTP/HTTPS endpoints and fetched with wp_safe_remote_get().
HTML responses are sanitized using WordPress KSES rules for post content.
Markdown is converted to HTML and sanitized before display.
Script tags and other unsafe HTML are removed by default.
The plugin never reads PHP constants, so it cannot expose wp-config.php secrets such as database credentials or authentication salts.
Secrets are not written to the plugin settings. Values typed into a mapping’s Request headers field are stored in the site options table.
If you intentionally need additional HTML tags/attributes, use the hivekit_eapc_allowed_html filter.
Markdown support
The bundled dependency-free Markdown renderer is intentionally small and supports the common constructs typically used in content/legal documents:
headings
paragraphs
blockquotes
horizontal rules
fenced code blocks
ordered and unordered lists
links
inline code
bold, emphasis, and strikethrough
It is not a full CommonMark implementation. If your source documents depend on advanced Markdown features such as tables, nested lists, footnotes, or reference-style links, replace/extend the renderer through the hivekit_eapc_markdown_html filter or integrate a full Markdown parser.
Filters
hivekit_eapc_should_replace_content
Controls whether content replacement occurs. Receives the page ID and full mapping.
hivekit_eapc_request_args
Changes WordPress HTTP request arguments before the API request. Receives URL, page ID, stable mapping ID, and full mapping.
hivekit_eapc_allowed_html
Changes the WordPress KSES allowlist for HTML responses.
hivekit_eapc_markdown_html
Changes rendered/sanitized Markdown HTML.
hivekit_eapc_rendered_content
Changes the final HTML before caching/output. Receives the stable mapping ID and full mapping.
External requests and privacy
This plugin does not send any data to the plugin author or to WordPress.org.
For every enabled mapping, the plugin performs a server-side HTTP request to the exact URL entered on the settings screen and replaces the body of the mapped page with the response. You choose those endpoints, so review the privacy policy and terms of use of each API you connect before enabling a mapping.
Requests use the WordPress HTTP API (wp_safe_remote_get) and accept only public HTTP/HTTPS URLs. Redirects are limited to 3, the response body is capped at 2 MB and the request times out after 8 seconds.
Source code and support
Development happens at https://github.com/corradofiore/wp-external-api-page-content
Bug reports and feature requests are welcome there. The distributed plugin contains the same unminified source as the repository, so no build step is required to review the code.
