內容簡介
lihi Short URL 外掛將 lihi 短網址服務整合至 WordPress 控制台，讓編輯者能夠輕鬆地從文章和媒體列表中創建短網址，選擇重定向域名，添加標籤及 UTM 參數，並在不離開 WordPress 的情況下複製結果。
【主要功能】
• 在所有公共文章類型列表中新增 lihi 短網址欄位及創建按鈕
• 媒體庫列表視圖及附件詳細面板提供創建/複製控制
• 一鍵複製短網址，支持 AJAX 請求生成
• 創建模式可選擇重定向域名及添加標籤
• 自動重用已存在的短網址，避免重複創建
• 管理員可透過 lihi 儀表板管理短網址及 UTM 選項
外掛標籤
開發者團隊
原文外掛簡介
lihi Short URL integrates the lihi short-link service into the WordPress admin. Editors can create short URLs from post and media list screens, choose a redirect domain, add tags, and add UTM parameters for non-media items, then copy the result without leaving WordPress. Existing short URLs become Copy controls, and administrators can open the matching lihi dashboard page to edit the link. This plugin is open source and maintained at weedgood/lihi-wp-plugin.
The plugin runs only inside wp-admin; it adds no front-end output and enqueues no scripts on public pages.
Features
Adds a lihi Short URL column with a Create button to all public post-type list screens (posts, pages, custom post types).
Adds the same Create / Copy controls to the Media Library list view and to the attachment detail panel in the media grid view.
One-click copy: generates the short URL on demand via AJAX and writes it to the clipboard, with a manual-copy prompt if browser clipboard access is blocked.
Creation modal: choose a redirect domain, add recommended or custom tags, and add UTM parameters for non-media items before creating a new short URL.
UTM source and medium are loaded from the lihi account options, while campaign, term, and content remain free-text fields; media items hide UTM controls and submit blank UTM values.
Reuses an existing short URL whenever one already exists for the item, so repeated clicks are idempotent.
Copy buttons still confirm the upstream short URL exists before copying; if it was removed, the button returns to Create and opens the creation modal again.
Marks items with lihi_already = 1 post meta after a successful short-URL lookup/create; the frontend renders those buttons as “Copy”.
Administrators can open existing short URLs, personal domain management, and UTM option management in the lihi dashboard through a browser-proof passthrough flow.
Settings page under Settings → lihi Short URL with Login and Register tabs, connected-account details, work-group switching, Logout, and a lihi dashboard shortcut. Login is selected by default, and the service heading breaks cleanly between its two sentences. Directly sanitized query-backed tab links and native WordPress AJAX POST forms keep tab switching and submission usable without JavaScript; JavaScript adds instant keyboard tabs, an accessible work-group modal layered above the dashboard workspace, inline errors, and delayed success feedback. Successful work-group changes reload the settings page after the confirmation so all group-scoped state is fresh. Logout makes one short best-effort server-session revocation and always continues with local credential cleanup.
Registration checks the request country before sending a verification email. Allowed registrations retain the registration request’s IP and device metadata for account creation; clicking the verification link does not replace them. After verifying, the administrator returns to the separate Login form; registration never logs the account in.
Login uses server-side PKCE and stores the email, opaque server-issued session identifier, access token, and rotating refresh token together in one non-autoloaded WordPress option. A renewable 20-second database lease serializes Login and Refresh; only the current byte-exact lease owner can write credentials under the captured activation generation.
Every refreshable protected lihi API request can refresh a rejected access token and retry once. Login and Refresh recheck activation after each remote response before renewing the lease; concurrent requests wait up to 18 seconds for a 15-second HTTP operation to finish. Any attempted refresh failure removes credentials still belonging to that Login session and asks the administrator to sign in again, while a newer Login remains untouched.
Localised; ships with Traditional Chinese (zh_TW).
External services
This plugin connects to the lihi short URL service to identify the WordPress site, authenticate the site administrator, and create or look up short URLs. Without an internet connection the plugin cannot function.
Service: lihi WordPress API auth endpoints (https://app.lihi.com/api/wordpress/v1/auth)
When data is sent: when an administrator submits Register, Login, or Logout on Settings → lihi Short URL; when Login exchanges its short-lived authorization code; when any protected API rejects the access token and the plugin attempts one token refresh; and once during plugin uninstall when a local session is available.
What is sent for Register: the entered email and password plus the WordPress site’s hostname. The request also carries normal network metadata such as source IP and User-Agent, which lihi uses to check registration availability and record the registration country and device. Account-creation consent is checked locally before the request. A successful registration only sends a verification email; it returns no login credentials and does not connect the plugin.
What is sent for Login: the entered email and password, the WordPress site’s hostname, and a PKCE challenge generated by WordPress PHP. The server returns a short-lived authorization code; WordPress sends that code with the matching verifier retained only in PHP memory to exchange it for a server-issued UUID, access token, and refresh token.
What is sent for refresh: the stored server-issued UUID and current refresh token. A successful refresh returns a new access token and a rotated refresh token.
What is sent for Logout or uninstall: the stored access token in the Authorization header. No request body is sent. This one-shot request is not refreshed or retried; network or API failure is ignored so local Logout/uninstall cleanup still finishes.
What WordPress stores: one non-autoloaded credential option containing the email, UUID, access token, and raw refresh token. The password, PKCE verifier, challenge, and authorization code are not stored after the request.
Service: lihi WordPress API protected endpoints (https://app.lihi.com/api/wordpress/v1)
When data is sent: when a connected administrator opens the settings page to display account information, opens the work-group switcher, or confirms a work-group change; when the Create modal loads redirect-domain and UTM options; when an administrator opens the lihi dashboard through passthrough; and when a user clicks “Create”, “Copy”, or “Edit” to generate, look up, copy, or edit a short URL. Media Create modals hide UTM controls and submit blank UTM values.
What is sent: the stored access token; when switching work groups, the selected numeric group ID or null for the personal work group; the post or attachment URL (permalink or attachment file URL, with entered UTM parameters appended); the post type namespace including the WordPress hostname; the post ID; the selected redirect domain; selected tags as a comma-separated string; and, when requesting browser passthrough, a browser-generated PKCE challenge plus an optional target such as a short URL or lihi dashboard path.
Service: browser-facing lihi pages (https://lihi.io, https://app.lihi.com, and https://lihidomain.com)
When data is sent: only after a user clicks the lihi dashboard, password-reset, personal-domain, or verification-email link.
What is sent: the browser’s normal request metadata. Connected dashboard links additionally carry the short-lived passthrough nonce and browser verifier described above; verification links carry the one-time registration token from the email. Public home, password-reset, and public domain-information links receive no account credentials from the plugin.
By using the plugin you agree that the data above is transmitted to the lihi service. Please review the lihi service’s legal documents:
Terms of Use: https://knowledge.lihi.io/terms/
Privacy Policy: https://knowledge.lihi.io/privacy-policy/
