CommentMate Documentation

Use single-site WordPress 6.5 or later and PHP 8.1 or later, with HTTPS, Sodium and InnoDB. Choose supported PHP 8.3 or later hosting where possible. Image attachments and screenshots need GD; WebP needs GD WebP support and PDF validation needs Fileinfo. Download review needs PHP ZIP support.

Encrypted private files need a writable, durable folder outside every public website folder. Advanced reports local hosting checks. Your host must also exclude review-mode pages, CommentMate REST responses and reviewer cookies from every page cache or CDN.

Back up the database, private files, normal website files, Media Library uploads and the site security settings in wp-config.php securely. Test a recovery before relying on the backup.

Install the CommentMate ZIP and activate it. Open CommentMate as an administrator and claim the designated owner. Only this owner manages review data; another administrator does not automatically gain access.

Check Notifications before sharing. Copy the private link and give it only to intended reviewers. Anyone with the active link can join the site’s review. Do not publish the link or include it in screenshots.

Use the Before your first review checklist below Review link to check hosting, backups, notification recipients and a real test email before inviting reviewers.

Reviewers open the private link, choose a display name and select the relevant page content. Add the requested change and any helpful attachment.

The sidebar shows feedback; it does not simulate other screen sizes. Mobile includes touch creation and replies; desktop remains recommended for full review work. Physical mobile keyboards and touch hardware remain unverified.

Page headings in the feedback sidebar collapse and expand their comments. Selecting a pin reopens its page group. Native scrollbar boundary markers are omitted because accurate positions cannot be guaranteed across browsers and changing content.

Open the uploaded image preview. Save to Media Library creates a WordPress media item from the original. These files are ordinarily publicly accessible, even though the review attachment was private.

Use the compression controls to choose a maximum width and compression quality, and select WebP when useful. Save the smaller copy to the Media Library or download it. The original remains unchanged; an identical saved compression is reused.

A saved image remains after review cleanup. PDFs and unsaved private review files are removed when you confirm that review’s deletion.

The signed-in owner can leave feedback without a guest session. Set the display name, initially Admin, to make replies clear. Use threaded replies for discussion and the copy control for suggested wording.

Only the designated owner can approve or reopen feedback. Reviewers can edit and delete their own comments while sharing is active.

Done! Notify Admin is a completion notification. It is enabled on fresh installs and initially targets the site administrator. Automatic daily and immediate notifications are off by default. Existing settings are retained on upgrade.

Confirm the recipients and check an actual delivered test email before relying on notifications. Depending on the alert, messages can contain reviewer names, page references, counts and feedback excerpts. A successful WordPress mail handoff does not prove inbox delivery.

A failed completion handoff can be retried. Completing a review notification does not stop sharing.

Beneath Notifications settings, the owner can inspect failure counts and last-attempt times for up to 20 recent retained reviews and retry a current failed notification. Reload the page if its state changed. Other administrators and reviewers cannot inspect or retry these failures. Raw SMTP payloads, recipients and private content are not included in diagnostics.

Click Stop sharing. After the link and reviewer sessions are revoked, CommentMate offers Keep review data or Delete review data. Keeping or dismissing the offer leaves the data intact and sharing stopped.

Deletion requires a second confirmation. It removes the stopped review’s comments, replies, screenshots and unsaved private attachments permanently. Saved original and compressed Media Library images remain, as do reusable owner and notification settings.

If cleanup fails, sharing stays stopped and the progress checkpoint and encryption key are retained until verification succeeds. Resolve the reported issue, then retry or use Continue deleting data in Advanced. An old confirmation cannot delete a resumed or different review.

Feedback, display names, page URLs, anchors, replies and audit events are stored in the site database. Private attachments and screenshots are encrypted outside public web roots. Share secrets and reviewer sessions are hashed for authentication; an encrypted active secret allows the owner to copy the same link again.

Screenshots can include visible page content. Avoid confidential material and personal details. Media Library saving changes the file’s exposure: the resulting WordPress media is ordinarily public.

Each upload is limited to 5 MB; each message accepts up to three images and one PDF. Private storage defaults to 100 MiB. The designated owner can choose 25–250 MiB in Advanced, immediately below the private storage status, then click Save storage limit. Lowering the limit never deletes existing files. Feedback capacity appears below Private storage. The feedback budget is 25 MiB and 2,000 stored entries, including comments and their initial messages. Soft-deleted records count until full cleanup.

Open Advanced → Data management and click Download review. The ZIP includes summary.html for readable comments and replies, structured review data and available private attachments. Open summary.html from the extracted folder so its attachment links work.

Images saved to the Media Library are referenced rather than copied into this archive. Missing files are identified as unavailable. The archive excludes access secrets and is a private review record, not a complete website recovery backup.

In Advanced, Ownership appears immediately below Data management. Choose an existing administrator, read the explanation, tick the confirmation and click Transfer ownership.

Existing links and reviewer sessions stop. The previous owner loses CommentMate access. Retained feedback and files remain, but email notifications are paused and recipients cleared. The new owner must review Notifications and restart sharing with a new link.

Recovery appears only if the recorded owner account no longer exists. Another site administrator can explicitly recover ownership to their own account. Recovery keeps feedback and any unfinished cleanup; it does not silently delete data. A running cleanup must finish its current protected step first.

Back up the database, all registered private-storage directories, uploads and wp-config.php. Confirm the backup can restore a private attachment and a saved Media Library image.

Deactivate CommentMate without clicking Delete. Replace the existing commentmate folder in place using the verified 1.0.4 ZIP, then reactivate. Keep the folder and main file names unchanged. The old signed updater must be inactive during replacement.

Confirm ownership, notification settings, comments, replies, private attachments and saved media. Do not uninstall and reinstall to update: WordPress Delete may erase review data. Free uses the WordPress.org update system after directory publication.

Keep the database, every registered private-storage directory, uploads, install identity, review keys and wp-config.php authentication salts together. An ordinary wp-content-only or database-only backup can omit essential encrypted files or keys.

Restore these together and verify that a retained attachment decrypts and saved media opens before discarding the backup. Do not rotate salts or manually remove encryption keys while encrypted files are needed.

Deactivation keeps data. WordPress Delete erases plugin data by default; turn off Erase data when this plugin is deleted first if you intend to keep it. Media Library items remain either way.

Use Advanced to check storage, encryption, database and cache warnings. Where no durable private parent can be established automatically, ask your host to configure COMMENTMATE_PRIVATE_STORAGE_DIR in wp-config.php before activation.

If an old install reports temporary storage, back it up and arrange durable storage before relying on long-term retention. Do not move files independently of the install identity, registered roots and keys.

For help, contact PluginHub. Keep private review links and attachments out of public support messages.

On phones, open the collapsed sidebar to choose Comment or Browse. Tap ordinary page content in Comment mode to create feedback; use Reply for a discussion. The composer follows the visible viewport and provides touch controls. Desktop remains recommended for full review work.

Click outside a new composer to minimise it, then use Resume unfinished comment. Failed saves retain text and files; failed file uploads can be retried against the already saved comment or reply without duplicating its text. Finish and Discard ask before losing unfinished work.

Private drafts and files remain only in the current tab’s memory. Reload, full navigation and tab close lose them after the browser leave warning. Same-document navigation retains and minimises a draft; return to its original page before saving. Revoked or replaced access clears private recovery state.

Physical iOS Safari/Android Chrome, real keyboards/touch hardware, Firefox/Edge and several builder render/TLS cases remain unverified. The exact 1.0.4 archive was checked in desktop Chrome and emulated phone/tablet layouts. Earlier optional-work evidence also covers desktop Safari and six builder service/enqueue labs, with render/TLS gaps; this does not establish support for every builder or device. Individual reviewer invitations/expiry, full filtering and Pro features are deferred.

If a pin’s popup shows Placement may have moved — repair pin, the signed-in owner can select that action and click a replacement target on the same page. Correctly placed comments do not offer repair. Reload if another repair changed the saved anchor.

The placement warning comes from the owner browser’s current page. The server checks ownership, nonce, original anchor and page identity; it does not independently detect where the page element belongs.