DoubleSharp
Remote Content Shortcode
Content integrationGitHub
Remote Content Shortcode
Remote Content Shortcode brings content from a public HTTP or HTTPS endpoint into a WordPress post or page. Select a fragment with CSS, remove unwanted elements, rewrite relative links and choose how long responses stay fresh. The version 2 development source includes a shortcode, a Remote content block and administrator tools for building and inspecting imports. Free works independently. A separate Pro add-on adds reusable sources, templates, scheduled refreshes and OAuth.
Add a shortcode or Remote content block
The version 2 source requires WordPress 6.6+, PHP 8.2+ with DOM, and cURL 7.49+. Its CSS selector dependency is bundled in the plugin package. Add the Remote content block and configure its source URL, selection, fallback and cache options, or use a Shortcode block with remote_content. The block uses GET; the shortcode also supports POST. Editor previews run through the same protected renderer and bypass visitor caching.
Bring a remote fragment into WordPress
Choose the source
Use a public endpoint whose content you have permission to reproduce. Decide which response fragment belongs on the WordPress page.
Select and transform
Choose CSS selectors, remove unwanted elements and enable relative URL rewriting when needed. Use entity encoding to display source code as text.
Set freshness and fallback
Choose a cache lifetime, an optional stale-response window and fallback text for failed or empty imports.
Preview and publish
Test the import under Tools > Remote content, then check the published result as a logged-out visitor. Editor tests bypass the public response cache.
Import a fragment and keep its links working
This example imports the main element, removes advertisements and resolves supported relative links and images against the source's final URL. Remote HTML is sanitized with WordPress post-HTML rules after transformations. Scripts, event handlers and other disallowed markup are removed.
[remote_content url="https://example.com/article" selector="main" remove="script, .advertisement" rewrite_urls="true"]Choose what visitors see during an outage
Free caches unauthenticated GET responses for logged-out visitors in a persistent object cache or expiring database transients. The default fresh lifetime is one hour. A separate stale_ttl can retain the last successful response for a limited period if refreshing fails. This example keeps a response fresh for five minutes, allows one extra hour of stale fallback, and supplies text when no eligible response is available. Authenticated requests, POST requests, logged-in renders and editor previews bypass response caching.
[remote_content url="https://example.com/status" selector=".status" cache_ttl="300" stale_ttl="3600" fallback="Status is temporarily unavailable."]Build and inspect imports in Free
Tools > Remote content includes Builder, Connections, Cache, Usage and Help. Generate a copyable shortcode, test selectors and inspect HTTP status, match counts, sanitized output and HTML source. Connections stores encrypted Basic, Bearer or API-key credentials behind aliases scoped to an exact HTTPS origin, endpoint path and permitted methods. Cache can clear one exact source URL or this plugin's indexed entries. Usage finds local shortcode and block references without fetching their sources. Help provides an environment summary for support.
Keep credentials out of post content
Use userpwd to name an administrator-configured alias. Never place a password or token in a shortcode, block or source URL. Managed secrets are encrypted using keys derived from the WordPress salts, so preserve salts with the database and re-enter secrets after rotating them. A credential authorizes the upstream request; selected content on a public page is still visible to that page's audience. Authenticated requests do not follow redirects or use the public response cache.
[remote_content url="https://docs.example.com/public-summary" userpwd="docs_api"]Reuse sources and schedule refreshes with Pro
Pro installs alongside Free 2.0 or later. Save an HTML or JSON source once and reuse its stable ID in the Saved remote source block or remote_content_source shortcode. JSON templates escape inserted values before permitted HTML is returned. Pro also adds scheduled GET refreshes, OAuth connections, refresh history, opt-in alerts, delegated management of public sources and bounded multisite operations. Authenticated sources stay administrator-owned. Persisting their encrypted snapshots requires explicit opt-in; POST refreshes remain individual manual actions.
[remote_content_source id="SOURCE-UUID"]Upgrade existing imports deliberately
Version 2 accepts public destinations only, validates redirect destinations and verifies TLS. Local files, private networks, executable remote markup, compressed responses and jQuery-only selectors such as :eq() are unsupported. Replace implicit credential lookups with scoped aliases and check selectors on a staging copy. Responses must stay below 1 MiB, and selector work is bounded. Public response storage is limited to 32 entries and 8 MiB per site. Fresh and additional stale lifetimes each have a one-day maximum. Follow the source upgrade guide for the complete migration rules.
Current development and update availability
The repositories now contain separate Free and Pro version 2.0 plugins. At this update, the public Free repository has no published GitHub releases. WordPress.org still lists version 1.5 and remains closed for a security issue; that listing is not a download for the new code. Use the current source documentation when evaluating the development version. Pro update delivery uses a separately configured Double Entitle service. Its update license controls downloads and updates, while installed features continue working without an active license or during a service outage.