Activity Link Preview For BuddyPress vs Stream – Activity Log & Audit Trail

Activity Link Preview For BuddyPress turns a plain URL into a rich card. When a member pastes a link into the activity composer or a comment, the plugin reads the page, pulls a title, description and image, and shows a preview card before they post. Saved previews render server-side, so they still display when JavaScript is off. It needs BuddyPress or BuddyBoss Platform active. There is no settings page: previews work as soon as you activate the plugin, and developers can change behaviour through filters. What you get Rich previews as members type * Detects URLs as they are typed or pasted into the activity form. * Shows title, description and a featured image in a card the member can review before posting. * Multiple image selection: when a page offers several images, prev and next buttons let the member pick one, with an “Image X of Y” counter. * The preview clears itself when the URL is removed from the composer, and blocked or invalid URLs show an inline error instead of failing quietly. Internal member and group cards, with no HTTP request * Sharing a link to a member profile on your own site (/members/username/) builds a card from your database: display name, the XProfile About text, and the member’s avatar. * Sharing a link to a group (/groups/group-slug/) builds a card with the group name, description and group avatar. * Because this reads locally, there is no self-request and no external fetch, which keeps busy sites fast. Comments and embeds * Link previews work in activity comments and replies, not just top-level posts. * Native embeds for Twitter/X and Facebook. * Inline video and rich embeds via WordPress oEmbed (YouTube, Vimeo and other providers WordPress supports). * Short URLs (bit.ly, tinyurl and similar) are resolved to the real destination before the preview is built. Fast and safe by default * Per-URL caching, plus 15-minute negative caching so a slow or unreachable link is not retried on every render. * Comment rendering never fetches remote URLs, so a dead link cannot delay a page load. * SSRF protection blocks localhost, private and reserved IP ranges, and re-validates redirect targets. * Nonce verification, logged-in-only parsing, and sanitized and escaped output. Works alongside your platform * On BuddyBoss Platform with its own link preview enabled, this plugin stands down so you never get two cards on one post. * On Youzify with its wall URL preview enabled, it does the same. * Preview data is included in the BuddyPress REST API activity response. Developer friendly * bp_activity_link_preview_load_assets – control which pages load the CSS, JS and social SDKs. * bp_activity_parse_url_preview – filter the preview data returned by the parse endpoint. * bp_activity_link_parse_url – filter the parsed result before it is returned. * bp_activity_link_parse_url_shorten_url_provider – add or remove short-URL providers to resolve. * bp_oembed_discover_support – opt in to oEmbed discovery for unknown providers. * bp_activity_link_preview_enable_comments – turn preview handling in activity comments on or off. Perfect For BuddyPress and BuddyBoss communities where members share articles, videos and news Groups that use the activity stream as a reading or link-sharing feed Communities that link internally to member profiles and groups Any activity stream that currently shows bare, unclickable-looking URLs Premium Support Our support team can help with setup, theme compatibility and troubleshooting. Reach us through the links below. Documentation Documentation and Support – Setup walkthrough and usage guides for every Wbcom plugin Translations English (default) Ready for translation in your language with the included POT file RTL language support included Links Plugin Homepage Documentation Support Request Features Compatibility WordPress 6.5 and higher PHP 8.0 and higher BuddyPress 6.0+ or BuddyBoss Platform (required – the plugin deactivates itself if neither is active) Tested with popular themes including BuddyX, Reign and Youzify What’s New in 1.7.4 A performance and security pass. Plugin assets and the Twitter and Facebook SDKs now load only in activity contexts instead of on every page. Failed link lookups are cached for 15 minutes and comment rendering never fetches remote URLs, so slow links no longer hold up a page. Blocked or invalid URLs now report the problem in the composer, scraped titles and descriptions are sanitized before saving, and short-URL resolution re-validates its redirect target against the SSRF guard. Third-Party Services This plugin renders native Twitter/X and Facebook embeds. Those embeds can only be rendered by each network’s own script, so the plugin loads that script directly from the network: Twitter/X widgets.js, loaded from platform.twitter.com. Terms of service: https://twitter.com/en/tos – Privacy policy: https://twitter.com/en/privacy Facebook SDK, loaded from connect.facebook.net. Terms of service: https://www.facebook.com/terms.php – Privacy policy: https://www.facebook.com/privacy/policy/ These scripts load only on BuddyPress activity screens (the activity directory, member activity and group screens), never site-wide. On those screens they load whether or not a Twitter or Facebook link is actually present, so the visitor’s browser contacts Twitter and Facebook on every activity page view. Those services can therefore see the visitor’s IP address, user agent and referring page, and may set their own cookies. If your site needs to avoid that (for example to satisfy a consent requirement), use the bp_activity_link_preview_load_assets filter to stop the assets loading: add_filter( 'bp_activity_link_preview_load_assets', '__return_false' ); No data is sent to Wbcom Designs, and the plugin itself collects nothing. More Free Tools from Wbcom Designs Rich link previews make your activity stream worth reading, but a stream is only one part of a community. These other free tools from Wbcom Designs fill in the rest of the space your members spend time in, from the theme and social network itself to forums, media, events, gamification, directories, jobs, and courses. BuddyX – A free, fast community theme for BuddyPress, BuddyBoss and PeepSo with a modern layout and dark mode. BuddyNext – Stand up a complete WordPress community with activity streams, member spaces, profiles, direct messaging, and built-in moderation. Jetonomy – Add forums, question-and-answer boards, and idea spaces that stay tidy through trust-based auto-moderation even past 100,000 topics. Mediaverse – Let members build photo and video albums, react, follow each other, and message privately while AI moderation keeps things clean. Eventonomy – Run community events with RSVPs, calendars, and front-end submissions. WB Gamification – Reward members with points, badges, and leaderboards to keep engagement high. Listora – Publish searchable directories across ten listing types with reviews, maps, and member-submitted entries from the front end. WP Career Board – Add a job board with front-end listings, applications, and employer profiles. Learnomy – Build and sell online courses, auto-grade quizzes, collect payments, and award certificates when learners finish.

Stream is a complete activity log and audit trail for your WordPress site: see what changed, who changed it, and when. From plugin activations to post edits, login attempts to new user creation, every user and system action is recorded in an audit log built for debugging, security monitoring, and compliance. Every logged action is displayed in an activity stream and organized for easy filtering by User, Role, Context, Action or IP address. Admins can highlight entries in the activity log—such as suspicious user activity—to investigate what’s happening in real time. Stream also lets you configure email alerts and webhooks for integrations like Slack and IFTTT, so your team knows the moment something goes wrong. Stream keeps its own logs healthy too: records are automatically purged on the retention schedule you choose, with batched deletion and orphaned-data cleanup that stay reliable even on very large sites. Stream is also AI-ready: its abilities are exposed through the WordPress Abilities API and MCP Adapter, so AI assistants and other tools can securely query your site’s activity records. For advanced users, Stream supports a network view of all activity records on your Multisite, exclude rules to ignore certain kinds of user activity, and a WP-CLI command for querying records. Stream is free and fully open source — development happens in the open on GitHub, maintained by XWP. With Stream’s powerful activity logging, you’ll have the information you need to responsibly manage your WordPress sites. Built-In Tracking Integrations For Popular Plugins: Advanced Custom Fields bbPress BuddyPress Easy Digital Downloads Gravity Forms Jetpack Two Factor User Switching WooCommerce Yoast SEO Built-In Tracking For Core Actions: Posts Pages Custom Post Types Users Themes Plugins Tags Categories Custom Taxonomies Settings Custom Backgrounds Custom Headers Menus Media Library Widgets Comments Theme Editor WordPress Core Updates Other Noteworthy Features: Multisite view of all activity records on a network Limit who can view user activity records by user role Set exclude rules to ignore certain kinds of user activity Live updates of user activity records in the Stream Export your Activity Stream as a CSV or JSON file WP-CLI command for querying records Configuration Most of the plugin configuration is available under the “Stream” → “Settings” page in the WordPress dashboard. Request IP Address The plugin expects the $_SERVER['REMOTE_ADDR'] variable to contain the verified IP address of the current request. On hosting environments with PHP processing behind reverse proxies or CDNs the actual client IP is passed to PHP through request HTTP headers such as X-Forwarded-For and True-Client-IP which can’t be trusted without an additional layer of validation. Update your server configuration to set the $_SERVER['REMOTE_ADDR'] variable to the verified client IP address. As a workaround, you can use the wp_stream_client_ip_address filter to adapt the IP address: add_filter( 'wp_stream_client_ip_address', function( $client_ip ) { // Trust the first IP in the X-Forwarded-For header. // ⚠️ Note: This is inherently insecure and can easily be spoofed! if ( ! empty( $_SERVER['HTTP_X_FORWARDED_FOR'] ) ) { $forwarded_ips = explode( ',' $_SERVER['HTTP_X_FORWARDED_FOR'] ); if ( filter_var( $forwarded_ips[0], FILTER_VALIDATE_IP ) ) { return $forwarded_ips[0]; } } return $client_ip; } ); ⚠️ WARNING: The above is an insecure workaround that you should only use when you fully understand what this implies. Relying on any variable with the HTTP_* prefix is prone to spoofing and cannot be trusted! Known Issues We have temporarily disabled the data removal feature through plugin uninstallation, starting with version 3.9.3. We identified a few edge cases that did not behave as expected and we decided that a temporary removal is preferable at this time for such an impactful and irreversible operation. Our team is actively working on refining this feature to ensure it performs optimally and securely. We plan to reintroduce it in a future update with enhanced safeguards. Contribute There are several ways you can get involved to help make Stream better: Report Bugs: If you find a bug, error or other problem, please report it! You can do this by creating a new topic in the plugin forum. Once a developer can verify the bug by reproducing it, they will create an official bug report in GitHub where the bug will be worked on. Translate into Your Language: Use the official plugin translation tool to translate Stream into your language. Suggest New Features: Have an awesome idea? Please share it! Simply create a new topic in the plugin forum to express your thoughts on why the feature should be included and get a discussion going around your idea. Issue Pull Requests: If you’re a developer, the easiest way to get involved is to help out on issues already reported in GitHub. Be sure to check out the contributing guide for developers. Thank you for wanting to make Stream better for everyone! View contributors here.