PagePin – Client Feedback & Bug Reporting vs Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)

PagePin gives WordPress agencies and developers two tools for client feedback and bug reporting — Pinshots for screenshot-based bug reports and Pinpoints for DOM-based comment threads. Self-hosted, GDPR compliant, no cloud dependencies. Pinshots — Bug Reporting Screenshot-based feedback with visual markers. Place numbered markers anywhere on the page, add notes, and capture everything in a single screenshot. Perfect for quick bug reports, design reviews, and client feedback rounds. Three Marker Types — Negative (red) for bugs, Positive (green) for approvals, Note (orange) for comments One-Click Screenshots — Capture the current page instantly with all markers included Email Delivery — Send feedback with screenshot attachment to up to 5 recipients Custom Watermark — Brand every screenshot with your own text Adjustable Compression — Image quality from 10% to 100% Undo/Redo — Ctrl+Z / Ctrl+Y to undo and redo marker placements Drag & Drop — Reposition markers by dragging them to the correct location Pinpoints — Client Feedback DOM-based comment threads attached directly to page elements — like Google Docs comments, but for your live website. Comments persist even when the page layout changes, making it ideal for ongoing collaboration and iterative design feedback. Element-Attached Threads — Click any element to start a comment thread on it Smart Element Matching — Comments survive layout changes through CSS selectors, content fingerprinting, and multi-signal scoring @Mentions — Mention team members or external guests in comments to notify them Resolve & Reopen — Mark threads as resolved and reopen them when needed Sidebar Overview — All pinpoints listed in a slide-out sidebar with unread badges Visual Indicators — Numbered badges on the page show where pinpoints are attached Tag System — Organize pinpoints with custom colored tags (Bug, Design, Content, Urgent, or your own) How It Works Pin — Press Ctrl+Alt+F (or click the floating button) and click anywhere on your site Capture — Screenshot, element position, and browser context are captured automatically Ship — Feedback is delivered to your inbox or discussed in a pinpoint thread Key Features Screenshots & Markers Three annotation tools with automatic numbering Keyboard shortcuts: Ctrl+Alt+F to activate, keys 1/2/3 for tool selection Customizable floating feedback button with inactivity auto-hide Dual screenshot engines (html2canvas and html-to-image) Touch support for tablets and mobile devices Collaboration External Collaborators — Invite anyone via Magic Link email or shareable URL (no WordPress account needed) Collaborator Reuse — Grant existing guests access to additional pinpoints without creating new links @Mention Notifications — Mention collaborators in comments to send email notifications with Magic Link access Auto-Grant Access — Mentioning a collaborator automatically grants them access if they don’t have it yet Share Modal — Internal link for team members, external sharing with guest dropdown or new guest creation Thread Notifications — All thread participants (including collaborators) are notified of new comments Configurable Link Expiry — Set Magic Links to expire after 7, 30, or 90 days Admin & Management Admin dashboard with feedback statistics and quick links Feedback overview with status filters (New, Sent, Resolved) and bulk actions Post/Page metabox showing pinpoint count per content Admin bar integration with live feedback counter badge Collaborator management with type display, inline email editing, and access control Tag management with custom colors and usage statistics 8-step setup wizard for first-time configuration Security & Access Control Role-based access — control who can create, view, and resolve feedback Granular pinpoint permissions (create, view, resolve per role) Spam protection: honeypot, submission timing, rate limiting with escalation Optional CAPTCHA: reCAPTCHA v2/v3, hCaptcha, Cloudflare Turnstile Rate limit escalation (5 min → 15 min → 1 hour → 6 hours → 24 hours) Privacy & Standards 100% self-hosted — your server, your database, your data GDPR compliant — no external calls unless CAPTCHA is enabled Clean uninstall — all data removed when plugin is deleted Multilingual — English and German included, translation-ready WordPress Coding Standards (WPCS 3.0) and PHPStan Level 5 Use Cases Web Agencies — Collect and manage client feedback across projects Developers — QA testing, bug reporting, and code review workflows Support Teams — Visual bug reports from users with full context Design Reviews — Attach comments to specific design elements for iterative feedback Content Teams — Request page changes with visual annotations Client Onboarding — Share feedback links with clients who don’t have WordPress accounts Public Feedback Mode Enable public feedback to allow website visitors (even without login) to submit visual feedback. Protected by multiple spam prevention measures: Honeypot fields Submission timing checks Rate limiting per IP and session Optional CAPTCHA (reCAPTCHA v2/v3, hCaptcha, Cloudflare Turnstile) For more information visit pagepin.io Support Website: pagepin.io Support: [email protected] Third Party Services This plugin connects to external services ONLY when you explicitly enable CAPTCHA protection: Google reCAPTCHA (v2 or v3) When enabled, user interaction data is sent to Google for spam verification. * Service: https://www.google.com/recaptcha/ * Privacy Policy: https://policies.google.com/privacy * Terms of Service: https://policies.google.com/terms hCaptcha When enabled, user interaction data is sent to hCaptcha for spam verification. * Service: https://www.hcaptcha.com/ * Privacy Policy: https://www.hcaptcha.com/privacy * Terms of Service: https://www.hcaptcha.com/terms Cloudflare Turnstile When enabled, user interaction data is sent to Cloudflare for spam verification. * Service: https://www.cloudflare.com/products/turnstile/ * Privacy Policy: https://www.cloudflare.com/privacypolicy/ * Terms of Service: https://www.cloudflare.com/website-terms/ Important: No data is sent to external services unless you explicitly enable CAPTCHA in the plugin settings. Without CAPTCHA, the plugin operates entirely on your own server. Privacy Data Collection This plugin collects and stores the following data locally on your WordPress server: For authenticated users (logged-in): * User ID (WordPress user reference) * Feedback content (screenshots, markers, messages) * Page URL where feedback was submitted * Timestamp For public/anonymous feedback (when enabled): * Email address (if provided by the visitor) * IP address (for rate limiting only) * Session token (anonymous identifier) * Feedback content (screenshots, markers, messages) * Page URL and timestamp For external collaborators (when enabled): * Display name * Email address (optional, for Magic Link invitations and @mention notifications) * Authentication token (for session-based access) * Access grants (which pinpoints the collaborator can view) * Last access timestamp Data Retention Feedback data: Stored until manually deleted by an administrator Rate limiting data (IP/Session): Automatically deleted after 24 hours Screenshots: Stored until feedback is deleted Collaborator data: Stored until manually deleted by an administrator Data Location Database: WordPress database tables (prefixed with your WordPress table prefix) Screenshots: /wp-content/uploads/pagepin/ directory GDPR Compliance All data is stored locally on your server No analytics or tracking is performed No data is shared with third parties (unless CAPTCHA is enabled) Data can be exported and deleted upon request via WordPress admin IP addresses are pseudonymized after rate limit period Consent For public feedback mode, we recommend: * Linking to your privacy policy in the feedback form * Enabling the GDPR consent checkbox in plugin settings * Informing visitors about data collection in your site’s privacy policy

Easily improve site security with WordPress Hardening, Two-Factor Authentication (2FA), Login Protection, Vulnerability Detection and SSL certificate. Really simple, Effective and Performant WordPress Security Really Simple Security is the most lightweight and easy-to-use security plugin for WordPress. It secures your WordPress website with SSL certificate generation, including proper 301 https redirection and SSL enforcement, scanning for possible vulnerabilities, Login Protection and implementing essential WordPress hardening features. We believe that security should have the absolute minimum effect on website performance, user experience and maintainability. Therefore, Really Simple Security is: Lightweight: Every security feature is developed with a modular approach and with performance in mind. Disabled features won’t load any redundant code. Easy-to-use: 1-minute configuration with short onboarding setup. Security Features Easy SSL Migration Migrates your website to HTTPS and enforces SSL in just one click. 301 redirect via PHP or .htaccess Secure cookies Let’s Encrypt: Install an SSL Certificate if your hosting provider supports manual installation. Server Health Check: Your server configuration is every bit as important for your website security. WordPress Hardening Tweak your configuration and keep WordPress fortified and safe by tackling potential weaknesses. Prevent code execution in the uploads folder Prevent login feedback and disable user enumeration Disable XML-RPC Disable directory browsing Username restrictions (block ‘admin’ and public names) and much more.. Vulnerability Detection Get notified when plugins, themes or WP core contain vulnerabilities and need appropriate action. Login Protection Allow or enforce Two-Factor Authentication (2FA) for specific user roles. Users receive a two-factor code via Email. Improve Security with Really Simple Security Pro Protect your site with all essential security features by upgrading to Really Simple Security Pro. Advanced SSL enforcement Mixed Content Scan & Fixer. Detect files that are requested over HTTP and fix them to HTTPS, both Front- and Back-end. Enable HTTP Strict Transport Security and configure your site for the HSTS Preload list. Firewall Really Simple Security Pro includes a performant and efficient WordPress firewall, to stop bots, crawlers and bad actors with IP and username blocks. 404 blocking – Blocks crawlers as they trigger unusual numbers of 404 errors. Region blocking – Only allow/block access to your site from specific regions. Automated and customisable Firewall rules. IP blocklist and allowlist. Security Headers Security headers protect your site visitors against the risk of clickjacking, cross-site-forgery attacks, stealing login credentials and malware. Independent of your Server Configuration, works on Apache, LiteSpeed, NGINX, etc. Protect your website visitors with X-XSS Protection, X-Content-Type-Options, X-Frame-Options, a Referrer Policy and CORS headers. Automatically generate your WordPress-tailored Content Security Policy. Vulnerability Measures When a vulnerability is detected in a plugin, theme or WordPress core you will get notified accordingly. With Vulnerability Measures, you can configure simple but effective measures to make sure that a critical vulnerability won’t remain unattended. Force update: An update process will be tried multiple times until it can be assumed development of a theme or plugin is abandoned. You will be notified during these steps. Quarantine: When a plugin or theme can’t be updated to solve a vulnerability, Really Simple Security can quarantine the plugin. Advanced Site Hardening Choose a custom login URL Automated File Permissions check and fixer Rename and randomize your database prefix Change the debug.log file location to a non-public folder Disable application passwords Control admin creation Disable HTTP methods, reducing HTTP requests Login Protection Secure your website’s login process and user accounts with powerful security measures. Two-Step verification (Email login) 2FA (two factor authentication) with TOTP Passwordless login with passkey login Enforce strong passwords and frequent password change Limit Login Attempts With Limit Login Attempts you can configure a threshold to temporarily or permanently block IP addresses or (non-existing) usernames. You can also throw a CAPTCHA after a failed login (hCaptcha or Google reCaptcha) Access Control Restrict access to your site for specific regions. Add specific IP addresses or IP ranges to the Blocklist or Allowlist. Useful Links Documentation Security Definitions Translate Really Simple Security Issues & pull requests Feature requests Love Really Simple Security? If you want to support the continuing development of this plugin, please consider buying Really Simple Security Pro, which includes some excellent security features and premium support. About Really Simple Plugins Our mission is to make complex WordPress requirements really easy. Really Simple Security is developed by Really Simple Plugins. For generating SSL certificates, Really Simple Security uses the le acme2 PHP Let’s Encrypt client library, thanks to ‘fbett’ for providing it. Vulnerability Detection uses WP Vulnerability, an open-source initiative by Javier Casares. Want to join as a collaborator? We’re on GitHub as well!