Show a maintenance page and share preview access
Use Maintenance mode under Settings → POM Tweaks → Content → Maintenance to replace public frontend pages while work is in progress. Site administrators configure the page and can share a private preview link with reviewers who do not have a WordPress account.
Logged-in users continue to see the normal site. Logged-out visitors without valid preview access receive the maintenance page with HTTP 503, a one-hour retry hint, and instructions not to cache or index that response.
Configure the maintenance page
- Enable Maintenance mode and select Save.
- Set Browser tab title.
- Choose Custom HTML or Existing page under Display.
- For custom mode, enter body markup in Maintenance HTML and styles in Maintenance CSS. Safe HTML is supported; scripts are not part of this field.
- For page mode, enter Maintenance page ID. Use a published page without a password. Its page template and content appear at the visitor's requested URL; visitors are not redirected to that page's permalink.
- Keep suitable HTML and CSS configured as a fallback. A missing, private, password-protected or unavailable page uses this fallback instead of exposing the original requested content.
- Save, then purge existing page caches and check the result in a signed-out browser.
On multisite, the setting applies only to the current site. The page ID must belong to that site. The custom HTML page is standalone; page mode uses the active theme's page template and integrations.
Give a reviewer temporary preview access
- Under Preview token, keep the generated value or select Generate new preview token.
- Select Save before using or sharing the new link.
- Use Preview website with saved token. Site administrators also see Preview website in the maintenance notice.
- Copy the link for the intended reviewer. Anyone who has it can preview the public frontend, so keep it private.
- Ask the reviewer to open it in the browser they will use for testing. After validation, the token is removed from the address bar and that browser can navigate the site for two days.
The preview cookie is limited to the current site and is unavailable to JavaScript. It is sent only over HTTPS when the site uses HTTPS. A valid new link replaces stale preview access. Preview access does not sign the reviewer in, grant an administration role, or unlock WordPress content that separately requires authentication or a password.
The link itself remains valid until its token changes; the two-day lifetime applies to each browser's preview cookie. Select Generate new preview token and save to revoke old links and cookies. Clear Preview token and save to disable preview links entirely. After a cookie expires, reopening a still-valid link starts another two-day session.
Scope and caching
Maintenance covers frontend template requests, including feed requests that reach WordPress. Login, administration, REST, AJAX, cron and command-line operations remain available. Uploaded files and responses served directly by a web server or CDN do not pass through this setting. This is a temporary presentation feature, not an access-control boundary for confidential information.
The module prevents caching of the responses it handles, including token exchanges and previews. Existing server, CDN or full-page caches can answer before WordPress runs: purge or pause them when enabling maintenance, and ensure they do not serve stored public pages or cache preview responses. Purge again after disabling maintenance so visitors immediately see the normal site.
If a CDN or reverse proxy forwards only selected cookies, allow the wordpress_pom_maintenance_* preview cookies through to WordPress and exclude requests carrying them from shared page caching. The preview cookie is separate from WordPress login cookies and does not sign the visitor in. Browser cookies must remain enabled, including in a private window; open the saved preview link again when starting a new private browsing session.
Verify and finish
- Signed out and without a preview cookie, visit the home page and another page. Both should show maintenance.
- Open the saved preview link, confirm the token disappears from the URL, then follow another internal link. The normal site should remain visible.
- In another signed-out browser, try an incorrect token. It must not grant access.
- Generate and save a new token; the previous link and browser preview should stop working. Check the new link.
- If using page mode, verify its layout and links. A page that becomes private or password-protected should switch to the safe HTML fallback.
- When the work is ready, disable Maintenance mode, save, and purge page caches. No content or user restoration is required.
If preview fails, use the link matching the last saved token, allow cookies, and keep the same hostname and HTTPS scheme while browsing. If the token disappears but maintenance remains, check that your CDN forwards the preview cookie, then reopen the saved link. An old raw maintenance cookie is not sufficient: reopen the preview link. If visitors see the normal site without a token, check whether they are logged in or receiving an earlier cached response.