Hype5 Theater 0.6.17 · Pre-release
Security and content visibility
Hype5 Theater follows WordPress's publication rules and applies them in every public output it owns — pages, lists, shortcodes, blocks, feeds, search and REST routes — independently of the theme.
On this page
Productions
| State | Production page | Lists, person profiles, general schedule |
|---|---|---|
| Draft, pending review, scheduled (future) | Not public. Editors can preview. | Not shown. |
| Private | Only for logged-in users who may read private productions. | Not shown to visitors. |
| Published, password protected | Only the title and WordPress's password form until the visitor enters the password; then the full page. | At most the title, address, poster, genres, audience recommendation and premiere — never performances, ticket offers, the teaser or credits, even after the password has been entered. |
| Published, public | Full page. | Shown. |
Lists that combine many productions treat a password-protected production strictly, also after a visitor has entered its password, because such pages may be cached and shown to everyone. Output scoped to one production — its own page and its own schedule — opens once the visitor has entered the password on that page.
Repertory status (Coming soon, Playing, On hold, Archived) never affects visibility. An archived production stays public and keeps its address.
Performances and ticket offers
- A performance appears publicly only while its production is published without a password (or unlocked on the production's own page).
- Internal notes and attendance are never shown publicly, never returned by the public REST API, and are hidden from users who may edit the production but not manage performances.
- A purchase button appears only under the ticket rule.
- Performances of a deleted or unpublished production are ignored by public output.
People
| Setting off | Effect |
|---|---|
| Allow public profile page | The profile page returns not found to visitors. Credits still show the name, without a link. The person is left out of the people directory, site search, feeds, the people archive, WordPress's REST listings and search, oEmbed and the sitemap. |
| Show in public directory | The person is left out of the people list only; the profile page and links to it stay available. |
A hidden profile also hides its translations. A person profile lists only productions that are published without a password. See People.
Credits
A hidden credit row is kept but never shown — not on pages, not in shortcodes and not in the public credits REST route. The public credits REST route also leaves out credits whose person profile is not published.
Venues
A venue is named, and its accessibility defaults are used, only while it is published. A venue in the Trash is no longer named in public schedules; production pages keep naming it as the premiere venue until it is deleted permanently. See Venues.
Multilingual sites
With WPML or Polylang, translations share credits, galleries, rows and performances through the original-language production. A password on any version in a production's chain — the version asked for, the original, or the reader's-language version — protects the shared data shown on that version. The first version that carries a password decides, so the password entered on a page always unlocks that page. Unpublished translations are never shown to visitors. See Multilingual sites.
REST API
The plugin's three public routes are read-only and follow the same rules: the credits route answers 401 while a password is required and 404 for an unpublished production. WordPress's own REST routes for Hype5 content leave out hidden profiles and mask Hype5 values of protected productions for users who may not edit them. The routes under /hype5-theater/v1/app/ are private to the Hype5 app and require a logged-in user with access to the app and the right capability. See REST API.
Themes and custom code
The plugin's templates receive prepared data that already follows these rules, so a template override cannot reveal protected data. Themes that call the plugin's PHP services directly must follow the rules themselves for services that return raw rows. See Presentation services and Theme integration.
Administration safeguards
- Every screen, route and save checks WordPress capabilities. See User roles and permissions.
- Changing custom CSS needs the
edit_csscapability, as WordPress's own Additional CSS does. Users without it see the stylesheet read-only. - Public texts (labels) are limited to 500 characters.
- The Hype5 app protects against overwriting someone else's newer changes: a stale save stops and marks the changed fields. This protection covers the app and the guarded classic forms, not REST clients, WP-CLI, other plugins, Bulk Edit or older browser tabs. See Known limitations.
What Hype5 does not store
Hype5 Theater stores no visitor accounts, payment details or ticket purchases. Ticket offers are links to external sellers.