Content Revalidation Tracker

Content Revalidation Tracker connects headless WordPress to your frontend. When content changes, the plugin sends a secure request to your frontend’s revalidation endpoint, so the affected pages are rebuilt right away and visitors never see stale content.

It works with Next.js on-demand ISR, Nuxt, Astro, Gatsby or any framework that can expose an API route.

How it works

1. You publish, update, unpublish, trash or delete a post, page, term or author.
2. The plugin works out the frontend path using your URL mapping (for example /blog/my-post/).
3. It sends POST https://your-frontend.com/api/revalidate?path=/blog/my-post/ with the secret in the X-Revalidate-Secret header.
4. Your frontend revalidates the page. If the request fails, the plugin retries it in the background.

Features

• Automatic revalidation for posts, pages, custom post types, categories, tags, custom taxonomies and author archives.
• Slug changes handled: both the old and the new URL are revalidated.
• URL mapping: match your frontend routes with per post type, per taxonomy and author archive prefixes, with a live preview of the resulting path.
• Secure by default: the secret is sent in a request header, never stored in the activity log, and masked on the settings page. A secret generator is built in.
• Fast for editors: requests are sent after the editor’s response is finished, so saving a post is never slowed down.
• Reliable: timeouts, rate limits and server errors are retried in the background through WP-Cron.
• Built for bulk changes: bulk edits, imports and WP-CLI loops are sent in parallel (10 at a time) with a retry queue of up to 5,000 paths.
• Test tool: send a real revalidation request for any path and see the response.
• Activity log: see the HTTP status of recent requests, filter by success, failure or retry, and search by path.
• Developer friendly: filters for allowed post types, taxonomies, prefixes, timeouts and concurrency.
• Clean uninstall: deleting the plugin removes all of its data, including on multisite.

Who it is for

• Headless WordPress sites with a Next.js, Nuxt, Astro or Gatsby frontend.
• Sites that use static generation or incremental static regeneration and need fresh pages without full rebuilds.
• Agencies that want a simple, reliable link between editors and the frontend.

Frontend endpoint example (Next.js App Router)

Create app/api/revalidate/route.ts on your frontend. Keep the secret in a server-only environment variable such as REVALIDATE_SECRET, never in a NEXT_PUBLIC_ variable.

import { revalidatePath } from 'next/cache';
import { timingSafeEqual } from 'node:crypto';

const SECRET = process.env.REVALIDATE_SECRET ?? '';
const ALLOW_LEGACY = process.env.ALLOW_LEGACY_QUERY_SECRET === 'true';

function matches(value: string | null): boolean {
  if (!value || !SECRET) return false;
  const a = Buffer.from(value), b = Buffer.from(SECRET);
  return a.length === b.length && timingSafeEqual(a, b);
}

export async function POST(req: Request) {
  const url = new URL(req.url);
  const ok = matches(req.headers.get('x-revalidate-secret'))
    || (ALLOW_LEGACY && matches(url.searchParams.get('secret')));
  if (!ok) return Response.json({ message: 'Invalid secret' }, { status: 401 });
  const path = url.searchParams.get('path');
  if (!path) return Response.json({ message: 'Missing path' }, { status: 400 });
  revalidatePath(path);
  return Response.json({ revalidated: true, path });
}


ALLOW_LEGACY_QUERY_SECRET is only needed while migrating from the old `?secret=` query parameter. New sites can leave it unset.

Developer filters

• content_revalidation_tracker_allowed_post_types: limit which post types are revalidated.
• content_revalidation_tracker_allowed_taxonomies: limit which taxonomies are revalidated.
• content_revalidation_tracker_author_prefix: change the author archive prefix.
• content_revalidation_tracker_request_timeout: request timeout in seconds (default 10).
• content_revalidation_tracker_concurrency: parallel requests per run (default 10).
• content_revalidation_tracker_batch_time_limit: time budget per run in seconds (default 30).
• content_revalidation_tracker_retry_queue_limit: maximum paths in the retry queue (default 5,000).