Deconde Virtuelles Schwarzes Brett

Virtuelles Schwarzes Brett adds a digital pinboard to your website where visitors and logged-in users can leave short messages as colourful post-it notes — for example for club, neighbourhood, or community websites.

New messages are not publicly visible at first (“pending”) and only appear on the board once an administrator has approved them in the backend. Posts can automatically disappear from the public board again after a configurable display duration.

Key Features

• Shortcode [schwarzes_brett] – the board can be embedded on any page or post.
• Form with required fields first name, last name, message (max. 280 characters).
• A way to get in touch is required: email OR phone number, shown on the post-it as a clickable mailto:/tel: link.
• Optional photo upload (JPG, PNG, GIF, WEBP), maximum file size configurable in the backend.
• Approval workflow: new posts only become publicly visible after admin approval.
• Automatic expiry: admin-configurable display duration per post (0 = unlimited).
• Random pastel colour (8 shades) and a slight tilt per note for an authentic pinboard look.
• AJAX form, no page reload required.
• No WordPress user account needed to submit a message.
• Fully translation-ready (text domain deconde-virtuelles-schwarzes-brett); translations are provided via translate.wordpress.org.

Pro Version

There is a separate add-on plugin, Virtuelles Schwarzes Brett Pro, that requires this free plugin and adds features such as multiple boards, categories, automatic moderation, pinned and expiring notes, email notifications, CSV export and custom colour palettes. This free version is complete and fully functional on its own; it contains no locked features, license checks or trial code.

Data Security

• All form input is validated and sanitized server-side; all output is escaped appropriately for its context.
• Every form-processing action (submitting a message, deleting a message, approving/rejecting, saving settings) is protected against CSRF with WordPress nonces.
• Database access is exclusively done through parameterized queries ($wpdb->prepare()).
• Photo uploads are validated against their actual file content (wp_check_filetype_and_ext()), not just the file extension.
• Approving, rejecting, removing, and all settings are restricted to users with the manage_options capability (typically administrators).