LiveCollab

Real-time collaborative editing for the WordPress block editor. Multiple editors, one post, live sync — plus a built-in team chat, right inside Gutenberg.

---

What it does

LiveCollab brings Google-Docs-style collaboration to WordPress. Open the same post from two accounts and watch edits sync live, with a presence list showing who's connected and a sidebar chat for talking without leaving the editor.

• Live content sync between everyone editing the same post
• Sidebar chat panel, history saved per post
• Presence list — see who's currently editing, in real time
• Standard WordPress revisions — content still saves through wp_update_post(), nothing proprietary
• Self-hosted sync server — a small bundled Node.js WebSocket relay, fully under your control
• Verified connections — every WebSocket session is authenticated against your WordPress site via nonce + a shared secret key before it's trusted

Why

WordPress core has no concept of live multi-user editing — two people on the same post just overwrite each other. LiveCollab fixes that without touching core, without a SaaS middleman, and without sending your content anywhere but your own server.

Requirements

• WordPress 6.0+
• PHP 7.4+
• Node.js 18+ (for the sync server — runs anywhere: same host, a VPS, a container)

Installation

1. Download the latest release or clone this repo into wp-content/plugins/livecollab.

2. Activate LiveCollab from the Plugins screen.

3. Go to Settings → LiveCollab, note the generated Secret Key, and set the WebSocket URL your sync server will run on.

4. Start the bundled sync server:

   cd wp-content/plugins/livecollab/sync-server
   cp .env.example .env
   # edit .env: set WP_REST_URL and SERVER_KEY (from step 3)
   npm install
   npm start

5. In production, put the sync server behind TLS (wss://) via a reverse proxy (nginx, Caddy) and keep it alive with a process manager (pm2, systemd, Docker).

6. Open any post in the block editor — the LiveCollab panel appears in the sidebar.

How it works

WordPress (PHP)  <--REST + nonce-->  Sync server (Node.js)  <--WebSocket-->  Every connected editor

• WordPress never holds a persistent connection — PHP can't do that. The Node.js relay does.
• Before admitting a client to a document "room," the relay calls back into WordPress's REST API to verify the user's nonce and edit_post capability, using a shared secret key set at activation.
• Chat messages are persisted as post meta and returned through the same REST API, so history survives page reloads.

Security model

• No anonymous or unauthenticated WebSocket session is ever trusted.
• All REST input is sanitized/escaped (sanitize_text_field, esc_url_raw, wp_kses_post).
• The sync server's SERVER_KEY is compared with hash_equals() — no timing attacks.
• Chat text is rendered client-side with textContent, never innerHTML, so it can't be used for stored XSS.

Roadmap

• Live cursor positions per user (Yjs-based)
• @mentions in chat with notifications
• Per-block lock indicators to reduce accidental overwrite conflicts

Contributing

Issues and PRs welcome. Keep changes scoped, follow WordPress coding standards for PHP, and test both the plugin and sync server before submitting.

License

GPL-2.0-or-later — see LICENSE.

Author

Valentin Constantinescu — github.com/Byot3711