WordPress 7.1 Notes support @mentions, rich text, multiple conversations, and inline feedback. The useful privacy question is whether the mentioned person can access the underlying post and whether a notification subject, excerpt, link, or email transport reveals text from private, draft, client, or role-restricted content.
Use this for editorial teams, agencies, membership sites, multisite networks, client staging environments, and organizations where authors, editors, contractors, and administrators have different content access.
Quick answer
WordPress 7.1 Notes Mentions Notification Privacy Test should be handled with a narrow evidence-first workflow: build role cases, send controlled mentions, capture every channel, then verify the result before making broader changes.
What to check first
- Create synthetic public, draft, private, scheduled, password-protected, and role-restricted posts with no real client data.
- Mention an administrator, editor, author, contributor, subscriber, removed user, and user from another multisite site.
- Capture in-app notices, email subject, email preview text, message body, deep link, sender identity, and delivery result.
- Open the notification link in logged-out, correct-role, wrong-role, expired-session, and removed-user states.
- Delete or resolve a Note and confirm retention, notification history, and audit evidence follow the site's collaboration policy.
Diagnostic table
Use this table to keep the work practical. It connects the symptom to evidence and a verification step.
| Action | Evidence to collect | How to verify |
|---|
| Build role cases | Create synthetic public, draft, private, scheduled, password-protected, and role-restricted posts with no real client data. | Unauthorized users receive no restricted post title, Note text, excerpt, attachment, or deep-link preview. |
| Send controlled mentions | Mention an administrator, editor, author, contributor, subscriber, removed user, and user from another multisite site. | Authorized users can open the correct Note and post without receiving duplicate notices. |
| Capture every channel | Capture in-app notices, email subject, email preview text, message body, deep link, sender identity, and delivery result. | Role removal and multisite boundaries are respected at delivery and open time. |
| Test access at open time | Open the notification link in logged-out, correct-role, wrong-role, expired-session, and removed-user states. | Resolved and deleted Notes follow the documented retention and audit policy. |
Why this usually happens
- Mention lookup and content authorization are separate operations.
- Email notifications can expose a Note excerpt even when the destination page later denies access.
- Multisite users may exist in the network but not belong to the current site.
- A user's role can change after the notification was queued but before the link is opened.
Useful command or data shape
Adapt paths, IDs, and privacy handling to the site before running commands or storing data on production.
privacy_case:
post_status: private
mentioned_role: subscriber
site_membership: current_site
in_app_notice: generic
email_excerpt: hidden
deep_link_result: 403
expected: no_content_exposure
Safe fix order
Do the work in a sequence that makes each result easy to prove. Stop if a step produces new evidence that changes the incident scope.
- Build role cases
- Send controlled mentions
- Capture every channel
- Test access at open time
- Document retention
Decision rule
A mention may notify a user only within the collaboration policy. It must never create access, include restricted text for an unauthorized recipient, or expose client content through an email subject or preview.
What to tell the client or owner
Share the post status, mentioned user and role, site membership, notification channel, exact exposed fields, deep-link result, timestamps, and expected privacy rule.
Production verification checklist
- Unauthorized users receive no restricted post title, Note text, excerpt, attachment, or deep-link preview.
- Authorized users can open the correct Note and post without receiving duplicate notices.
- Role removal and multisite boundaries are respected at delivery and open time.
- Resolved and deleted Notes follow the documented retention and audit policy.
Mistakes to avoid
- Do not test with real confidential content.
- Do not check only the in-app sidebar and ignore email previews.
- Do not assume network membership grants site access.
- Do not treat a hidden destination page as proof that the email leaked nothing.
Questions teams ask during testing
Should an unauthorized user receive any notification?
The safest default is no content-bearing notification. A generic notice may be acceptable only if policy requires it and it reveals no restricted title, excerpt, or participant detail.
Does deleting a Note retract an email?
No. Once delivered, an email copy may persist. Keep notification content minimal and test retention and deletion expectations before enabling the feature broadly.
When HandL WP should help
HandL WP should help when Notes are used around client drafts, membership content, or role-separated editorial teams. We can build the access matrix, inspect notifications, and document a safe rollout before production use.
If this is active on a production site, audit WordPress collaboration privacy.
Related HandL WP guides
Use these related guides when the same issue touches tracking, security, checkout, or crawler visibility.
Helpful references