WordPress 7.1 Beta 1 expands Notes with bold, italic, code, links, emoji, and keyboard shortcuts. A safe rollout checks what the editor accepts, what is stored, what the sidebar renders, what notifications include, and what survives revisions. Use harmless marker strings instead of executable payloads on any shared environment.
Use this for editorial teams, agencies, plugin developers, membership sites, and organizations that plan to use WordPress Notes around drafts, client content, or restricted posts.
Quick answer
WordPress 7.1 Notes Rich Text Link Sanitization Test should be handled with a narrow evidence-first workflow: build harmless fixtures, capture stored values, compare every renderer, then verify the result before making broader changes.
What to check first
- Create harmless fixtures for bold, italic, code, emoji, a normal HTTPS link, a relative link, mailto, tel, an unsupported protocol label, pasted markup, and malformed nesting.
- Enter each fixture through typing, paste, keyboard shortcut, and any programmatic path used by an integration, then capture the editor value and stored representation.
- Compare the Notes sidebar, post reload, revision restore, duplicate block, frontend output, notification subject, email preview, and deep link without using real confidential text.
- Repeat with administrator, editor, author, contributor, and a role that cannot open the post so formatting does not hide an authorization leak.
- Retest on the latest Beta or Release Candidate because the feature is still changing before the planned final release.
Diagnostic table
Use this table to keep the work practical. It connects the symptom to evidence and a verification step.
| Action | Evidence to collect | How to verify |
|---|
| Build harmless fixtures | Create harmless fixtures for bold, italic, code, emoji, a normal HTTPS link, a relative link, mailto, tel, an unsupported protocol label, pasted markup, and malformed nesting. | Typed and pasted fixtures have documented stored and rendered results. |
| Capture stored values | Enter each fixture through typing, paste, keyboard shortcut, and any programmatic path used by an integration, then capture the editor value and stored representation. | Unsupported protocols, event attributes, and malformed markup cannot become executable content. |
| Compare every renderer | Compare the Notes sidebar, post reload, revision restore, duplicate block, frontend output, notification subject, email preview, and deep link without using real confidential text. | Notification subjects, previews, and bodies preserve the same safety and authorization boundary. |
| Test role boundaries | Repeat with administrator, editor, author, contributor, and a role that cannot open the post so formatting does not hide an authorization leak. | Reload, revision restore, block duplication, and role changes do not reintroduce removed markup. |
Why this usually happens
- Rich-text parsing, storage, sidebar rendering, and email rendering can use different allow lists.
- Pasted markup can contain attributes or protocols that are not created by the toolbar.
- A link can look harmless in text while its normalized destination uses another scheme.
- A safe editor rendering does not prove that notification HTML or a later revision uses the same sanitizer.
Useful command or data shape
Adapt paths, IDs, and privacy handling to the site before running commands or storing data on production.
fixture_set:
- bold_and_italic
- inline_code
- emoji
- https_link
- relative_link
- mailto_link
- tel_link
- unsupported_protocol_marker
- pasted_attributes
- malformed_nesting
expected: no_executable_markup
Safe fix order
Do the work in a sequence that makes each result easy to prove. Stop if a step produces new evidence that changes the incident scope.
- Build harmless fixtures
- Capture stored values
- Compare every renderer
- Test role boundaries
- Repeat on each prerelease
Decision rule
Approve Notes rich text only when unsupported links and attributes become safe text or are removed consistently, allowed links retain the intended destination, notifications reveal no restricted content, and the result survives reload and revision workflows.
What to tell the client or owner
Share the exact WordPress prerelease build, browser, role, entry method, harmless fixture ID, stored representation, sidebar output, email output, revision result, expected result, and any plugin that modifies Notes.
Production verification checklist
- Typed and pasted fixtures have documented stored and rendered results.
- Unsupported protocols, event attributes, and malformed markup cannot become executable content.
- Notification subjects, previews, and bodies preserve the same safety and authorization boundary.
- Reload, revision restore, block duplication, and role changes do not reintroduce removed markup.
Mistakes to avoid
- Do not use live attack strings or real client data on a shared site.
- Do not inspect only the visible editor and skip stored and email output.
- Do not assume a toolbar-only test covers pasted or integration-created content.
- Do not publish a permanent policy from one Beta build.
Questions teams ask during testing
Which link protocols should Notes allow?
Use the behavior supported by the tested WordPress build and the site's policy. Record HTTPS, relative, mailto, and tel separately, and treat any unsupported scheme as a failed fixture if it remains clickable.
Can Notes formatting affect the public post?
Notes are collaboration data, but the test should still check frontend output, copied content, revisions, exports, and notifications. A plugin or workflow can create an unexpected bridge between private feedback and public content.
When HandL WP should help
HandL WP should help when a Notes link changes destination, pasted markup survives unexpectedly, email output differs from the editor, or restricted feedback reaches the wrong role. We can build a safe fixture suite and trace every output surface.
If this is active on a production site, test WordPress Notes output safely.
Related HandL WP guides
Use these related guides when the same issue touches tracking, security, checkout, or crawler visibility.
Helpful references