About this plugin
PagePin is a visual feedback plugin for WordPress. Your team and your clients mark problems directly on the live page, either as annotated screenshots for bug reports (Pinshots) or as comment threads pinned to page elements (Pinpoints). Screenshots, comments and guest accounts stay in your own WordPress database and uploads folder.
There is no SaaS account to create, clients can take part without a WordPress account, and the plugin makes no external requests unless you turn on a CAPTCHA.
Many visual feedback tools for WordPress connect your site to an external service that stores the feedback. PagePin is the complete tool inside WordPress: capture, discussion, notifications and the admin overview run on your server.
How it works
- Pin: Press Ctrl+Alt+F (Cmd+Option+F on Mac) or click the floating feedback button.
- Capture: Place markers, add notes, and PagePin takes the screenshot with page URL, time, browser, operating system and viewport size.
- Ship: The Pinshot is saved in WordPress and goes out by email with one click in the Pinshot list, or the discussion continues in a Pinpoint thread.
Pinshots: annotated screenshots for bug reports
A Pinshot is a screenshot of the current page with numbered markers and notes, saved in WordPress and sent by email to the people who fix the problem.
- Three marker types: Negative (red) for bugs, Positive (green) for approvals, Note (orange) for comments. Keys 1, 2 and 3 switch between them.
- Context included: page URL, time, browser with operating system, viewport size and device pixel ratio are recorded with every Pinshot.
- Two capture methods: the Screen Capture API of the browser (it asks for permission first) and html2canvas as fallback.
- Email delivery: up to 5 recipients and a custom subject line, the screenshot is attached. Pinshots from your team are sent from the Pinshot list, public feedback goes out right away.
- Watermark and compression: optional watermark text on every screenshot, image quality from 10 to 100 percent.
- Undo and redo: Ctrl+Z and Ctrl+Y (Cmd+Z and Cmd+Shift+Z on Mac). Markers can be dragged to a new position, on touch screens too.
- Status tracking: the Pinshot list in the admin has paging, filters, status and bulk actions.
Pinpoints: comments pinned to page elements
A Pinpoint is a comment thread attached to one element of a page, comparable to comments in a shared document, but on the live website.
- Click to comment: click any element to start a thread on it. Numbered badges on the page show where threads are.
- Element matching: a thread finds its element again by CSS selector, XPath and text preview. If the element is gone, the thread is marked instead of being attached to the wrong place.
- @mentions: mention team members or guests to notify them by email.
- Resolve and reopen: close a thread when the change is done, reopen it when needed.
- Sidebar: all Pinpoints of the site in a slide-out list with unread badges.
- Tags: Bug, Design, Content, Urgent or your own tags, each with its own color.
- Editor metabox: the post and page editor shows how many Pinpoints a page has.
Guests and collaborators without a WordPress account
A collaborator is a person without a WordPress account who gets access to selected Pinpoints through a personal magic link. Collaborators are off by default; turn them on under PagePin > Settings > Collaborators.
- Invite by email or link: the share dialog sends a magic link by email or creates a link you pass on yourself.
- Reuse guests: give an existing guest access to more Pinpoints without a new link.
- Mention to invite: mentioning a guest with @ grants access to that thread if they do not have it yet.
- Notifications: everyone in a thread, guests included, is notified of new comments.
- Link expiry: magic links do not expire by default, or expire after 7, 30 or 90 days.
- Share links for single threads: optional. Anyone with such a link can read and reply in that thread.
Guests can read and reply in the threads they were given and use @mentions. They cannot open new threads, and the @mention list does not show them user logins or the email addresses of other guests.
Public feedback from visitors
Public feedback mode lets visitors without an account send Pinshots from your site. It is off by default.
- The visitor gives an email address (required by default) and agrees to the processing of the data before sending.
- Spam protection: honeypot field, a minimum time before sending, a limit of submissions per hour and IP address (10 by default).
- Optional CAPTCHA: Google reCAPTCHA v2 or v3, hCaptcha or Cloudflare Turnstile.
Privacy and accessibility
PagePin is built for GDPR: all data is processed and stored on your own server.
- No external requests: no CDN, no external fonts, no tracking, no analytics. The only exception is a CAPTCHA provider you select yourself.
- No Gravatar: avatars are local initials. Email addresses typed into the invite search stay on your server.
- IP addresses: public reports are rate limited with a keyed hash of the IP address, kept in a transient for at most one hour and never stored with the feedback.
- Screenshots: stored in /wp-content/uploads/pagepin/, not in the Media Library.
- Clean uninstall: deleting the plugin removes its tables, options and screenshot folder.
- Keyboard and screen readers: dialogs open and close with the keyboard, Esc closes them, the focus stays inside and returns to the button that opened them. Markers work with Enter and Space.
- Contrast: contrast and focus rings follow WCAG 2.2 AA.
For agencies and developers
PagePin fits agencies that collect client feedback during a website project, and developers who need bug reports with the context to reproduce them.
- Roles: Pinshots for Administrators by default, other roles can be added. Pinpoints have separate create, view and resolve rights per role.
- Admin overview: dashboard with key numbers and the latest Pinshots and Pinpoints, an admin bar counter, and a Next steps checklist after activation.
- Collaborator and tag management: guest list with type, inline email editing and access control; tags with colors and usage counts.
- Proxy support: the pagepin_trusted_proxy_headers filter names the header your reverse proxy or CDN sets.
- Languages: English and German included, ready for translation.
- Code quality: WordPress Coding Standards (WPCS 3.0) and PHPStan level 5.
What PagePin does not do
PagePin does not record video and does not sync feedback to external project management tools. Feedback stays in WordPress and reaches you by email and in the admin.
io.
Support
- Website: pagepin.io
- Support: [email protected]
External services
PagePin connects to an external service ONLY when you turn on CAPTCHA protection for public feedback and select a provider. The provider’s script then loads in the public feedback dialog, and the visitor’s answer is checked on the provider’s server when the feedback is sent.
Google reCAPTCHA (v2 or v3)
When enabled, user interaction data is sent to Google for spam verification.
com/recaptcha/
com/privacy
com/terms
hCaptcha
When enabled, user interaction data is sent to hCaptcha for spam verification.
com/
com/privacy
com/terms
Cloudflare Turnstile
When enabled, user interaction data is sent to Cloudflare for spam verification.
com/products/turnstile/
com/privacypolicy/
com/website-terms/
Important: No data is sent to external services unless you explicitly enable CAPTCHA in the plugin settings. Without CAPTCHA, the plugin operates entirely on your own server.
Privacy
Data Collection
This plugin collects and stores the following data locally on your WordPress server:
For authenticated users (logged-in):
* User ID (WordPress user reference)
* Feedback content (screenshots, markers, messages)
* Page URL where feedback was submitted
* Timestamp
* Browser name with major version and operating system, viewport size and device pixel ratio (Pinshots only, the full user agent string is not stored)
For public/anonymous feedback (when enabled):
* Email address (if provided by the visitor)
* IP address (for rate limiting only, kept as a keyed hash in a transient and never stored with the feedback)
* Session token (anonymous identifier)
* Feedback content (screenshots, markers, messages)
* Page URL and timestamp
* Browser name with major version and operating system, viewport size and device pixel ratio
For external collaborators (when enabled):
* Display name
* Email address (optional, for Magic Link invitations and @mention notifications)
* Authentication token (for session-based access)
* Access grants (which pinpoints the collaborator can view)
* Last access timestamp
Data Retention
- Feedback data: Stored until manually deleted by an administrator
- Rate limiting data (IP hash): Kept in a transient that expires at most one hour after the last attempt.
- Screenshots: Stored until feedback is deleted
- Collaborator data: Stored until manually deleted by an administrator
Data Location
- Database: WordPress database tables (prefixed with your WordPress table prefix)
- Screenshots: /wp-content/uploads/pagepin/ directory
GDPR Compliance
- All data is stored locally on your server
- No analytics or tracking is performed
- No data is shared with third parties (unless CAPTCHA is enabled)
- Feedback, comments and collaborators can be deleted in the WordPress admin
- IP addresses are pseudonymized (keyed hash) before they are stored for rate limiting
Consent
For public feedback mode, we recommend:
* Linking to your privacy policy in the feedback form
* Informing visitors about data collection in your site’s privacy policy