---
title: Reviews
description: MediaPress Reviews lets editorial users and invited reviewers approve or request changes on posts.
url: https://developers.wpengine.com/docs/newsroom/mediapress/reviews/
image: https://developers.wpengine.com/og/docs/newsroom/mediapress/reviews.png
---

# Reviews

MediaPress Reviews lets editorial users and invited reviewers record an approval decision (approved or requires changes) with an optional comment on a post.

Reviews are stored as a private WordPress comment type (`mediapress_review`) using the shared private-comment infrastructure in MediaPress core. Each reviewer’s submissions are grouped under a per-reviewer thread container so the editor can see the latest decision at a glance.

The package owns review submission, storage and display end to end:

- In the editor, reviews are shown and submitted from the review panel.
- On a secure preview page (provided by the Secure Preview package), the review form is rendered on the front end. It is shown to invited reviewers on their personal link, and to logged-in editorial users on the shared link.

Both paths submit through the core `/wp/v2/comments` REST route. Submission is gated by `Reviews_Comment_Handler`: editorial users (with `edit_post`) may always submit, and other actors can be granted access through the `mediapress_reviews_can_add_review` filter (Secure Preview uses this to allow a reviewer holding a valid invite token). Logged-in reviewers are always attributed to their own account so a review cannot be submitted under someone else’s email.

## Filters/Actions

### PHP

#### Filters

##### `mediapress_reviews_supported_post_types`

Defines the post types on which reviews are enabled.

**Default Value**

`[ 'post' ]`

**Parameters**

| Name       | Type  | Description              |
| ---------- | ----- | ------------------------ |
| post_types | array | Array of post type slugs |

**Usage**

```php
add_filter( 'mediapress_reviews_supported_post_types', 'my_plugin_add_reviews_support' );
function my_plugin_add_reviews_support( array $post_types ): array {
  $post_types[] = 'my_custom_post_type';
  return $post_types;
}
```

##### `mediapress_reviews_can_add_review`

Grants a non-editorial actor permission to submit a review. Runs after the built-in `edit_post` check, so it only needs to handle actors who are not editorial users. The shared preview link alone does not grant submission.

**Default Value**

`false`

**Parameters**

| Name    | Type            | Description                           |
| ------- | --------------- | ------------------------------------- |
| can_add | bool            | Whether submission is already allowed |
| post_id | int             | The post being reviewed               |
| request | WP_REST_Request | The current REST request              |

**Usage**

```php
add_filter( 'mediapress_reviews_can_add_review', 'my_plugin_grant_review', 10, 3 );
function my_plugin_grant_review( bool $can_add, int $post_id, WP_REST_Request $request ): bool {
  if ( $can_add ) {
    return true;
  }


  return my_plugin_request_has_valid_token( $post_id, $request );
}
```

##### `mediapress_reviews_reviewer_identity`

Sets the reviewer’s name and email server-side from a trusted source rather than trusting client-supplied values. Return `null` to use the client or logged-in values. When an identity is returned the review is stored against that email with no user account.

**Default Value**

`null`

**Parameters**

| Name     | Type                                      | Description                    |
| -------- | ----------------------------------------- | ------------------------------ |
| identity | array{name?: string, email: string}\|null | The resolved identity, or null |
| post_id  | int                                       | The post being reviewed        |
| request  | WP_REST_Request                           | The current REST request       |

**Usage**

```php
add_filter( 'mediapress_reviews_reviewer_identity', 'my_plugin_reviewer_identity', 10, 3 );
function my_plugin_reviewer_identity( $identity, int $post_id, WP_REST_Request $request ) {
  $invite = my_plugin_find_invite( $post_id, $request );


  return $invite ? [ 'name' => $invite['email'], 'email' => $invite['email'] ] : $identity;
}
```

#### Actions

##### `mediapress_reviews_submitted`

Fires after a review has been submitted and stored. Integrating packages hook this to react to a submission; Secure Preview uses it to consume the invite that authorized the reviewer. Remove the action to opt out of that behavior.

**Parameters**

| Name           | Type            | Description                  |
| -------------- | --------------- | ---------------------------- |
| post_id        | int             | The reviewed post ID         |
| comment_id     | int             | The new review comment ID    |
| reviewer_email | string          | The reviewer’s email address |
| request        | WP_REST_Request | The submission request       |

**Usage**

```php
add_action( 'mediapress_reviews_submitted', 'my_plugin_on_review_submitted', 10, 4 );
function my_plugin_on_review_submitted( int $post_id, int $comment_id, string $reviewer_email, WP_REST_Request $request ): void {
  // React to the submission, e.g. notify the editorial team.
}
```

## Was this helpful?

Thanks for the feedback!

```json
{"@context":"https://schema.org","@graph":[{"@type":"WebSite","@id":"https://developers.wpengine.com/#website","name":"WP Engine Product Documentation","url":"https://developers.wpengine.com/","description":"Resources for developing, deploying, and scaling on WP Engine.","inLanguage":"en-US","keywords":["API documentation","product documentation","headless WordPress","managed WordPress hosting"],"publisher":{"@id":"https://wpengine.com/#organization"}}]}
```