datlechin / flarum-link-preview

v2.0.1 2026-09-07 12:32 UTC

Requires

• php: ^8.2
• ext-dom: *
• ext-json: *
• ext-mbstring: *
• flarum/core: ^2.0.0-rc.7

Requires (Dev)

• flarum/phpstan: ^2.0
• flarum/tags: *
• flarum/testing: ^2.0
• laravel/pint: ^1.18

MIT

• Ngo Quoc Dat

• open graph
• embed
• preview
• flarum
• link preview
• unfurl

Published on Packagist.org on 2026-09-07 12:33 UTC

README

Paste a link in a post and it becomes a card with the page's title, description and image. Your forum reads the page itself, so nothing is sent to a third party.

Install

composer require datlechin/flarum-link-preview:"*"

Updating:

composer update datlechin/flarum-link-preview:"*"
php flarum migrate
php flarum cache:clear

Needs Flarum 2.0 and PHP 8.2.

What gets a card

Only a pasted address, meaning the link's text is the address itself. [the docs](https://example.com) keeps the words you wrote.

Left alone: mentions, quotes and code, media files if you ask, links past the per-post limit, and anything your lists rule out. A preview that cannot be built is left alone too: no card, no message, just the link as it was written.

A link back to this forum gets a card built from the database, not fetched: a discussion, a member, a tag, or the index itself. Readers only see what they could already open. It has to be alone on its line; inside a sentence Flarum's own #12 label is better.

Members can turn previews off for themselves in their settings.

Settings

The two lists take one entry per line or separated by commas:

Entry	Matches
example.com	that host and its subdomains
example.com/news	that path and everything under it
*.example.com	one label in front of the domain

Anchored at both ends, so example.com does not match notexample.com.evil.org.

Security

Anyone who can read a post can ask your server to fetch a URL, so:

• Loopback, private and reserved addresses are refused, IPv4 and IPv6. The connection is pinned to the address that was checked, so DNS cannot swap in an internal one afterwards.
• Redirects are followed by hand, three hops at most, each one checked again.
• http and https only. TLS is always verified.
• 1 MiB and 8 seconds per page, 30 requests a minute per member.
• Failures are cached too, so a dead domain is not retried on every page view.

Older versions could fall back to a third-party oEmbed service. That sent your members' links to someone else's server, so it is gone.

Links

• Packagist
• Discuss