What Yoast Duplicate Post does in your dashboard
Yoast Duplicate Post copies a post, a page or a custom post type entry in one click. In the post list, three links appear under each title: “Clone” creates the copy and keeps you on the list, “New Draft” creates the copy and opens it in the editor, and “Rewrite & Republish” prepares a working version of content that is already live. The same actions are available in the editor, in the admin bar and in Bulk Actions, so you can copy several items at once.
Rewrite & Republish is what sets the plugin apart. You edit a copy while the original stays online, compare both versions on the revisions screen, then republish right away or at a scheduled date. The copy’s content, taxonomies and fields replace the original’s, at the same URL, and the copy is deleted. The feature only works on published content.
Enrico Battocchi created the plugin in 2007, and it is now developed together with the Yoast team. It is completely free: Yoast says it has no paid tier, and it works without Yoast SEO. Its settings live under Settings > Duplicate Post, split into three tabs: What to copy, Permissions and Display.
Which sites get the most out of Yoast Duplicate Post
The plugin pays off when you often build similar content, or when you need to fix a live page without exposing unfinished work:
- Business sites and landing pages: a cloned template page keeps its layout, featured image and page template, so only the copy needs changing.
- Publishers that refresh their articles: Rewrite & Republish lets you rework a well-ranked post without unpublishing it or changing its URL.
- Teams with an editorial review: the working copy can be reviewed before it replaces the original, and the republish can be scheduled.
- Multilingual sites running WPML: the plugin ships with a dedicated WPML compatibility module.
It is not the tool for copying products: the plugin turns itself off for WooCommerce products, and WooCommerce already has its own duplicate link. If all you want is a copy link, without Rewrite & Republish, Duplicate Page covers the basics with fewer settings.
Yoast Duplicate Post strengths and limitations
Strengths
- Rewrite & Republish. A working version replaces the original at the same URL, after a comparison, either immediately or on a schedule.
- Fine control over what gets copied. Date, status, slug, author, password, attachments, taxonomies and custom fields are each a separate choice.
- Cautious defaults. A copy starts as a draft, without the original’s slug, date or password.
- Completely free. No Pro version, no features held back for a subscription, no account to create.
Limitations
- Edits to the original get overwritten. While a Rewrite & Republish copy exists, any change made to the original is replaced when the copy is republished.
- Copy rights are site-wide. An allowed role can copy, rewrite and republish all content, including other authors’ posts.
- Not for WooCommerce products. The plugin disables itself for that post type.
- Links can be missing on some post types. As the plugin itself notes, they may not show for custom post types that skip the standard WordPress screens.
The Yoast Duplicate Post settings we recommend
The defaults are already safe for most sites. The settings to watch are on the Permissions tab, because they decide who can copy, and therefore read, other people’s content.
| Setting | Recommended value | Why |
|---|---|---|
| Roles allowed to copy Settings > Duplicate Post > Permissions | Administrator and Editor (default) | The plugin itself warns that these roles can copy all content and see password-protected posts, so do not add Author or Contributor. |
| Enable for these post types Same tab | Posts and Pages, then any custom post types you have tested | Test a copy on each custom post type before enabling it, especially if it comes from a page builder. |
| Date, Status and Slug Settings > Duplicate Post > What to copy > Post/page elements to copy | Unchecked (default) | The copy stays a draft with its own URL, so nothing goes live twice by mistake. |
| Password Same section | Unchecked (default) | Keeps protected content from being duplicated along with its password. |
| Attachments Same section | Unchecked (default) | The plugin recommends this itself; otherwise each copy also duplicates the attached files in the Media Library. |
| Title prefix Settings > Duplicate Post > What to copy | “Copy of” (empty by default) | A cloned draft stands out at a glance in the post list. |
| In a column in the Post list Settings > Duplicate Post > Display > Show original item | On | Each copy shows its original, so nobody edits the wrong version. |
| Enable auto-updates Plugins > Installed Plugins | On | The 2026 permissions flaw is only fixed from version 4.6. |
- Clone a published post: the copy should show up as a draft, with your prefix.
- Log in with an Author account: the copy links should not appear.
- Before republishing, click “Save changes and compare” and read through the revisions screen.
- Delete cloned drafts you no longer need: published by mistake, they would create duplicate content.
Yoast Duplicate Post security: a permissions flaw fixed in 4.6
A copy plugin touches every piece of content on the site, drafts and private posts included, so its permission checks are the weak spot. Two vulnerabilities are worth knowing:
- CVE-2026-1217, fixed in 4.6: up to version 4.5, a Contributor account could copy any content, even private, draft or trashed posts, and an Author account could overwrite a published post through Rewrite & Republish (CVSS 5.4).
- CVE-2019-25314, fixed in 3.2.4: stored XSS in the settings fields (prefix, suffix, menu order, excluded fields), an old flaw published in 2026.
What to do: turn on automatic plugin updates and keep Contributor and Author accounts for the people who really need them (see our article on WordPress roles and capabilities). For visitors, the plugin only loads its stylesheet when the admin bar is showing; WP Masquerade removes the traces of its folder and styles, which makes it harder for bots to spot, without replacing the update.
What WP Masquerade hides for Yoast Duplicate Post
Free version Handled by the free version of WP Masquerade
Yoast Duplicate Post is one of the 50 most used plugins known to the free version. Pro goes further by renaming its files.
Free version
Nothing to remove
With Pro
- folder name
- tag IDs
Still visible
No known trace
Yoast Duplicate Post FAQ
Do I need Yoast SEO to use Yoast Duplicate Post?
No, the two plugins are independent. If Yoast SEO is installed, its fields (SEO title, meta description) are copied with the content like any other custom field, unless you exclude them in “Do not copy these fields”.
Can a copy hurt my SEO?
Not while it stays a draft, which is the default. The risk comes from a copy published without being rewritten, or from a checked “Status” setting that carries over the original’s status.
What happens to the copy after Rewrite & Republish?
Its content, taxonomies and fields replace the original’s, which keeps its URL and ID, then the copy is deleted. The copy’s revisions are moved to the original, so the history of the work is kept.
Why is the Rewrite & Republish link missing?
It only shows on published content that does not already have a copy in progress. Also check the Display tab in the settings, where each link can be turned off, and the Permissions tab for your role and post type.