# Read-Only Custom Fields Viewer for Administrators

> Adds a box to the post editor that lists every custom field stored for the post, hidden ones included, with serialized arrays and JSON shown in a readable layout. Nothing can be changed from it.

- Type: PHP
- Runs: Admin only
- Category: [Developer](https://wpide.com/library/category/developer/)
- Tags: developer, debugging, custom-fields, meta
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/post-meta-viewer/

## Code

```php
// Who can see the box.
$wpide_meta_viewer_capability = 'manage_options';

// Also list hidden keys that start with an underscore (used by WordPress and plugins).
$wpide_meta_viewer_show_hidden = true;

// Post types that get the box. Leave empty for every post type with an edit screen.
$wpide_meta_viewer_post_types = array();

$wpide_meta_viewer_value = function ( $value ) {
    $value = (string) $value;

    if ( '' === $value ) {
        return '<em>(empty)</em>';
    }

    // Serialized data is unpacked for reading only. Objects are never rebuilt.
    if ( is_serialized( $value ) ) {
        $data = @unserialize( trim( $value ), array( 'allowed_classes' => false ) ); // phpcs:ignore WordPress.PHP.NoSilencedErrors, WordPress.PHP.DiscouragedPHPFunctions

        if ( false !== $data || 'b:0;' === trim( $value ) ) {
            return '<span class="wpide-meta-viewer__type">serialized ' . esc_html( gettype( $data ) ) . '</span><pre>' . esc_html( print_r( $data, true ) ) . '</pre>'; // phpcs:ignore WordPress.PHP.DevelopmentFunctions
        }
    }

    $first = substr( ltrim( $value ), 0, 1 );

    if ( '{' === $first || '[' === $first ) {
        $data = json_decode( $value, true );

        if ( null !== $data ) {
            return '<span class="wpide-meta-viewer__type">JSON</span><pre>' . esc_html( (string) wp_json_encode( $data, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE ) ) . '</pre>';
        }
    }

    return '<pre>' . esc_html( $value ) . '</pre>';
};

$wpide_meta_viewer_render = function ( $post ) use ( $wpide_meta_viewer_show_hidden, $wpide_meta_viewer_value ) {
    $meta = get_post_meta( $post->ID );
    $meta = is_array( $meta ) ? $meta : array();

    if ( ! $wpide_meta_viewer_show_hidden ) {
        $meta = array_filter( $meta, function ( $key ) {
            return ! is_protected_meta( $key, 'post' );
        }, ARRAY_FILTER_USE_KEY );
    }

    uksort( $meta, 'strnatcasecmp' );

    if ( ! $meta ) {
        echo '<p>This post has no custom fields.</p>';
        return;
    }

    ?>
    <style>
        .wpide-meta-viewer { table-layout: fixed; }
        .wpide-meta-viewer th:first-child { width: 30%; }
        .wpide-meta-viewer td { vertical-align: top; overflow-wrap: anywhere; }
        .wpide-meta-viewer pre { margin: 0; max-height: 240px; overflow: auto; white-space: pre-wrap; word-break: break-word; font-size: 12px; }
        .wpide-meta-viewer__type { display: inline-block; margin-bottom: 4px; padding: 0 6px; border-radius: 3px; background: #f0f0f1; color: #50575e; font-size: 11px; }
        .wpide-meta-viewer-filter { margin: 4px 0 8px; }
    </style>
    <p class="wpide-meta-viewer-filter">
        <label for="wpide-meta-viewer-search"><?php echo esc_html( sprintf( '%d keys. Filter by key:', count( $meta ) ) ); ?></label>
        <input type="search" id="wpide-meta-viewer-search" class="regular-text">
    </p>
    <table class="widefat striped wpide-meta-viewer">
        <thead><tr><th scope="col">Key</th><th scope="col">Value</th></tr></thead>
        <tbody>
        <?php foreach ( $meta as $key => $values ) : ?>
            <?php foreach ( (array) $values as $value ) : ?>
                <tr data-key="<?php echo esc_attr( strtolower( $key ) ); ?>">
                    <td><code><?php echo esc_html( $key ); ?></code></td>
                    <td><?php echo $wpide_meta_viewer_value( $value ); // phpcs:ignore WordPress.Security.EscapeOutput -- escaped when built. ?></td>
                </tr>
            <?php endforeach; ?>
        <?php endforeach; ?>
        </tbody>
    </table>
    <script>
    ( function () {
        var search = document.getElementById( 'wpide-meta-viewer-search' );
        if ( ! search ) { return; }
        search.addEventListener( 'input', function () {
            var term = search.value.trim().toLowerCase();
            document.querySelectorAll( '.wpide-meta-viewer tbody tr' ).forEach( function ( row ) {
                row.hidden = term !== '' && row.getAttribute( 'data-key' ).indexOf( term ) === -1;
            } );
        } );
    } )();
    </script>
    <?php
};

add_action( 'add_meta_boxes', function ( $post_type, $post ) use ( $wpide_meta_viewer_capability, $wpide_meta_viewer_post_types, $wpide_meta_viewer_render ) {
    if ( ! $post instanceof WP_Post || ! current_user_can( $wpide_meta_viewer_capability ) ) {
        return;
    }

    if ( $wpide_meta_viewer_post_types && ! in_array( $post_type, $wpide_meta_viewer_post_types, true ) ) {
        return;
    }

    add_meta_box( 'wpide-post-meta-viewer', 'All Custom Fields (read-only)', $wpide_meta_viewer_render, $post_type, 'normal', 'low' );
}, 10, 2 );
```

## Notes

Only users who can manage options see the box. Serialized objects are displayed without being rebuilt, so viewing them is safe. In the block editor the box is at the bottom of the screen. Type in the filter field to find a key quickly.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Read-Only Custom Fields Viewer for Administrators" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/