One Two Three Send
| 开发者 | onetwothreesend |
|---|---|
| 更新时间 | 2026年5月30日 00:29 |
| PHP版本: | 8.1 及以上 |
| WordPress版本: | 6.9 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
One Two Three Send is a complete newsletter workflow inside WordPress. The plugin uses the Claude API (you supply the key) to draft issues from your site's content, gives you inline AI editor tools to polish the copy, runs a pre-send audit to catch common mistakes, and sends through Resend or SMTP to subscribers stored in your own database.
What's included
- AI newsletter generator — Claude drafts a newsletter from your recent posts, site tagline, and a manual description you provide. Tone selector (Friendly / Professional / Casual / Authoritative) and length selector (~200, ~400, ~700 words).
- AI editor — select any paragraph and click Rewrite, Shorten, Expand, or Fix grammar. Generate 5 alternative subject lines in one click. Tone check, local spam-word scan.
- Pre-send audit — one click runs 10 checks: subject length, body word count, unsubscribe reference, link count, link format, spam triggers, placeholder leaks, readability (Flesch-Kincaid), read time, structural sanity. Each check returns pass / warn / fail with a plain-language explanation.
- Scheduling — manual, daily, weekly, fortnightly, monthly. Manual-approval mode emails the admin before any send. Auto-send is opt-in.
- Email delivery — Resend (API) or SMTP (any provider).
- Subscribers — local database with filtering, CSV export, one-click token-based unsubscribe.
- Signup forms — inline form via shortcode
[otts_form id="1"], Gutenberg block, or PHPonetwothreesend_render_form(1). - Welcome email — automatic, configurable subject and body with
{first_name},{email},{site_name},{from_name}placeholders. - Lead magnet delivery — upload a PDF, zip, or any allowed file. New subscribers receive a signed, time-limited download link in the welcome email. Expired links auto-refresh when clicked, no manual resending.
- Anthropic Claude API (
api.anthropic.com) — for drafting and editing newsletters. You provide the API key in Settings → AI. Terms: https://www.anthropic.com/legal/consumer-terms. Privacy: https://www.anthropic.com/legal/privacy. - Resend (
api.resend.com) — optional, for email delivery. You provide the API key in Settings → Email Provider if you choose Resend. Terms: https://resend.com/legal/terms-of-service. Privacy: https://resend.com/legal/privacy-policy.
- Features overview — full feature breakdown with screenshots.
- Documentation — setup walkthroughs and troubleshooting guides.
- Pricing — free tier, monthly, annual, and founder plans for the companion newsletter and pro plugin.
- Privacy policy.
- Contact / support — for questions the FAQ below doesn't answer.
安装:
- Upload the plugin zip from Plugins → Add New → Upload Plugin, then activate.
- Newsletter → Settings → Email Provider → connect Resend or SMTP.
- (Optional) Newsletter → Settings → AI → paste your Claude API key (get one at console.anthropic.com) if you want the AI drafting + editing features. The plugin also works without a key — you can write newsletters yourself.
- Newsletter → New Newsletter → write or generate, edit, run the audit, send.
屏幕截图:
常见问题:
Do I need a Claude API key?
No — the plugin works fine without one if you write newsletters yourself. The AI features (Generate, Rewrite, Shorten, Expand, Fix grammar, subject-line suggestions, tone check) are all optional and only run when you click them. Without a key, you can still write a newsletter directly in the editor, run the pre-send audit, schedule it, and send to your subscribers. If you want the AI features, get a key at console.anthropic.com — free to sign up, pay-per-token usage — and paste it into Newsletter → Settings → AI.
Can I use a different email provider than Resend or SMTP?
Out of the box, no — the free plugin supports Resend and SMTP. The companion pro plugin adds Mailchimp, MailerLite, Brevo, and ConvertKit. Developers can also add providers by hooking the otts_make_provider filter.
Is my subscriber data stored anywhere outside my site?
No. Subscribers live in your own WordPress database (wp_otts_subscribers). Unsubscribe is one-click via a token in the email footer — no login required.
What happens to my data if I delete the plugin?
By default, your subscriber list, newsletter drafts, and settings are preserved. If you tick "Delete data on uninstall" in Settings → Advanced before deleting, the plugin drops its tables and removes all options.
Does the plugin work with cache plugins?
Yes. The signup form uses a honeypot for spam protection instead of a nonce, so it is cache-safe.
更新日志:
2.1.0
- Double opt-in (confirmed opt-in). New Newsletter → Settings → Confirmation tab. When enabled, new signups receive an email with a confirmation link and are NOT added to the list until they click. Bots that POST directly to the signup endpoint never click — so subscription-bombing attacks no longer add real rows or trigger welcome emails to victims, even when bombs slip past upstream defences. Pending subscribers are stored with status
pending_confirm; the welcome email + signup notifier + external-provider sync only fire on activation. Customisable subject, body, post-click landing copy, and link-expiry days (default 7). Off by default. - Cloudflare Turnstile bot protection. New Newsletter → Settings → Bot Protection tab. Paste a Site Key + Secret Key (free from Cloudflare; no Cloudflare subscription needed; site does not need to use Cloudflare DNS or CDN). When enabled, the signup form renders the Turnstile widget and the REST endpoint POSTs the token to Cloudflare's verify API before accepting any signup. Token verification failure silently accept-and-drops (consistent with existing defences). Fail-open on Cloudflare network errors (filterable via
otts_turnstile_fail_open) so a CF outage does not kill all signups. Off by default. - Schema: new
confirmation_sent_atcolumn onwp_otts_subscribers. dbDelta migration runs automatically on plugin upgrade.
- Subscription-bombing defences on the public
/wp-json/otts/v1/subscribeendpoint. Bots use newsletter signup forms across thousands of sites to flood a victim's inbox with confirmation emails, burying real alerts (fraud notifications, password resets) — your site is the unwitting relay, not the target. The endpoint now applies three additional layers on top of the existing honeypot: (1) per-IP rate limit, default 10 submissions per IP per hour, filterable viaotts_subscribe_rate_limit_per_hour; (2) MX-record check on the email's domain — typos and bogus domains are rejected; (3) disposable / temp-email domain blocklist (mailinator, guerrillamail, yopmail and ~25 common throwaways), filterable viaotts_subscribe_disposable_domains. Each layer silently accept-and-drops (HTTP 200 OK) so bots can't fingerprint which check rejected them. - Delete subscribers from the admin. Newsletter → Subscribers now has a Delete button on every row (nonce-protected, with a confirmation dialog). Two new admin-only REST endpoints for scripted cleanup:
DELETE /wp-json/otts/v1/subscriber/{id}andPOST /wp-json/otts/v1/subscriber/delete-by-email. Useful for clearing bot signups that slip past the new defences.
- Adds
publerto the affiliate-hint helper's service map. When the new One Two Three Post 1.7.0 surfaces its Publer-transport setup field, the helper renders a contextual "Don't have a Publer account yet? Sign up →" link pointing at/tools/#publeron onetwothreesend.com — same compliance posture as the existing Claude / MailerLite / Brevo / Postmark / BigScoots / Beehiiv hints. No external HTTP from this plugin; the affiliate redirection lives on the destination docs page.
- Admin notification email on every new signup. New Newsletter → Settings → Notifications tab with two recipient lists: one for free signups, one for paid (paid signups often go to a different stakeholder). Notifications go out through the same email provider you have configured for newsletter sends — not via
wp_mail()— so deliverability matches the rest of your traffic. Stripe paid signups + free→paid upgrades both notify the paid list. Includes a "Send test notification" button on the Notifications tab so you can verify wiring before a real signup happens. Subject line is[Site name] New {free|paid} signup — email@example.com, body includes source attribution from 2.0.17.
- Captures signup source on every new subscriber. New
signup_metaJSON column onwp_otts_subscribersrecords the first-touch referrer host, landing-page URL, and anyutm_*query parameters set on the visitor's first front-end pageview. The Subscribers admin table gains a Source column; both the free CSV export and the Pro export/import flow includesource+signup_meta_jsoncolumns. Cookie name isotts_ft, SameSite=Lax, 1-year TTL; no PII stored, no external HTTP. Sites with a consent gate can hold the cookie until consent is granted via theotts_signup_attribution_consentfilter. First-touch wins — re-subscribing an existing email doesn't overwrite the original attribution. Stripe and Beehiiv signups are tagged withutm_source=stripe/utm_source=beehiivso the same column reflects the channel of paid + imported subscribers, not just web signups.
- Fixes the AI Settings tab showing two competing links (the legacy "Get a key at console.anthropic.com" plain link and the new 2.0.14 affiliate hint side by side). Now: when no Claude API key is configured, only the affiliate hint renders. When a key is already configured, only the operational "Manage your key at console.anthropic.com" link renders. One link at a time, depending on state.
- The affiliate-hint helper from 2.0.14 now also renders per-provider sign-up hints on the Email provider config panel. When a Pro provider (MailerLite, Brevo) is selected and its API key field is empty, an inline "Don't have a {provider} account yet? Sign up →" link appears beneath the config table. Providers without an affiliate program (Mailchimp, Kit, SES, Resend, SMTP) show nothing — the helper returns empty for unknown slugs. Same compliance posture as 2.0.14: links point to
onetwothreesend.com/tools/, not raw affiliate URLs; filterable viaotts_affiliate_hint_enabledto disable globally.
- Adds a small
OTTS_Affiliate_Hinthelper that renders an inline "Don't have a {service} account yet? Sign up →" link next to setup fields when the field is empty. First two call sites: the Claude API key field on Newsletter → Settings → AI Settings, and the Email provider selector on Newsletter → Settings → Provider. Operators who already have credentials never see the hints — the helper only renders when the relevant field is blank. Every link points toonetwothreesend.com/tools/(a docs page on the publisher's site, not a raw affiliate URL); affiliate redirection happens there and the FTC disclosure lives on that page. Operators can disable all hints globally via theotts_affiliate_hint_enabledfilter (returnsfalse), or replace the service map viaotts_affiliate_hint_services. wp.org review note: no external HTTP, no tracking, no site-identifying data — static helper, fully filterable.
- Adds three integration points so a Pro extension can replace the Settings → Schedule UI and own scheduling without modifying the free plugin: filter
otts_settings_schedule_show_defaulthides the legacy schedule form when an extension takes over, actionotts_settings_schedule_render_prelets an extension inject a replacement notice, and filterotts_scheduler_register_default_cronsuppresses the defaultotts_scheduled_sendcron registration when an extension provides its own. Free plugin behaviour is unchanged without those hooks.
- Send reliability overhaul. Per-recipient failures are now classified as transient (rate limit, network blip, 5xx — retry), permanent (invalid email, 4xx — never retry, mark subscriber bounced), or system (auth failure, suspended account — halt the send and email the admin). A new
wp_otts_send_retriestable holds transient failures; a 5-minute cron worker re-fires them with exponential backoff (5m → 15m → 45m → 2h → 6h) up to 5 attempts. Subscribers get newbounce_state,soft_bounces,last_bounce_at, andlast_delivery_atcolumns. The Resend provider now returns structured WP_Error values with a category so the classifier can act on them without re-parsing the response. A new "Send Health" admin page (Newsletter → Send Health) shows pending retries, bounced subscribers, recently resolved retries, and recent send results — and an admin notice fires whenever a send finishes with any non-success rows.
- Resend provider now retries on HTTP 429 with backoff. Resend caps free/default accounts at 5 requests per second; sequential sends to 6+ subscribers were hitting the rate limit on later recipients, and the failure was recorded but never retried — so those recipients silently never got the email. The send loop is unchanged; the provider retries up to 3 times with
Retry-Afterhonoured (or 250ms default) before giving up.
- Welcome email now ends with the standard footer + working unsubscribe link (the same one broadcast newsletters use). The default body text already promises "every email has an instant unsubscribe at the bottom" — until this release, the welcome email had no footer at all, so the link was missing. Looks up the new subscriber's token to build the URL, falls back to no footer if for any reason the token can't be loaded.
- Sidebar menu label changed from "Newsletter" to "One Two Three Send". Submenu items (Dashboard, Newsletters, Subscribers, Settings, etc.) keep their original names — those describe specific features, only the top-level brand label changes.
- Welcome email body now supports rich HTML — paste headings, lists, emoji links, and CTA buttons into the body field at Newsletter → Settings → Welcome Email and they render. Bodies without any HTML tags still get the previous plain-text + wpautop treatment, so existing setups carry over unchanged.
- Signup forms gained a "Redirect after signup" field (Newsletter → Signup Forms → edit form). When set, the subscriber is redirected to that URL after a successful signup instead of seeing the inline success message. The token
{email}in the URL is replaced with the URL-encoded email so a follow-up page (e.g. a Stripe-checkout pricing page) can pre-fill the address. Leave blank to keep the existing inline-message behaviour.
- Docs: added a "Useful links" section in the Description with pointers to the features overview, documentation, pricing, privacy policy, and contact page on onetwothreesend.com. No code changes.
- Docs: clarified that the Claude API key is OPTIONAL — the plugin works fine for hand-written newsletters without it. The AI features (Generate, Rewrite, Shorten, Expand, Fix grammar, subject suggestions, tone check) only run when you click them, so a key is only needed if you want them. Updated the FAQ and install steps accordingly.
- Newsletters can now be marked Free or Paid from the edit screen. Free is the default and sends the full body to every active subscriber. The companion pro plugin applies the paywall when the mode is Paid.
- Added filter
otts_send_recipientsso pro-plugin Stripe paywall can segment free vs paid subscribers per newsletter. - Added filter
otts_render_for_subscriberso pro-plugin paywall can substitute a teaser + Subscribe CTA when a free subscriber receives a paid-newsletter send. - Added extension points on the Settings page:
otts_settings_tabsfilter,otts_render_settings_tab_{tab}andotts_save_settings_{tab}actions, so companion plugins can add their own tabs without modifying free-plugin files.
- Fix: differentiated Plugin URI and Author URI in the plugin header as required by the wordpress.org submission check.
- wordpress.org compliance pass based on Plugin Check report.
- Added translator comments to every translatable string with placeholders.
- Ordered placeholders (
%1$s,%2$s) in strings with multiple values. - Switched file operations to WP_Filesystem-aligned helpers (
wp_handle_upload,wp_delete_file). - Tightened
$_POST/$_GETsanitization pipeline (wp_unslash→sanitize_*). - Subscriber database queries now pass through
$wpdb->prepare()end-to-end. - Removed legacy
load_plugin_textdomain()call; WP 4.6+ auto-loads translations.
- Major refactor for wordpress.org submission.
- Removed license-gating system — all advertised features work out of the box.
- Removed phone-home license validation.
- Extended Phase 2 features (Stripe paywall, additional email providers, popup/slide-in forms) are now in a separate companion plugin.
- Added filter hooks for companion plugins:
otts_form_types,otts_provider_choices,otts_make_provider,otts_editor_action,otts_audit_checks. - Cleaner settings UI — Claude API key moved from Advanced to a dedicated AI tab.
- Merged lead-magnet delivery into the welcome email (one email per signup instead of two).
- Expired download links now auto-regenerate and email a fresh link when clicked.
- Default download link expiry bumped to 365 days.
- Improved default welcome email copy.
- New
{from_name}placeholder for email templates.
- Signup form is now cache-safe — swapped the nonce for a honeypot.
- Lead Magnet feature — upload a file, new subscribers receive a signed, time-limited download link.
- Welcome email on signup.
- Pre-send audit with 10 checks.
- Reorganised settings tabs.
- Hotfix for edit-newsletter page permissions.
- Initial release.