Ultimate Push Notifications

Push notifications have 4x higher open rates than email. Keep your customers, community members, and team informed the moment something happens — for free.

• One-click setup: generate a key pair and you are done. No Firebase project, no Google account
• Standards-based delivery (RFC 8030 / 8291 / 8292) straight to each browser's push service
• Background queue with automatic retry and per-service backoff — sends never slow down checkout
• Health page checks every link in the chain and says exactly what is wrong when something is
• Service Worker handles background notifications even when the browser is closed
• Rich notifications: show images inside the push popup
• Click-to-navigate: clicking a notification opens the right page automatically
• Auto-cleanup: invalid / expired device tokens are removed automatically — no stale bloat Subscribers — Unlimited, Yours
• Visitors subscribe without an account; members subscribe with theirs. No cap, in any tier, ever
• Soft-ask prompt: your own dismissible bar asks first — after N seconds, page views or scroll depth — and only hands off to the browser's one-shot permission prompt when the visitor clicks Allow
• Floating bell, [upn_subscribe] shortcode, a Push Subscribe Button block, or any element with data-upn-subscribe
• Subscriber list shows browser, OS, device, locale, time zone, last seen, last delivery and consent — with Logged-in / Visitors / Web Push views
• Privacy tools: subscriptions and preferences are exported and erased with the account (WordPress Privacy → Export / Erase) Compose & Send
• Write a notification, pick an audience — everyone, visitors, members, roles, device type, active in the last N days — see the live recipient count, send it to your own device first, then send
• Merge tags — {site_name}, {post_title}, {user_name}, {first_name} and more, plus event tags in automations
• Rich payload: icon, large image, click URL; click tracking with click-through rate on the Health page Automations
• Push on publish — new posts (or any post type) go to your subscribers automatically, with the featured image
• Event automations — trigger → audience → message. Free runs three at a time:
• WordPress: new user registers, comment posted
• WooCommerce: new order, order status changes (filter by status), payment received, added to cart, low stock, out of stock
• BuddyPress: friend request, friend accepted, private message, member update (to their friends), reply to an update, group update (to the group), member joins a group (to its admins)
• Contact Form 7: form submitted — every field is a merge tag, {field_your_email}, whatever the form's field names
• Each automation chooses who: store staff by role, the product's author (vendor), the customer, the message recipients, the group's members… The person who caused the event is left out unless you say otherwise
• Members turn any automation off for themselves under Set Notifications (and in their BuddyPress profile) Device Management
• Every device is tracked individually; one member can register several
• Test notifications directly from the admin — verify delivery before going live
• Devices a push service reports as gone are removed automatically

1. Open UPush Notifier → App Config and click Generate key pair. That is the whole setup — no Firebase, no Google account.
2. Turn on the Subscribe Prompt, add the bell or the block — or have members open Register My Device — and visitors allow notifications
3. Their browser is registered — compose a notification, or let an automation send one

• The VAPID private key never leaves the database and is never sent to the browser
• All user inputs are sanitized through WordPress standards
• AJAX endpoints use nonce verification (SECURE_AUTH_SALT)
• Capability checks enforce admin-only access to sensitive settings
• VAPID key authentication ensures only your server can send notifications

• WordPress 5.0 or higher
• PHP 7.4 or higher
• SSL (HTTPS) required — browsers block push notification registration on non-secure sites
• OpenSSL PHP extension (present on virtually every host)
• Nothing else — no third-party account

• One user can register multiple browsers / devices
• For testing: use different browsers or incognito windows logged in as different users
• Use the Register My Device page to register your own device and test with one click

1. Install and activate the plugin
2. Go to UPush Notifier → App Config and click Generate key pair
3. Go to UPush Notifier → Register My Device and click Allow when the browser asks
4. Send a test notification — you should receive it within a second or two
5. Open UPush Notifier → Health to confirm every part of the path is working

• Getting started with Web Push

• {site_name} {site_url} {date} {time}
• {post_title} {post_url} {post_excerpt} {post_type} {author_name} — when the notification is about a post
• {user_name} {user_login} {user_email} {first_name} — when it is about a user WooCommerce automations
• {order_id} {order_total} {order_status} {status_from} {customer_name} {customer_email} {items_count} {item_names} {payment_method} {order_url} {order_admin_url}
• {product_title} {product_price} {product_url} {quantity} {shopper_name} {stock_quantity} {product_admin_url} BuddyPress automations
• {initiator_name} {friend_name} {sender_name} {message_subject} {message_excerpt} {thread_url} {member_name} {activity_excerpt} {activity_url} {commenter_name} {comment_excerpt} {group_name} {group_url} {requests_url} {profile_url} Contact Form 7 automations
• {form_title} {form_summary} {form_url} and every field as {field_<name>} — e.g. {field_your_email} for a field named your-email The automation editor lists the tags each trigger provides. Add your own with the upn_merge_tags filter.

For support, feature requests, and bug reports: * Visit [codesolz.net](https://codesolz.net/?utm_source=wordpress.org&utm_medium=README&utm_campaign=ultimate-push-notifications) for instant support * Email: [support@codesolz.net](mailto:support@codesolz.net) * GitHub: [github.com/CodeSolz/ultimate-push-notifications](https://github.com/CodeSolz/ultimate-push-notifications) * Forum: [forum.codesolz.net](https://forum.codesolz.net/?utm_source=wordpress.org&utm_medium=README&utm_campaign=ultimate-push-notifications)

1. Upload the ultimate-push-notifications folder to the /wp-content/plugins/ directory
2. Activate the plugin through the Plugins menu in WordPress
3. Go to UPush Notifier → App Config and click Generate key pair
4. Go to UPush Notifier → Register My Device to register your browser
5. Send a test notification to confirm everything is working

• New: 13 more automation triggers (29 in all): post or product published / updated; WooCommerce price drop and back in stock; BuddyBoss / BuddyPress Follow new follower and "someone you follow published"; and a Membership group for Paid Memberships Pro, MemberPress, Restrict Content Pro, WooCommerce Memberships, Ultimate Member and LearnDash — each shown only while its plugin is active, with the member as the audience and the plan, level or course as merge tags.
• New: Home Screen app. Turn it on under Subscribe Prompt and the plugin serves a web app manifest built from your Site Icon and tags every page for installation, so iPhone and iPad visitors (iOS 16.4+) can add the site and subscribe — and the soft-ask bar shows them how instead of a prompt they cannot act on. Steps aside if another plugin already provides a manifest. A Health check says whether the site is installable.
• New: The menu is six entries with tabs — Compose, Automations, Subscribers, Subscribe Prompt, Health, Settings — instead of one entry per screen. Every old link still works.
• Changed: Every screen now shares the plugin's own look (the App Configuration panel): heading with a subtitle, hints, label / input rows, section titles, submit bar, footer. Screens fill the width and work on a narrow window.
• Pro: Each new trigger names, right in the rule editor, the Pro step that completes it — per-shopper price and stock alerts, conditions, digests, frequency caps, carriers, goals, a welcome series. The free plugin makes the first send; Pro finishes the workflow.
• Fixed: WooCommerce no longer flags the plugin as incompatible with High-Performance Order Storage or block checkout — compatibility is declared; orders were only ever read through WooCommerce's own APIs. The top-level menu entry could fatal if opened directly (its callback was a leftover from another product); it now opens the first screen you may see.
• Developer: admin\builders\Layout, admin\builders\Screens (upn_admin_groups), Trigger::next(), pwa\Manifest (upn_pwa_manifest, upn_pwa_deferred), UPN_WebPush.needsInstall; entitlement keys network, commerce, pwa.install, ai.segments, risk.

• New: Each delivery can be held for later or left out per subscriber just before it goes out — the seam quiet hours, frequency caps and digests are built on. Held deliveries wait in the queue without counting as a failed attempt; test and preview sends are never held. Recipients held back are shown apart from failures on the Health page.
• Changed: the service worker's click beacon now sends same-origin credentials, so a first-party cookie can be set from it (used by Pro to credit a later WooCommerce order to the notification that was clicked).
• Developer: upn_delivery_hold, upn_delivery_skip, upn_delivery_skipped, JobOutcome::defer(), upn_automation_dispatch, upn_automation_sanitize_extra, upn_rule_editor_extras, upn_subscription_created, DeliveryLog::add_recipients(), upn_sanitize_fields_extra, the upn:bell-click event and UPN_WebPush.post() / .endpoint(), upn_automations_capability.
• Major: Anonymous subscribers. Visitors subscribe without an account; there is no subscriber cap in any tier. Each subscription records browser, OS, device, locale, time zone, last seen and when/where consent was given.
• Major: Compose (UPush Notifier → Compose). Write a notification, pick an audience with a live recipient count, send it to your own device first, then send. One request queues one job however large the audience; the fan-out runs in the background.
• Major: Event automations rebuilt as trigger → audience → message rules with merge tags. 16 triggers across WordPress, WooCommerce, BuddyPress and Contact Form 7. Every audience is explicit: roles, specific users, all members, all visitors, everyone, or the people the event is about — the customer, the products' authors, the message recipients, the member's friends, the group's members. The person who caused the event is left out unless the rule says otherwise. Free runs three automations at a time.
• Fixed by the rebuild: WooCommerce alerts went to the product author only, so a multi-author store's owner got nothing; five BuddyPress activity events notified the member who had just performed the action; "new user registered" targeted the new user, who has no device, so it could never fire; Contact Form 7 only read the four default field names. All four are gone with the old engine.
• New: Push on publish — any post type, with the featured image, once per post.
• New: Subscribe Prompt (UPush Notifier → Subscribe Prompt). A dismissible soft-ask bar shown after a delay, page-view count or scroll depth, a floating bell, the [upn_subscribe] shortcode and a Push Subscribe Button block. The browser's permission prompt is only ever shown after a click.
• New: Merge tags, registry-driven (upn_merge_tags), with per-trigger event tags listed in the automation editor. Contact Form 7 exposes every field as {field_<name>}.
• New: Click tracking. The service worker reports clicks; the Health page shows clicks and click-through rate per send, and each subscriber records when they last clicked.
• New: Privacy tools — subscriptions and automation preferences are included in WordPress personal data export and erasure, and removed when an account is deleted.
• New: The subscriber list shows browser, OS, device, push service, locale, time zone, last seen, last delivery, last error, delivered counts and consent, with All / Logged-in / Visitors / Web Push / Legacy FCM views, sortable columns and a search across all of it.
• Changed: Set Notifications is now a member's list of automations to receive or not. Notification copy lives on the automation, not per user. The same form appears in a BuddyPress member's profile.
• Changed: The upn_notifications per-user table is no longer created or used; existing installs keep it untouched.
• Fix: The background queue now books its next tick for the earliest future job, so a long Retry-After backoff or a delayed job no longer waits for someone to open wp-admin; and a tick already booked for later is moved up when work is queued now.
• Developer: The Free/Pro seam — Entitlements::can() with the upn_can filter, fail-closed on unknown keys — and the extension points upn_automation_triggers, upn_automation_rule_matches, upn_automation_audience, upn_automation_fields, upn_automation_fired, upn_automation_active_limit, upn_autopush_fields, upn_before_broadcast, upn_allow_anonymous_subscriptions, upn_notification_clicked, upn_sanitize_audience, upn_audience_where, upn_ajax_handlers, upn_queue_housekeeping, and the window.UPN_Compose script hook.
• Major: Native Web Push (VAPID) is now the default transport. Setup is one click — no Firebase project, no Google account, no server key. Sends go from your server directly to each browser's push service using RFC 8030/8291/8292; the encryption is verified against the RFC 8291 published test vector.
• Major: Background delivery queue. Sends no longer run on the triggering request (a customer's checkout, a member's message). Jobs are claimed atomically, retried with exponential backoff, honour a push service's Retry-After, and drain through Action Scheduler when present or WP-Cron otherwise.
• New: Health page (UPush Notifier → Health). Live checks for HTTPS, PHP, cryptography, keys, transport, the service worker, registered devices, legacy devices, the queue and recent deliveries — each with a plain explanation and a fix. Scored from 100 with every deduction shown.
• New: Delivery log. The upn_notification_log table (created in 1.3.0, never written) now records every send with per-recipient success, failure, expiry and retry counts and the first error message.
• New: Service worker is served from the site root (/?upn_sw=1), so it can act site-wide. Re-subscribes automatically when a push service rotates a subscription.
• New: Subscribe/unsubscribe from any theme via data-upn-subscribe / data-upn-unsubscribe attributes or window.UPN_WebPush.subscribe(). Permission is only requested on a user gesture — never cold on the first page view.
• Changed: Devices are addressed by row id and deduplicated on the full endpoint or token. The prefix-LIKE matching that could delete another user's device is gone.
• Changed: Test sends report the real reason on failure, and a device the push service reports as gone is removed from the list.
• Changed: Legacy Firebase sending is retained for existing rows but reports the API shutdown date rather than an unexplained 401. Firebase-registered devices need to open Register My Device once to re-register over Web Push.
• Developer: New extension points — upn_transports, upn_before_send, upn_after_send, upn_subscription_pruned, upn_delivery_logged, upn_queue_job_handlers, upn_queue_enabled, upn_health_checks, and more.
• Requires: PHP 7.4 or newer.
• Security: Device tokens are now bound to the authenticated user server-side. Previously the account was read from the request body, which allowed an unauthenticated visitor to attach their own device to any account — including an administrator — and receive that account's private notifications. All sites should update.
• Security: Fixed the recursive input sanitizer, which discarded its own result and returned array input unsanitized.
• Security: Fixed two SQL injections in the registered-devices list (s and order request parameters). One was reachable by any subscriber via the Register My Device screen.
• Security: The AJAX endpoint no longer invokes arbitrary plugin classes supplied by the request. Handlers are now explicitly allow-listed and each requires a capability.
• Security: The BuddyPress notification-settings form now verifies its nonce. The previous guard (isset( $_POST )) was always true, so the handler ran and saved on every page view.
• Security: Bulk device deletion is now scoped to the current user unless the caller can manage_options.
• Security: Removed a Firebase configuration that had been committed to the repository and shipped in the plugin package. Fresh installs previously ran against it until App Config was saved.
• Fix: The activation routine was registered as a deactivation hook, so it never ran on activation and no schema change could reach an existing site. Tables are now installed and upgraded through dbDelta() with a real version check.
• Fix: Added indexes on upn_user_devices.user_id, upn_user_devices.token and upn_notifications.user_id — all were unindexed despite being the hot lookup path on every send.
• Fix: The registered-devices list no longer fatals on a row whose user account has been deleted.
• Removed: The Events Calendar settings tab. It collected preferences that could never trigger a notification — no hooks were ever registered for it. The stored preferences and the upn_the_events_calendar_fields filter are preserved.
• Removed: Dokan / WCFM multi-vendor claims from the plugin description. No such integration existed in the code; WooCommerce seller alerts go to the product author.
• Removed: Dead files shipped in the package — a duplicate SetNotifications class declaration, an unused clone of the BuddyPress notification class, the orphaned Firebase v7 SDK copies, a device-manager class that called a development-only function, and stray readme/idea files.
• Housekeeping: Corrected readme claims for BuddyPress activity events and new-user registration that did not match the implementation.
• Housekeeping: The plugin header now declares Requires PHP: 7.4, matching what readme.txt has stated for some time. WordPress enforces the header, so sites still on PHP 7.0–7.3 will no longer be offered updates — those versions have been unsupported by the PHP project since 2021.

• Major: Firebase SDK updated from v7.15.5 to v11.0.0 compat — fixes compatibility with modern browsers
• Major: Service worker updated to use onBackgroundMessage() — replaces removed setBackgroundMessageHandler()
• New: VAPID Key (Web Push Certificate) field added to App Config — required for modern browser push registration
• New: Rich notifications — image support added to push notification payload (desktop & mobile)
• New: Notification click-to-navigate — clicking a notification now opens the correct URL (handled in service worker)
• New: Auto-cleanup of invalid device tokens — NotRegistered / InvalidRegistration tokens are deleted automatically
• New: Notification delivery log database table (upn_notification_log) for tracking send history
• New: WooCommerce buyer (customer) now also receives order status change notifications — not just the seller
• Security: FCM server key is no longer exposed to browser JavaScript via UPN_Notifier localized object
• Fix: WooCommerce build_notific_on_payment_complete() — undefined variable bug fixed (order checked before use)
• Fix: prepare_send_notifications() — missing image field added to payload, click_action falls back to site_url()
• Fix: Return value consistency — all notification builders now return empty array instead of undefined on no-op
• Improvement: Firebase scripts now load from Google CDN with explicit dependency chain for correct load order
• Improvement: measurementId and vapidKey are treated as optional fields — saving config no longer blocks on them
• Compatibility: WordPress 6.8 tested, WooCommerce 10.2 tested CHECK THE FULL CHANGELOG.