WH4U Domains
| 开发者 | webhosting4ugr |
|---|---|
| 更新时间 | 2026年4月19日 15:37 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 6.9 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
WH4U Domains is a WordPress plugin that allows website owners and resellers to offer domain name services directly from their WordPress site. It integrates with the DomainsReseller API to provide real-time domain availability checking, registration, and transfer capabilities.
Features
- Domain Search -- Visitors can search for domain availability via a shortcode or Gutenberg block
- Public Registration & Transfer -- Anonymous visitors can submit domain registration and transfer requests that admins review and approve
- Admin Dashboard -- Full admin panel for managing orders, viewing API status, and monitoring the retry queue
- Reseller Support -- Per-user API credentials allow multi-reseller setups
- Retry Queue -- Failed API calls are automatically retried with exponential backoff
- Shopping Cart Redirect -- Optional redirect to WHMCS, Blesta, ClientExec, Upmind, or custom cart URL with the domain pre-filled when visitors click Register or Transfer
- Internationalization -- Fully translatable; Greek translation included
- Install and activate the plugin
- Configure your DomainsReseller API credentials under Domains > Settings
- Add the
[wh4u_domain_lookup]shortcode or the "Domain Lookup" block to any page - Visitors search for domains -- available domains can be registered, and taken domains can be transferred through the frontend form (or, if configured, sent to your WHMCS/Blesta/ClientExec/Upmind cart with the domain in the URL)
- Admins review and approve/reject public orders from the WordPress admin
安装:
- Upload the
wh4u-domainsfolder to/wp-content/plugins/ - Activate the plugin through the Plugins menu in WordPress
- Go to Domains > Settings > Credentials and enter your DomainsReseller API email and API key
- Set your default nameservers under the same Credentials tab
- Go to Domains > Settings > General to choose between Real-time or Notification-only registration mode
- (Optional) Under General, set Shopping Cart Redirect to WHMCS, Blesta, ClientExec, Upmind, or Custom and enter your cart URL so visitors are sent to your cart with the domain pre-filled
- Add
[wh4u_domain_lookup]to any page, or use the "Domain Lookup" Gutenberg block
屏幕截图:
常见问题:
Do I need a DomainsReseller account?
Yes. You need valid API credentials from WebHosting4U to use this plugin. Without credentials, the domain search will not function.
Can visitors register domains without logging in?
Yes. The frontend form allows anonymous visitors to submit registration and transfer requests. These are stored as pending orders that an admin must approve before the domain is processed through the API.
What happens if the API is temporarily unavailable?
Orders that fail due to temporary API issues (timeouts, server errors) are automatically queued for retry with exponential backoff. The retry queue processes items via WP-Cron.
Can I send customers to my WHMCS (or other) cart instead of the built-in form?
Yes. Under Domains > Settings > General, use the Shopping Cart Redirect section. Choose WHMCS, Blesta, ClientExec, Upmind, or Custom URL template, and enter your cart base URL (or full URL templates with {domain}, {sld}, {tld}). When a visitor clicks Register or Transfer, they will be redirected to your cart with the domain pre-filled.
Is the plugin translatable?
Yes. The plugin is fully internationalized. A Greek translation is included. Additional translations can be added via .po/.mo files in the languages/ directory.
更新日志:
1.5.5
- Removed: TLD Pricing admin page and all pricing-related code paths. The upstream DomainsReseller API
/tlds/pricingendpoint returnsregistrationPrice: nullfor TLDs whose registry enforces multi-year registration minimums (notably.gr, which requires a 2-year minimum), so a pricing table rendered from this endpoint cannot reliably display prices for every reseller-enabled TLD. Rather than half-showing data, the "View Pricing" tile on the dashboard now links out to the authoritative WHMCS pricing page athttps://webhosting4u.gr/customers/index.php?m=DomainsReseller&mg-page=Prices - Removed:
admin/class-wh4u-admin-pricing.php,rest-api/class-wh4u-rest-pricing.php, the/wh4u/v1/tlds,/wh4u/v1/tlds/pricing,/wh4u/v1/tlds/pricing/cache, and/wh4u/v1/pricing/(register|transfer)REST endpoints, thewh4u_tld_pricing_v2transient, theloadPricing()admin JS routine, the frontendprefetchPricing()/getPriceForTld()code path, theshow_pricingappearance setting, theshowPricingblock attribute, thedata-show-pricingshortcode data attribute, and the.wh4u-domains__result-priceCSS rules - Changed: dashboard "View Pricing" quick link is now an external link (opens the WHMCS pricing page in a new tab with
rel="noopener noreferrer")
- Fix: TLD pricing page left the register column blank for ccTLDs whose upstream response emits an empty
registrationPricefield because they have no 1-year tier (notably.gr, whose registry enforces a 2-year minimum).extract_price()in the REST pricing controller now skips empty scalars/arrays instead of accepting the first matching key, recurses into nested period-keyed arrays picking the lowest numeric period (so{"2":"24.00","4":"48.00"}surfaces the 2-year price), and as a last resort scans period-suffixed variants likeregister2orregistrationPrice_2y - Added: "Refresh Cache" button on the TLD Pricing admin page, backed by a new
DELETE /wh4u/v1/tlds/pricing/cacheendpoint (gated by thewh4u_manage_domainscapability) that clears both thewh4u_tld_pricing_v2andwh4u_tlds_cachetransients; needed because the previous normalization was cached for 12 hours and existing sites would otherwise keep serving stale empty prices after upgrade
- i18n: reinstated
load_plugin_textdomain()on theinithook so self-hosted installs load translations correctly under WordPress 6.7+ (where gettext calls beforeinitno longer resolve the user locale) - i18n: replaced string concatenation patterns (
__( 'API call failed: ' ) . $msg,$label . ' ' . __( 'Contact' ),$period . ' ' . __( 'year(s)' )) withsprintf/_nagainst%s/%dplaceholders in admin-dashboard, admin-domains, admin-history, and notifications; word order can now be reordered per locale without code changes - i18n: replaced the hardcoded English
' yr'unit in the order history period column with a proper_n( '%d year', '%d years' )plural form - i18n: added translator comments (
/* translators: ... */) on every newsprintf/_ncall per the WordPress handbook - i18n: regenerated
wh4u-domains.pot(412 strings) from the updated source, merged intowh4u-domains-el.po, and translated the remaining 77 previously-untranslated Greek strings (Frontend Appearance panel, Shopping Cart Redirect, Turnstile, Reverse Proxy / Trusted IPs, Public Orders post type + status plurals, block editor title/description/keywords, encryption key notices) - i18n: rebuilt
wh4u-domains-el.moand the JSON translation file consumed bywp_set_script_translations(); removed two orphan JSON files whosesourcefield held malformed artifacts ((JS,i18n)) from a prior tooling run
- Security: encryption key management rewrite -- removed the auto-generate-to-wp_options fallback so decryption keys are never created in the database; added a one-shot idempotent migration (guarded by a 5-minute transient lock) that re-encrypts reseller settings, order contacts, site settings, and public-order PII postmeta under the preferred WH4U_ENCRYPTION_KEY / AUTH_KEY-derived key and only deletes the legacy wp_options key after every row migrates successfully
- Security: webhook delivery now passes
redirection => 0towp_remote_post(), closing a redirect-based SSRF bypass where a crafted 3xx response could divert a webhook away from the validated/pinned host - Security:
save_reseller_settings()in the admin reseller screen now re-verifies thewh4u_reseller_settings_nonceinside the save handler (defense-in-depth alongside the existingcheck_admin_referer()wrapper) - Security: defense-in-depth
(int)cast on$item->order_idin the retry queue before it reaches$wpdb->prepare()with a%dplaceholder, eliminating any theoretical type-confusion path regardless of upstream callers - Security: removed the unused
WH4U_Logger::get_logs()method so the admin-only log reader no longer exists as latent attack surface (no callers in the plugin)
- i18n: compiled Greek .mo binary from the existing .po catalogue so WordPress gettext loads translations at runtime without relying on a language pack
- i18n: all public-facing form labels (First Name, Last Name, Email, Phone, Address, City, State/Province, Country Code, Zip/Postal Code, Registration Period, Transfer Period, EPP/Auth Code, etc.) now render in Greek on el locale sites
- Security: registrant PII in pending public orders (name, email, phone, address, company, EPP code) is now encrypted at rest in post meta using the existing AES-256-CBC + HMAC-SHA256 envelope; legacy plaintext rows keep reading via a transparent fallback
- Security: validated the domain regex on public order submission to accept punycode (ACE-encoded) TLDs such as xn--fiqs8s while continuing to reject malformed inputs
- Housekeeping: added a daily WP-Cron task that prunes
wh4u_api_logsandwh4u_notificationsrows older than 30 days; retention is filterable via thewh4u_log_retention_daysfilter - Housekeeping: removed the orphan
wh4u_public_ordersdatabase table from activation (public orders have always been stored as a custom post type with post meta); the DROP statement in uninstall.php remains for legacy installs - i18n: regenerated the POT template against the current source and generated JSON translation files (
wp_set_script_translations) so Greek (and any future locale) covers the block editor InspectorControls panel labels - i18n: bumped Project-Id-Version in the POT and Greek .po header from 1.0.0 to the current release
- Security: Turnstile secret key is now encrypted at rest (AES-256-CBC + HMAC-SHA256), matching the treatment of reseller API keys
- Security: encryption key derivation prefers the WH4U_ENCRYPTION_KEY constant, then AUTH_KEY/SECURE_AUTH_KEY salts; auto-generated DB-stored keys are now only kept for legacy installs
- Security: anonymous domain lookup and public pricing queries now require an administrator to explicitly designate a public-lookup reseller (Domains > Settings > General); the previous "first reseller in DB" fallback is removed
- Security: webhook delivery validates the resolved host IP once and pins it via CURLOPT_RESOLVE for the outgoing request, closing the DNS-rebinding window; DNS failures now fail-closed instead of allowing the request
- Security: rate limiter now supports opt-in trusted-proxy configuration (Cloudflare, nginx, X-Forwarded-For leftmost, True-Client-IP) with a declared list of trusted proxy IPs; client-supplied headers are ignored unless both settings are configured
- Privacy: added an explicit "Data stored locally" section to the readme describing order records, public order submissions, API logs, retry queue, rate-limit counters, and encrypted reseller settings
- Fixed plugin directory name to match text domain and slug (wh4u-domains)
- Removed load_plugin_textdomain call (handled automatically by WordPress.org since WP 4.6)
- Removed Domain Path header (unnecessary for WordPress.org-hosted plugins)
- Moved inline CSS, JS, and link tags in appearance preview to use wp_enqueue_style, wp_enqueue_script, and wp_add_inline_style
- Extracted preview JavaScript into dedicated admin/js/wh4u-preview.js file
- Improved sanitize_settings: added is_array check, applied wp_unslash to full input array
- Added defensive esc_attr escaping on all ternary-output patterns
- Added export-ignore rules to .gitattributes for .gitignore, .gitattributes, and .github
- Fixed Contributors field in readme.txt to match WordPress.org username
- Added optional Cloudflare Turnstile bot protection for public registration and transfer forms
- Turnstile site key and secret key configurable under Domains > Settings > General
- Client-side Turnstile widget rendered explicitly with auto theme detection
- Server-side token verification on public order REST endpoints before order creation
- Turnstile is fully optional -- forms work without it when keys are not configured
- Enriched domain lookup frontend with skeleton shimmer loading cards during API calls
- Added popular TLD chips below the search bar (configurable in Appearance > Search Bar)
- Primary result card now highlighted with accent styling and "Best match" badge
- Pricing display on available domain results when show-pricing is enabled
- Dark mode support via prefers-color-scheme media query (respects user color overrides)
- Animated SVG status icons (checkmark/X) on result cards with entrance animation
- Copy-to-clipboard button on each result card with tooltip feedback
- Animated placeholder text cycling through example domains in the search input
- Automatic theme design adoption: plugin detects active theme colors, fonts, spacing, and border radius from theme.json
- Theme compatibility banner in Appearance settings showing detected design tokens
- Fixed appearance settings not passing to frontend when using global defaults
- Improved i18n: removed hardcoded English fallback strings in JavaScript
- Added shopping cart redirect: optional redirect to WHMCS, Blesta, ClientExec, Upmind, or custom URL when visitors click Register or Transfer
- Domain (or sld/tld) is passed in the cart URL so the billing cart opens with the chosen domain
- Configure under Domains > Settings > General (Shopping Cart Redirect section)
- Added public domain registration and transfer via frontend form
- Added admin approve/reject workflow for public orders
- Added automatic API processing on order approval
- Added retry queue for failed API calls
- Added Greek translation
- Initial release
- Domain search, registration, and transfer
- Admin dashboard with API status and credits
- Per-user reseller credentials with encrypted storage
- TLD pricing display
- Rate limiting and logging