ATR Notifier vs Host Header Injection Fix

ATR Notifier allows administrators and store owners to to receive real-time notifications about order status updates directly in their Telegram chat, ensuring that you never miss an important event related to your business. Key Features: Instant Notifications: Get immediate alerts for various order statuses, including new orders, processing, completed, on-hold, cancelled, refunded, and failed orders. Customizable Messages: Tailor the notification messages to include essential order details such as order ID, customer information, total amount, and payment method. User-Friendly Setup: Easy to install and configure. Simply enter your Telegram bot token and chat ID to start receiving notifications. Support for Multiple Statuses: Receive notifications for all relevant order statuses. Emoji Support: Enhance your notifications with emojis that provide a visual cue for different order statuses. External services This plugin connects to an Telegram API to send orders information, it’s needed to achieve the purpose of sending messages to your Telegram bot. It sends the order status change details (selected statuses and details are determined by the web site admin). This service is provided by “Telegram”: terms of use, privacy policy. Creating and Using a Telegram Bot: A Non-Technical Guide Step 1: Set Up Your Telegram Bot Go to Telegram app, log in to your account, or create a new one. Type in @BotFather in the search field, and go to this bot. Start a chat with BotFather and type /newbot (including the /) Follow the prompts to name your bot and choose a username BotFather will provide you with a bot token – save this securely If you lose this token, you can retrieve it from @BotFather or you\’ll need to generate a new one. Step 2: Configure Your Bot Set a profile picture for your bot (optional) Add a description of what your bot does IMPORTANT! You MUST first send a message (anything) to the bot before the bot can send messages to you. Step 3: Get Your Chat ID Start a conversation with your new bot Send a message to your bot Open a web browser and enter: https://api.telegram.org/bot /getUpdates (Replace with your actual bot token) Look for the “id” field in the “chat” section of the response This number is your chat ID Step 4: Add Bot to the Plugin Settings Go to the plugin’s settings in admin menu Settings -> ATR Notifier General tab In Bot Token enter the bot token you received from BotFather In Chat ID enter the chat ID you found in Step 3 Check Enable Telegram option In the Select statuses check Woocommerce statuses you want to be notified on Save the settings. From now on every order status change you selected will send a message to your Telegram bot in your telegram account. Message details tab Check the details you want to see in the notifications

👉 Enables custom headers for WP email notifications 👉 Also provides a “set it and forget it” security fix for WP < 5.5 👉 Uses only 50KB of code, so super lightweight, fast, and effective Important As of WordPress 5.5, this plugin no longer is necessary to fix the host-header security issue reported in Ticket #25239 finally is fixed, and mentioned in this post WordPress 5.5 Beta 4. Thank You WordPress devs! Is this plugin still useful? Yes, it enables you to choose the “From”, “Name”, and “Return-Path” headers for all WP notification emails. And for versions of WordPress less than 5.5, this plugin continues to fix the host-header injection security issue. Features This simple plugin does three things: Sets custom From, Name, and Return-Path for WP notifications Fixes a security vulnerability in WordPress versions < 5.5 Fixes a bug where invalid email addresses may be generated (in WordPress versions < 5.5) Choose from the following options: Use WordPress defaults (insecure for WP < 5.5) Use “Email Address” from WP General Settings Use a custom name and address Plus there is an option to use the specified From address as the Return-Path header. Why? The security issue fixed by this plugin has been known about since way back in WordPress version 2.3. There has been some talk about fixing, but nothing has been implemented. While the issue does not affect all sites, it does affect a good percentage of them, including some of my own projects. So, not wanting to get hacked, I decided to write my own solution. Hopefully this issue gets fixed in a future version of WordPress, and this plugin will become unnecessary. As a bonus, setting an explicit From address resolves a long-standing bug whereby an invalid email address is generated under the following conditions: A “From” address is not set, And the $_SERVER['SERVER_NAME'] is empty So by explicitly setting a “From” address, we prevent this bug from happening. Security Issue What is the security issue addressed by this plugin? Follows is a quick summary. To learn more in-depth, check out the resources linked in the next section. WP uses $_SERVER['SERVER_NAME'] to set the “From” header in email notifications This includes sensitive email notifications like password resets and user registration In some cases, an attacker could modify the “From” header and intercept the email Using the intercepted email, an attacker could gain access to your site and wreak havoc More Infos This security vulnerability is well-known and has been around for a looong time. To learn more, check out these articles: WP Core Trac Ticket Exploit Box Info Exploit Database Privacy This plugin does not collect or store any user data. It does not set any cookies, and it does not connect to any third-party locations. Thus, this plugin does not affect user privacy in any way. Host Header Injection Fix is developed and maintained by Jeff Starr, 15-year WordPress developer and book author. Support development I develop and maintain this free plugin with love for the WordPress community. To show support, you can make a donation or purchase one of my books: The Tao of WordPress Digging into WordPress .htaccess made easy WordPress Themes In Depth Wizard’s SQL Recipes for WordPress And/or purchase one of my premium WordPress plugins: BBQ Pro – Blazing fast WordPress firewall Blackhole Pro – Automatically block bad bots Banhammer Pro – Monitor traffic and ban the bad guys GA Google Analytics Pro – Connect WordPress to Google Analytics Head Meta Pro – Ultimate Meta Tags for WordPress REST Pro Tools – Awesome tools for managing the WP REST API Simple Ajax Chat Pro – Unlimited chat rooms USP Pro – Unlimited front-end forms Links, tweets and likes also appreciated. Thank you! 🙂