Host Header Injection Fix vs Smart Marketing SMS and Newsletters Forms

👉 Enables custom headers for WP email notifications 👉 Also provides a “set it and forget it” security fix for WP < 5.5 👉 Uses only 50KB of code, so super lightweight, fast, and effective Important As of WordPress 5.5, this plugin no longer is necessary to fix the host-header security issue reported in Ticket #25239 finally is fixed, and mentioned in this post WordPress 5.5 Beta 4. Thank You WordPress devs! Is this plugin still useful? Yes, it enables you to choose the “From”, “Name”, and “Return-Path” headers for all WP notification emails. And for versions of WordPress less than 5.5, this plugin continues to fix the host-header injection security issue. Features This simple plugin does three things: Sets custom From, Name, and Return-Path for WP notifications Fixes a security vulnerability in WordPress versions < 5.5 Fixes a bug where invalid email addresses may be generated (in WordPress versions < 5.5) Choose from the following options: Use WordPress defaults (insecure for WP < 5.5) Use “Email Address” from WP General Settings Use a custom name and address Plus there is an option to use the specified From address as the Return-Path header. Why? The security issue fixed by this plugin has been known about since way back in WordPress version 2.3. There has been some talk about fixing, but nothing has been implemented. While the issue does not affect all sites, it does affect a good percentage of them, including some of my own projects. So, not wanting to get hacked, I decided to write my own solution. Hopefully this issue gets fixed in a future version of WordPress, and this plugin will become unnecessary. As a bonus, setting an explicit From address resolves a long-standing bug whereby an invalid email address is generated under the following conditions: A “From” address is not set, And the $_SERVER['SERVER_NAME'] is empty So by explicitly setting a “From” address, we prevent this bug from happening. Security Issue What is the security issue addressed by this plugin? Follows is a quick summary. To learn more in-depth, check out the resources linked in the next section. WP uses $_SERVER['SERVER_NAME'] to set the “From” header in email notifications This includes sensitive email notifications like password resets and user registration In some cases, an attacker could modify the “From” header and intercept the email Using the intercepted email, an attacker could gain access to your site and wreak havoc More Infos This security vulnerability is well-known and has been around for a looong time. To learn more, check out these articles: WP Core Trac Ticket Exploit Box Info Exploit Database Privacy This plugin does not collect or store any user data. It does not set any cookies, and it does not connect to any third-party locations. Thus, this plugin does not affect user privacy in any way. Host Header Injection Fix is developed and maintained by Jeff Starr, 15-year WordPress developer and book author. Support development I develop and maintain this free plugin with love for the WordPress community. To show support, you can make a donation or purchase one of my books: The Tao of WordPress Digging into WordPress .htaccess made easy WordPress Themes In Depth Wizard’s SQL Recipes for WordPress And/or purchase one of my premium WordPress plugins: BBQ Pro – Blazing fast WordPress firewall Blackhole Pro – Automatically block bad bots Banhammer Pro – Monitor traffic and ban the bad guys GA Google Analytics Pro – Connect WordPress to Google Analytics Head Meta Pro – Ultimate Meta Tags for WordPress REST Pro Tools – Awesome tools for managing the WP REST API Simple Ajax Chat Pro – Unlimited chat rooms USP Pro – Unlimited front-end forms Links, tweets and likes also appreciated. Thank you! 🙂

🇵🇹 VERSÃO EM PORTUGUÊS (PT-PT) E-goi Smart Marketing: O Motor de Crescimento All-in-One para o Seu WordPress! Cansado de ter contactos no seu site que nunca se transformam em vendas? O plugin E-goi Smart Marketing SMS and Newsletters Forms é o seu atalho para o sucesso, transformando o seu website WordPress ou loja WooCommerce numa máquina de marketing e automação integrada. Venda mais, recupere vendas perdidas e automatize a sua comunicação, tudo a partir de um só lugar! 💡 PORQUÊ INICIAR OU MUDAR PARA O E-GOI SMART MARKETING? 1. Captação Múltipla e Compatibilidade Total Chega de widgets, pop-ups e shortcodes de diferentes ferramentas! Simplifique a sua gestão e capte contactos de forma eficaz, em qualquer canal: Captação: Crie Pop-ups, Formulários Simples e Complexos, Widgets e Barra de Subscrição — tudo a partir de um único painel. Comunicação: Use o Connected Sites para ligar o seu site a canais como Web Push, SMS e E-mail. Compatibilidade: Garanta que os seus formulários e elementos de design funcionam com Elementor, Gutenberg, WPBakery Page Builder, Contact Form 7 e Gravity Forms. 2. Integração Profunda com WooCommerce (Track & Engage) O E-goi oferece uma integração de dados de compra profunda para automações que geram receita: Vendas Perdidas: Ative o Track & Engage para monitorizar Carrinhos Abandonados e comportamento de navegação, permitindo automações de recuperação por E-mail e SMS. Visão 360º da Encomenda: Sincronize Produtos e utilize o Converter Encomendas (API Backend) para registar no E-goi o estado exato de todas as compras. Conteúdo Automatizado: Envie campanhas de e-mail sobre um produto automaticamente (requer WooCommerce). 3. Entregabilidade Essencial com E-mail Transacional (SMTP) O seu marketing é inútil se os e-mails não chegarem. Confie a sua reputação de remetente a quem sabe: Fim ao SPAM: Utilize o E-mail Transacional (SMTP) do E-goi para processar todos os e-mails críticos do WordPress e WooCommerce. Relatórios: Melhore a sua taxa de entregabilidade e aceda a relatórios detalhados de envios, aberturas e cliques. 4. Automação Simples e Poderosa com RSS Feed Mantenha a sua audiência a par das novidades, sem ter de criar e-mails manualmente todas as semanas: Feeds Personalizados: Crie RSS Feeds por Categorias, Tags ou Tipo (Artigos/Produtos). Campanhas Automáticas: Transforme esses Feeds em Campanhas RSS Feed automáticas. Conformidade: Garanta a qualidade e a segurança dos seus dados com Double Opt-in (RGPD). Novidades: Conversão de Encomendas (API Backend): Monitorização e sincronização dos estados de encomenda (“Criada”, “Pendente”, “Cancelada”, “Completa” e “Desconhecida”) diretamente com o E-goi. Funcionalidades: Geral: 100% Gratuito, Sincronização automática de contactos, Connected Sites, E-goi Track & Engage, Bloco E-goi para Gutenberg. Captação de Leads: Formulários Simples, Formulários Múltiplos, Barra de Subscrição, Formulários Pop-up, Formulários Widgets. Automação & E-commerce: Conversão de encomenda por estado (API Backend), Campanha E-mail com publicação de artigo, Sincronização produtos Woocommerce. Canais & Conteúdo: Notificações Web Push, RSS Feed por categorias, tags ou produtos. E-mail Transacional (SMTP) E-goi: Envio de todos os e-mails do WordPress e WooCommerce pelo E-goi, com melhor entregabilidade. Compatibilidade: Integração com WooCommerce, CF7, Gravity Forms, Elementor, WPBakery Page Builder. Conformidade: Opção de validação dos contactos com Double Opt-in (RGPD), Associação de Tags a formulários. Add-on: Plugin E-goi SMS Orders Alert/Notifications Requisitos: Plano E-goi com acesso a sua API Key. WordPress na versão 4.7 ou superior. Já tem uma conta E-goi? Criar conta E-goi gratuita 🇬🇧 ENGLISH VERSION (EN-EN) E-goi Smart Marketing: The All-in-One Growth Engine for Your WordPress! Tired of having contacts on your site that never turn into sales? The E-goi Smart Marketing SMS and Newsletters Forms plugin is your shortcut to success, transforming your WordPress website or WooCommerce store into an integrated marketing and automation machine. Sell more, recover lost sales, and automate your communication, all from one place! WHY SWITCH TO E-GOI SMART MARKETING? 1. MULTIPLE LEAD CAPTURE AND FULL COMPATIBILITY No more widgets, pop-ups, and shortcodes from different tools! Simplify your management and capture contacts effectively, across any channel: Multiple Capture: Create Pop-ups, Simple and Complex Forms, Widgets, and Subscription Bar — all from a single panel. Immediate Communication: Use Connected Sites to link your site to multiple E-goi channels, such as Web Push, SMS, and E-mail, re-engaging visitors wherever they are. Full Compatibility: Ensure your forms and design elements work with Elementor, Gutenberg, WPBakery Page Builder, Contact Form 7, and Gravity Forms. 2. DEEP WOOCOMMERCE INTEGRATION (TRACK & ENGAGE) Go beyond the basics. E-goi offers deep purchase data integration for automations that generate revenue: Lost Sales Automation: Activate Track & Engage to monitor Abandoned Carts and real-time browsing behavior, enabling recovery automations via E-mail and SMS. 360º Order View: Synchronize Products and use the Order Conversion (API Backend) to record the exact status of all purchases in E-goi (“Created”, “Pending”, “Canceled”, “Completed” or “Unknown”), allowing for highly segmented post-purchase automations. Automated Content: Send e-mail campaigns about a product automatically as soon as you publish a new article (requires WooCommerce). 3. ESSENTIAL DELIVERABILITY WITH TRANSACTIONAL E-MAIL (SMTP) Your marketing is useless if the emails don’t arrive. Trust your sender reputation to the experts: End SPAM: Use E-goi’s Transactional E-mail (SMTP) to process all critical emails from WordPress and WooCommerce (password recovery, order confirmations). Reports and Trust: Improve your deliverability rate and access detailed reports on sends, opens, and clicks to track transactional performance. 4. SIMPLE AND POWERFUL AUTOMATION WITH RSS FEED Keep your audience up-to-date with news without having to manually create emails every week: Custom Feeds: Create RSS Feeds by Categories, Tags, or Type (Articles/Products). Automatic Campaigns: Transform these Feeds into automatic RSS Feed Campaigns that are sent to your subscribers on a schedule without intervention. Compliance: Ensure the quality and security of your data with the option for contact validation via Double Opt-in (GDPR). What’s new: Order Conversion (API Backend): Monitoring and synchronization of order statuses (“Created”, “Pending”, “Canceled”, “Completed” or “Unknown”) directly with E-goi. Features: Geral: 100% Free, Automatic contact synchronization (incl. custom fields), Connected Sites, E-goi Track & Engage, Gutenberg E-goi Block. Lead Capture: Simple Forms, Multiple Forms (via Connected Sites), Subscription Bar, Pop-up Forms (Visit and Exit Intent), Widget Forms. Automation & E-commerce: Order sync by status (API Backend), E-mail campaign on article publication, WooCommerce product synchronization. Channels & Content: Web Push Notifications, RSS Feed by categories, tags or products. E-goi Transactional E-mail (SMTP): Send all WordPress and WooCommerce e-mails through E-goi for better deliverability. Compatibility: Integrates with WooCommerce, CF7, Gravity Forms, Elementor, WPBakery Page Builder. Compliance: Double Opt-in contact validation (GDPR), Tag association to forms. Add-on: E-goi SMS Orders Alert/Notifications Requirements: E-goi Plan with access to your API Key. WordPress version 4.7 or higher. Do you need an E-goi account ? Click and create a free E-goi account