Ultimate Push Notifications

Changelog

Version: 1.6.2 ( September 16, 2026 )

• New: 13 more automation triggers (29 in all): post or product published / updated; WooCommerce price drop and back in stock; BuddyBoss / BuddyPress Follow new follower and “someone you follow published”; and a Membership group for Paid Memberships Pro, MemberPress, Restrict Content Pro, WooCommerce Memberships, Ultimate Member and LearnDash — each shown only while its plugin is active, with the member as the audience and the plan, level or course as merge tags.
• New: Home Screen app. Turn it on under Subscribe Prompt and the plugin serves a web app manifest built from your Site Icon and tags every page for installation, so iPhone and iPad visitors (iOS 16.4+) can add the site and subscribe — and the soft-ask bar shows them how instead of a prompt they cannot act on. Steps aside if another plugin already provides a manifest. A Health check says whether the site is installable.
• New: The menu is six entries with tabs — Compose, Automations, Subscribers, Subscribe Prompt, Health, Settings — instead of one entry per screen. Every old link still works.
• Changed: Every screen now shares the plugin’s own look (the App Configuration panel): heading with a subtitle, hints, label / input rows, section titles, submit bar, footer. Screens fill the width and work on a narrow window.
• Pro: Each new trigger names, right in the rule editor, the Pro step that completes it — per-shopper price and stock alerts, conditions, digests, frequency caps, carriers, goals, a welcome series. The free plugin makes the first send; Pro finishes the workflow.
• Fixed: WooCommerce no longer flags the plugin as incompatible with High-Performance Order Storage or block checkout — compatibility is declared; orders were only ever read through WooCommerce’s own APIs. The top-level menu entry could fatal if opened directly (its callback was a leftover from another product); it now opens the first screen you may see.
• Developer: admin\builders\Layout, admin\builders\Screens (upn_admin_groups), Trigger::next(), pwa\Manifest (upn_pwa_manifest, upn_pwa_deferred), UPN_WebPush.needsInstall; entitlement keys network, commerce, pwa.install, ai.segments, risk.

Version: 1.6.1 ( September 14, 2026 )

• New: Each delivery can be held for later or left out per subscriber just before it goes out — the seam quiet hours, frequency caps and digests are built on. Held deliveries wait in the queue without counting as a failed attempt; test and preview sends are never held. Recipients held back are shown apart from failures on the Health page.
• Changed: the service worker’s click beacon now sends same-origin credentials, so a first-party cookie can be set from it (used by Pro to credit a later WooCommerce order to the notification that was clicked).
• Developer: upn_delivery_hold, upn_delivery_skip, upn_delivery_skipped, JobOutcome::defer(), upn_automation_dispatch, upn_automation_sanitize_extra, upn_rule_editor_extras, upn_subscription_created, DeliveryLog::add_recipients(), upn_sanitize_fields_extra, the upn:bell-click event and UPN_WebPush.post() / .endpoint(), upn_automations_capability.
• Major: Anonymous subscribers. Visitors subscribe without an account; there is no subscriber cap in any tier. Each subscription records browser, OS, device, locale, time zone, last seen and when/where consent was given.
• Major: Compose (UPush Notifier → Compose). Write a notification, pick an audience with a live recipient count, send it to your own device first, then send. One request queues one job however large the audience; the fan-out runs in the background.
• Major: Event automations rebuilt as trigger → audience → message rules with merge tags. 16 triggers across WordPress, WooCommerce, BuddyPress and Contact Form 7. Every audience is explicit: roles, specific users, all members, all visitors, everyone, or the people the event is about — the customer, the products’ authors, the message recipients, the member’s friends, the group’s members. The person who caused the event is left out unless the rule says otherwise. Free runs three automations at a time.
• Fixed by the rebuild: WooCommerce alerts went to the product author only, so a multi-author store’s owner got nothing; five BuddyPress activity events notified the member who had just performed the action; “new user registered” targeted the new user, who has no device, so it could never fire; Contact Form 7 only read the four default field names. All four are gone with the old engine.
• New: Push on publish — any post type, with the featured image, once per post.
• New: Subscribe Prompt (UPush Notifier → Subscribe Prompt). A dismissible soft-ask bar shown after a delay, page-view count or scroll depth, a floating bell, the [upn_subscribe] shortcode and a Push Subscribe Button block. The browser’s permission prompt is only ever shown after a click.
• New: Merge tags, registry-driven (upn_merge_tags), with per-trigger event tags listed in the automation editor. Contact Form 7 exposes every field as {field_<name>}.
• New: Click tracking. The service worker reports clicks; the Health page shows clicks and click-through rate per send, and each subscriber records when they last clicked.
• New: Privacy tools — subscriptions and automation preferences are included in WordPress personal data export and erasure, and removed when an account is deleted.
• New: The subscriber list shows browser, OS, device, push service, locale, time zone, last seen, last delivery, last error, delivered counts and consent, with All / Logged-in / Visitors / Web Push / Legacy FCM views, sortable columns and a search across all of it.
• Changed: Set Notifications is now a member’s list of automations to receive or not. Notification copy lives on the automation, not per user. The same form appears in a BuddyPress member’s profile.
• Changed: The upn_notifications per-user table is no longer created or used; existing installs keep it untouched.
• Fix: The background queue now books its next tick for the earliest future job, so a long Retry-After backoff or a delayed job no longer waits for someone to open wp-admin; and a tick already booked for later is moved up when work is queued now.
• Developer: The Free/Pro seam — Entitlements::can() with the upn_can filter, fail-closed on unknown keys — and the extension points upn_automation_triggers, upn_automation_rule_matches, upn_automation_audience, upn_automation_fields, upn_automation_fired, upn_automation_active_limit, upn_autopush_fields, upn_before_broadcast, upn_allow_anonymous_subscriptions, upn_notification_clicked, upn_sanitize_audience, upn_audience_where, upn_ajax_handlers, upn_queue_housekeeping, and the window.UPN_Compose script hook.
• Major: Native Web Push (VAPID) is now the default transport. Setup is one click — no Firebase project, no Google account, no server key. Sends go from your server directly to each browser’s push service using RFC 8030/8291/8292; the encryption is verified against the RFC 8291 published test vector.
• Major: Background delivery queue. Sends no longer run on the triggering request (a customer’s checkout, a member’s message). Jobs are claimed atomically, retried with exponential backoff, honour a push service’s Retry-After, and drain through Action Scheduler when present or WP-Cron otherwise.
• New: Health page (UPush Notifier → Health). Live checks for HTTPS, PHP, cryptography, keys, transport, the service worker, registered devices, legacy devices, the queue and recent deliveries — each with a plain explanation and a fix. Scored from 100 with every deduction shown.
• New: Delivery log. The upn_notification_log table (created in 1.3.0, never written) now records every send with per-recipient success, failure, expiry and retry counts and the first error message.
• New: Service worker is served from the site root (/?upn_sw=1), so it can act site-wide. Re-subscribes automatically when a push service rotates a subscription.
• New: Subscribe/unsubscribe from any theme via data-upn-subscribe / data-upn-unsubscribe attributes or window.UPN_WebPush.subscribe(). Permission is only requested on a user gesture — never cold on the first page view.
• Changed: Devices are addressed by row id and deduplicated on the full endpoint or token. The prefix-LIKE matching that could delete another user’s device is gone.
• Changed: Test sends report the real reason on failure, and a device the push service reports as gone is removed from the list.
• Changed: Legacy Firebase sending is retained for existing rows but reports the API shutdown date rather than an unexplained 401. Firebase-registered devices need to open Register My Device once to re-register over Web Push.
• Developer: New extension points — upn_transports, upn_before_send, upn_after_send, upn_subscription_pruned, upn_delivery_logged, upn_queue_job_handlers, upn_queue_enabled, upn_health_checks, and more.
• Requires: PHP 7.4 or newer.
• Security: Device tokens are now bound to the authenticated user server-side. Previously the account was read from the request body, which allowed an unauthenticated visitor to attach their own device to any account — including an administrator — and receive that account’s private notifications. All sites should update.
• Security: Fixed the recursive input sanitizer, which discarded its own result and returned array input unsanitized.
• Security: Fixed two SQL injections in the registered-devices list (s and order request parameters). One was reachable by any subscriber via the Register My Device screen.
• Security: The AJAX endpoint no longer invokes arbitrary plugin classes supplied by the request. Handlers are now explicitly allow-listed and each requires a capability.
• Security: The BuddyPress notification-settings form now verifies its nonce. The previous guard (isset( $_POST )) was always true, so the handler ran and saved on every page view.
• Security: Bulk device deletion is now scoped to the current user unless the caller can manage_options.
• Security: Removed a Firebase configuration that had been committed to the repository and shipped in the plugin package. Fresh installs previously ran against it until App Config was saved.
• Fix: The activation routine was registered as a deactivation hook, so it never ran on activation and no schema change could reach an existing site. Tables are now installed and upgraded through dbDelta() with a real version check.
• Fix: Added indexes on upn_user_devices.user_id, upn_user_devices.token and upn_notifications.user_id — all were unindexed despite being the hot lookup path on every send.
• Fix: The registered-devices list no longer fatals on a row whose user account has been deleted.
• Removed: The Events Calendar settings tab. It collected preferences that could never trigger a notification — no hooks were ever registered for it. The stored preferences and the upn_the_events_calendar_fields filter are preserved.
• Removed: Dokan / WCFM multi-vendor claims from the plugin description. No such integration existed in the code; WooCommerce seller alerts go to the product author.
• Removed: Dead files shipped in the package — a duplicate SetNotifications class declaration, an unused clone of the BuddyPress notification class, the orphaned Firebase v7 SDK copies, a device-manager class that called a development-only function, and stray readme/idea files.
• Housekeeping: Corrected readme claims for BuddyPress activity events and new-user registration that did not match the implementation.
• Housekeeping: The plugin header now declares Requires PHP: 7.4, matching what readme.txt has stated for some time. WordPress enforces the header, so sites still on PHP 7.0–7.3 will no longer be offered updates — those versions have been unsupported by the PHP project since 2021.

Version: 1.3.0 ( June 09, 2026 )

• Major: Firebase SDK updated from v7.15.5 to v11.0.0 compat — fixes compatibility with modern browsers
• Major: Service worker updated to use onBackgroundMessage() — replaces removed setBackgroundMessageHandler()
• New: VAPID Key (Web Push Certificate) field added to App Config — required for modern browser push registration
• New: Rich notifications — image support added to push notification payload (desktop & mobile)
• New: Notification click-to-navigate — clicking a notification now opens the correct URL (handled in service worker)
• New: Auto-cleanup of invalid device tokens — NotRegistered / InvalidRegistration tokens are deleted automatically
• New: Notification delivery log database table (upn_notification_log) for tracking send history
• New: WooCommerce buyer (customer) now also receives order status change notifications — not just the seller
• Security: FCM server key is no longer exposed to browser JavaScript via UPN_Notifier localized object
• Fix: WooCommerce build_notific_on_payment_complete() — undefined variable bug fixed (order checked before use)
• Fix: prepare_send_notifications() — missing image field added to payload, click_action falls back to site_url()
• Fix: Return value consistency — all notification builders now return empty array instead of undefined on no-op
• Improvement: Firebase scripts now load from Google CDN with explicit dependency chain for correct load order
• Improvement: measurementId and vapidKey are treated as optional fields — saving config no longer blocks on them
• Compatibility: WordPress 6.8 tested, WooCommerce 10.2 tested

CHECK THE FULL CHANGELOG.