About this plugin
GGPush Web Push adds browser push notifications to WordPress without requiring a separate push-notification SaaS account.
The plugin generates VAPID keys on your server, stores browser subscriptions in your WordPress database, and sends encrypted Web Push messages directly from your WordPress server to each subscriber’s browser push service.
Features include:
- Modern non-modal subscription panel and animated notification launcher.
- Mobile-friendly compact subscription experience.
- The launcher is hidden for users who already have an active push subscription.
- Automatic VAPID key generation.
- Manual push notifications from the WordPress admin area.
- Optional automatic notifications when a new post is published.
- Push button in the post editor for published posts.
- Optional notification image from the WordPress Media Library.
- Active subscriber, campaign, successful delivery, failure, click and CTR statistics.
- Unique click counting per subscription and campaign.
- Automatic removal of expired push endpoints after 404/410 responses.
- HTTPS-only endpoint validation, SSRF protection and REST rate limiting.
- VAPID private-key encryption at rest using AES-256-GCM when supported by the server.
- No bundled third-party JavaScript or PHP framework.
External services and privacy
Web Push requires communication with the push service selected by the visitor’s browser. Depending on the browser and operating system, this may be a service operated by Google, Mozilla, Apple, Microsoft, or another browser/platform provider.
The plugin does not contact these services merely because it is installed. A visitor must explicitly click the notification opt-in control and grant browser notification permission before a push subscription is stored. When a site administrator sends a notification, the WordPress server sends the encrypted notification payload to the push endpoint supplied by that visitor’s browser.
Data involved in Web Push can include the browser-provided push endpoint, public subscription encryption keys, encrypted notification content, and VAPID authentication data. The plugin stores subscriptions and campaign/click statistics in the site’s own WordPress database. It does not send analytics or telemetry to the plugin author.
Browser push services are third-party services and are governed by the terms and privacy policies of the visitor’s browser/platform provider. Site owners should describe their use of browser notifications in their own privacy policy where required by applicable law.
Security
GGPush Web Push includes request-size limits, REST rate limits, same-origin checks, strict Web Push key validation, HTTPS-only endpoint validation, public-IP/DNS validation for outbound push endpoints, wp_safe_remote_post() for push delivery, dedicated notification capabilities, signed click tokens and scheduled stale-data cleanup.
No software can be guaranteed vulnerability-free. Keep WordPress, PHP and server packages updated and maintain tested backups.