Description

This plugin is not affiliated with, endorsed by or sponsored by Telegram. “Telegram” is used only to describe the messaging service it can optionally connect to.

Popup Control stores popups as application data (not blog content) in dedicated database tables and exposes them through:

A wp-admin UI (Popup Control menu) to create and manage popups.
A REST API (/wp-json/popup-control/v1/popups) so external systems can manage the same popups programmatically.

Both access paths share a single PopupService, so there is only one implementation of validation, persistence and business rules.

External service required for Telegram control (important)

Managing popups via Telegram is optional, but it requires connecting this plugin to an external, third-party backend that we operate (hosted on AWS, in the eu-central-1 region) and that talks to the Telegram Bot API on your behalf. This is not a local, self-hosted feature – your site’s domain and a Telegram chat identifier are sent to and stored on that external server so it can authenticate your Telegram messages and manage popups on your site. See the in-plugin “Privacy & Data” page (Popup Control -> Privacy & Data) for the full, itemized breakdown of what is stored, why, for how long, and how to have it deleted.

This external service is free to use for the first 30 days (a free trial) and costs €2.49/month afterwards, billed via Stripe. You can cancel anytime from within Telegram (the “💳 Abo” button opens the Stripe customer portal for active subscribers). If you don’t subscribe after the trial ends, Telegram-based popup management simply stops working – your existing popups and all other wp-admin functionality of this plugin keep working normally, entirely for free, with or without this optional integration.

You must explicitly tick a consent checkbox on the “Telegram Connection” admin page before any data is sent to this external service – nothing is transmitted automatically on plugin activation.

This initial version implements:

POST /wp-json/popup-control/v1/popups – create/update a popup (used by the Telegram bot).
An “All Popups” admin page listing existing popups with Enable/Disable and Delete actions, plus a “New Popup” button (a simple title + description form) so popups can be created directly in wp-admin, in addition to sending /popup to the Telegram bot.
Two authentication modes for the REST API:
- WordPress cookie session + nonce + the manage_popup_control capability (used automatically by the admin UI).
- A Bearer API token, established through a Telegram pairing flow (Popup Control -> Telegram Connection), for external/Telegram-driven systems. See docs/telegram-connection-architecture.md in the repository for the full design.

External services

Telegram control is optional. Nothing is sent to any external service unless you tick the consent checkbox on Popup Control -> Telegram Connection and submit a pairing code.

1. Popup Control backend (AWS API, operated by the plugin author)

What it is / why: a hosted API (AWS API Gateway + Lambda + DynamoDB, region eu-central-1) that receives your Telegram messages via the bot and forwards popup commands to your site.
Data sent: when you submit the pairing code, your site’s domain/URL and the pairing code are sent to the /connections/confirm endpoint. Afterwards the backend stores your site domain, your Telegram chat ID, the plan/trial state, and the popup title/description you enter in Telegram.
When: once on connecting, and whenever you use the Telegram bot.
Terms of Service: https://gitlab.com/sergeyonny/popup-control-for-telegram/-/blob/main/docs/legal/terms.md
Privacy Policy: https://gitlab.com/sergeyonny/popup-control-for-telegram/-/blob/main/docs/legal/privacy.md

2. Telegram Bot API (Telegram Messenger Inc.)

Why: delivers your messages to and from the bot. Your Telegram chat ID and message content are processed by Telegram.
Terms of Service: https://telegram.org/tos
Privacy Policy: https://telegram.org/privacy

3. Stripe (Stripe, Inc.)

Why: processes the optional paid subscription after the free 30-day trial. Payment data is entered on Stripe-hosted pages only and never reaches your site.
Terms of Service: https://stripe.com/legal/ssa
Privacy Policy: https://stripe.com/privacy

Installation

Upload the serge-popup-control-telegram folder to /wp-content/plugins/.
Activate the plugin through the “Plugins” menu in WordPress.
Go to Popup Control -> Telegram Connection to pair this site with your Telegram bot.
In Telegram, tap the “🔘 Popup” button to create your first popup.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“Serge Popup Control for Telegram” is open source software. The following people have contributed to this plugin.

serge2addplugin

Translate “Serge Popup Control for Telegram” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

1.3.6

Renamed to “Serge Popup Control for Telegram” (slug and text domain serge-popup-control-telegram) to avoid the restricted term “plugin” in name and slug.

1.3.5

Renamed to “Serge Popup Control for Telegram” with new slug and text domain serge-popup-control-telegram (WordPress.org review).
Added “External services” section (backend, Telegram, Stripe) with Terms/Privacy links.
The “not connected” admin notice now appears only on this plugin’s own screens and is dismissible.
Updated Plugin URI and Author headers.

1.3.4

Text Domain changed to serge-popup-control-telegram to match the plugin directory slug (required by WordPress.org automated scan).

1.3.3

Fixed the remaining two Plugin Check warnings in TokenAuthenticator::authenticate(): the previous single-line phpcs:ignore comment no longer covered the actual $wpdb->prepare() call after an earlier edit shifted line numbers, so it was replaced with a phpcs:disable/phpcs:enable block that reliably covers the whole statement, and the (statically undetectable, dynamic-count) ReplacementsWrongNumber false-positive is now explicitly suppressed too.

1.3.2

Resolved all Plugin Check warnings: dynamic SQL table names now use $wpdb->prepare()‘s %i identifier placeholder (requires WordPress 6.2+, see “Requires at least” above) instead of raw string interpolation; removed the discouraged load_plugin_textdomain() call (WordPress.org auto-loads translations for hosted plugins); $_SERVER['REQUEST_URI'] is now unslashed and sanitized before use; shortened the readme’s short description to fit the 150-character limit; documented remaining findings (direct queries against this plugin’s own custom tables, and read-only display flags read from $_GET) as reviewed, intentional false-positives via inline phpcs:ignore comments with justification.

1.3.1

Fixed Plugin Check findings: missing translators comment, an unescaped output value, removed hidden .gitkeep files, and updated “Tested up to” to the current WordPress version.

1.3.0

Added a “New Popup” button on the All Popups admin page: a simple title + description form (mirroring the Telegram Mini App’s own minimal editor) that lets popups be created directly in wp-admin, without needing Telegram.
Added a “Delete” row action on the All Popups admin page to permanently remove a popup.

1.2.1

readme.txt / plugin description / connect-page consent checkbox now clearly disclose that Telegram-based popup management uses an external, third-party AWS backend that is free for 30 days and then costs €2.49/month (cancellable anytime), per WordPress.org’s external-service transparency guidelines.

1.2.0

Telegram now shows a permanent “🔘 Popup” / “💳 Abo” menu after connecting – no chat commands needed for everyday use. “🔘 Popup” opens a Telegram Mini App form (title + description); “💳 Abo” opens the Stripe payment link or the Stripe customer portal depending on the current plan.

1.1.0

Added /popup disable – immediately disables (never deletes) the Telegram bot’s managed popup, via the new POST /popups/disable-telegram-popup REST endpoint.

1.0.0

Replaced the generic API token page with a Telegram-initiated pairing flow: the admin sends /connect to the Telegram bot, which generates a one-time pairing code; the admin pastes that code (plus the AWS API URL and consent) into wp-admin, which calls the AWS /connections/confirm endpoint and, on success, stores the connection as already active – reusing the pairing code as the Bearer token for POST /popups.

0.1.0

Initial scaffold: popup data model (custom tables), POST /popups REST endpoint, admin UI to create/save popups, dual authentication (cookie+capability / Bearer token).