{"id":389611,"date":"2026-10-23T15:25:21","date_gmt":"2026-10-23T15:25:21","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/popup-control-for-telegram\/"},"modified":"2026-10-23T15:26:41","modified_gmt":"2026-10-23T15:26:41","slug":"serge-popup-control-telegram","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/serge-popup-control-telegram\/","author":23574342,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.3.6","stable_tag":"1.3.6","tested":"7.1.3","requires":"6.2","requires_php":"7.4","requires_plugins":null,"header_name":"Serge Popup Control for Telegram","header_author":"Serge Rot\u00e4rmel","header_description":"Remote-controllable popups for WordPress. Manage popups locally in wp-admin for free, or optionally control them via Telegram using our external AWS-hosted backend (free 30-day trial, then \u20ac2.49\/month).","assets_banners_color":"","last_updated":"2026-10-23 15:26:41","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/gitlab.com\/sergeyonny\/popup-control-for-telegram","header_author_uri":"https:\/\/profiles.wordpress.org\/serge2addplugin\/","rating":0,"author_block_rating":0,"active_installs":0,"downloads":70,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","changelog"],"tags":{"1.3.6":{"tag":"1.3.6","author":"serge2addplugin","date":"2026-10-23 15:26:41","revision":3761942}},"upgrade_notice":[],"ratings":[],"assets_icons":[],"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.3.6"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[569,456,491,23853],"plugin_category":[55],"plugin_contributors":[288092],"plugin_business_model":[],"class_list":["post-389611","plugin","type-plugin","status-publish","hentry","plugin_tags-automation","plugin_tags-marketing","plugin_tags-popup","plugin_tags-rest-api","plugin_category-seo-and-marketing","plugin_contributors-serge2addplugin","plugin_committers-serge2addplugin"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/s.w.org\/plugins\/geopattern-icon\/serge-popup-control-telegram.svg","icon_2x":false,"generated":true},"screenshots":[],"raw_content":"<!--section=description-->\n<p>This plugin is not affiliated with, endorsed by or sponsored by Telegram. \"Telegram\" is used only to describe the messaging service it can optionally connect to.<\/p>\n\n<p>Popup Control stores popups as application data (not blog content) in dedicated database tables and exposes them through:<\/p>\n\n<ul>\n<li>A wp-admin UI (Popup Control menu) to create and manage popups.<\/li>\n<li>A REST API (<code>\/wp-json\/popup-control\/v1\/popups<\/code>) so external systems can manage the same popups programmatically.<\/li>\n<\/ul>\n\n<p>Both access paths share a single <code>PopupService<\/code>, so there is only one implementation of validation, persistence and business rules.<\/p>\n\n<h4>External service required for Telegram control (important)<\/h4>\n\n<p>Managing popups via Telegram is optional, but it requires connecting this plugin to an external, third-party backend that we operate (hosted on AWS, in the <code>eu-central-1<\/code> region) and that talks to the Telegram Bot API on your behalf. This is not a local, self-hosted feature - your site's domain and a Telegram chat identifier are sent to and stored on that external server so it can authenticate your Telegram messages and manage popups on your site. See the in-plugin \"Privacy &amp; Data\" page (Popup Control -&gt; Privacy &amp; Data) for the full, itemized breakdown of what is stored, why, for how long, and how to have it deleted.<\/p>\n\n<p><strong>This external service is free to use for the first 30 days (a free trial) and costs \u20ac2.49\/month afterwards<\/strong>, billed via Stripe. You can cancel anytime from within Telegram (the \"\ud83d\udcb3 Abo\" button opens the Stripe customer portal for active subscribers). If you don't subscribe after the trial ends, Telegram-based popup management simply stops working - your existing popups and all other wp-admin functionality of this plugin keep working normally, entirely for free, with or without this optional integration.<\/p>\n\n<p>You must explicitly tick a consent checkbox on the \"Telegram Connection\" admin page before any data is sent to this external service - nothing is transmitted automatically on plugin activation.<\/p>\n\n<p>This initial version implements:<\/p>\n\n<ul>\n<li><code>POST \/wp-json\/popup-control\/v1\/popups<\/code> - create\/update a popup (used by the Telegram bot).<\/li>\n<li>An \"All Popups\" admin page listing existing popups with Enable\/Disable and Delete actions, plus a \"New Popup\" button (a simple title + description form) so popups can be created directly in wp-admin, in addition to sending <code>\/popup<\/code> to the Telegram bot.<\/li>\n<li>Two authentication modes for the REST API:\n\n<ul>\n<li>WordPress cookie session + nonce + the <code>manage_popup_control<\/code> capability (used automatically by the admin UI).<\/li>\n<li>A Bearer API token, established through a Telegram pairing flow (Popup Control -&gt; Telegram Connection), for external\/Telegram-driven systems. See docs\/telegram-connection-architecture.md in the repository for the full design.<\/li>\n<\/ul><\/li>\n<\/ul>\n\n<h3>External services<\/h3>\n\n<p>Telegram control is optional. Nothing is sent to any external service unless you tick the consent checkbox on Popup Control -&gt; Telegram Connection and submit a pairing code.<\/p>\n\n<h4>1. Popup Control backend (AWS API, operated by the plugin author)<\/h4>\n\n<ul>\n<li>What it is \/ why: a hosted API (AWS API Gateway + Lambda + DynamoDB, region eu-central-1) that receives your Telegram messages via the bot and forwards popup commands to your site.<\/li>\n<li>Data sent: when you submit the pairing code, your site's domain\/URL and the pairing code are sent to the <code>\/connections\/confirm<\/code> endpoint. Afterwards the backend stores your site domain, your Telegram chat ID, the plan\/trial state, and the popup title\/description you enter in Telegram.<\/li>\n<li>When: once on connecting, and whenever you use the Telegram bot.<\/li>\n<li>Terms of Service: https:\/\/gitlab.com\/sergeyonny\/popup-control-for-telegram\/-\/blob\/main\/docs\/legal\/terms.md<\/li>\n<li>Privacy Policy: https:\/\/gitlab.com\/sergeyonny\/popup-control-for-telegram\/-\/blob\/main\/docs\/legal\/privacy.md<\/li>\n<\/ul>\n\n<h4>2. Telegram Bot API (Telegram Messenger Inc.)<\/h4>\n\n<ul>\n<li>Why: delivers your messages to and from the bot. Your Telegram chat ID and message content are processed by Telegram.<\/li>\n<li>Terms of Service: https:\/\/telegram.org\/tos<\/li>\n<li>Privacy Policy: https:\/\/telegram.org\/privacy<\/li>\n<\/ul>\n\n<h4>3. Stripe (Stripe, Inc.)<\/h4>\n\n<ul>\n<li>Why: processes the optional paid subscription after the free 30-day trial. Payment data is entered on Stripe-hosted pages only and never reaches your site.<\/li>\n<li>Terms of Service: https:\/\/stripe.com\/legal\/ssa<\/li>\n<li>Privacy Policy: https:\/\/stripe.com\/privacy<\/li>\n<\/ul>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>serge-popup-control-telegram<\/code> folder to <code>\/wp-content\/plugins\/<\/code>.<\/li>\n<li>Activate the plugin through the \"Plugins\" menu in WordPress.<\/li>\n<li>Go to Popup Control -&gt; Telegram Connection to pair this site with your Telegram bot.<\/li>\n<li>In Telegram, tap the \"\ud83d\udd18 Popup\" button to create your first popup.<\/li>\n<\/ol>\n\n<!--section=changelog-->\n<h4>1.3.6<\/h4>\n\n<ul>\n<li>Renamed to \"Serge Popup Control for Telegram\" (slug and text domain <code>serge-popup-control-telegram<\/code>) to avoid the restricted term \"plugin\" in name and slug.<\/li>\n<\/ul>\n\n<h4>1.3.5<\/h4>\n\n<ul>\n<li>Renamed to \"Serge Popup Control for Telegram\" with new slug and text domain <code>serge-popup-control-telegram<\/code> (WordPress.org review).<\/li>\n<li>Added \"External services\" section (backend, Telegram, Stripe) with Terms\/Privacy links.<\/li>\n<li>The \"not connected\" admin notice now appears only on this plugin's own screens and is dismissible.<\/li>\n<li>Updated Plugin URI and Author headers.<\/li>\n<\/ul>\n\n<h4>1.3.4<\/h4>\n\n<ul>\n<li>Text Domain changed to <code>serge-popup-control-telegram<\/code> to match the plugin directory slug (required by WordPress.org automated scan).<\/li>\n<\/ul>\n\n<h4>1.3.3<\/h4>\n\n<ul>\n<li>Fixed the remaining two Plugin Check warnings in <code>TokenAuthenticator::authenticate()<\/code>: the previous single-line <code>phpcs:ignore<\/code> comment no longer covered the actual <code>$wpdb-&gt;prepare()<\/code> call after an earlier edit shifted line numbers, so it was replaced with a <code>phpcs:disable<\/code>\/<code>phpcs:enable<\/code> block that reliably covers the whole statement, and the (statically undetectable, dynamic-count) <code>ReplacementsWrongNumber<\/code> false-positive is now explicitly suppressed too.<\/li>\n<\/ul>\n\n<h4>1.3.2<\/h4>\n\n<ul>\n<li>Resolved all Plugin Check warnings: dynamic SQL table names now use <code>$wpdb-&gt;prepare()<\/code>'s <code>%i<\/code> identifier placeholder (requires WordPress 6.2+, see \"Requires at least\" above) instead of raw string interpolation; removed the discouraged <code>load_plugin_textdomain()<\/code> call (WordPress.org auto-loads translations for hosted plugins); <code>$_SERVER['REQUEST_URI']<\/code> is now unslashed and sanitized before use; shortened the readme's short description to fit the 150-character limit; documented remaining findings (direct queries against this plugin's own custom tables, and read-only display flags read from <code>$_GET<\/code>) as reviewed, intentional false-positives via inline <code>phpcs:ignore<\/code> comments with justification.<\/li>\n<\/ul>\n\n<h4>1.3.1<\/h4>\n\n<ul>\n<li>Fixed Plugin Check findings: missing translators comment, an unescaped output value, removed hidden <code>.gitkeep<\/code> files, and updated \"Tested up to\" to the current WordPress version.<\/li>\n<\/ul>\n\n<h4>1.3.0<\/h4>\n\n<ul>\n<li>Added a \"New Popup\" button on the All Popups admin page: a simple title + description form (mirroring the Telegram Mini App's own minimal editor) that lets popups be created directly in wp-admin, without needing Telegram.<\/li>\n<li>Added a \"Delete\" row action on the All Popups admin page to permanently remove a popup.<\/li>\n<\/ul>\n\n<h4>1.2.1<\/h4>\n\n<ul>\n<li>readme.txt \/ plugin description \/ connect-page consent checkbox now clearly disclose that Telegram-based popup management uses an external, third-party AWS backend that is free for 30 days and then costs \u20ac2.49\/month (cancellable anytime), per WordPress.org's external-service transparency guidelines.<\/li>\n<\/ul>\n\n<h4>1.2.0<\/h4>\n\n<ul>\n<li>Telegram now shows a permanent \"\ud83d\udd18 Popup\" \/ \"\ud83d\udcb3 Abo\" menu after connecting - no chat commands needed for everyday use. \"\ud83d\udd18 Popup\" opens a Telegram Mini App form (title + description); \"\ud83d\udcb3 Abo\" opens the Stripe payment link or the Stripe customer portal depending on the current plan.<\/li>\n<\/ul>\n\n<h4>1.1.0<\/h4>\n\n<ul>\n<li>Added <code>\/popup disable<\/code> - immediately disables (never deletes) the Telegram bot's managed popup, via the new <code>POST \/popups\/disable-telegram-popup<\/code> REST endpoint.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Replaced the generic API token page with a Telegram-initiated pairing flow: the admin sends \/connect to the Telegram bot, which generates a one-time pairing code; the admin pastes that code (plus the AWS API URL and consent) into wp-admin, which calls the AWS \/connections\/confirm endpoint and, on success, stores the connection as already active - reusing the pairing code as the Bearer token for POST \/popups.<\/li>\n<\/ul>\n\n<h4>0.1.0<\/h4>\n\n<ul>\n<li>Initial scaffold: popup data model (custom tables), <code>POST \/popups<\/code> REST endpoint, admin UI to create\/save popups, dual authentication (cookie+capability \/ Bearer token).<\/li>\n<\/ul>","raw_excerpt":"Create and manage WordPress popups in wp-admin, or control them remotely via Telegram using an optional external AWS backend.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/389611","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=389611"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/serge2addplugin"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=389611"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=389611"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=389611"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=389611"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=389611"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=389611"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}