=== Tempmails === Contributors: neosmartapps,neoparker007 Tags: temporary email, disposable email, IMAP, email privacy, temp mails Requires at least: 5.8 Tested up to: 6.9 Stable tag: 1.0.7 Requires PHP: 7.4 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html Donate link: https://paypal.me/growmify White-label temporary email platform. Let visitors generate disposable inboxes on your site — powered by your own IMAP server. == Description == > **Self-hosted. Privacy-first. Fully yours.** Tempmails turns your WordPress site into a **self-hosted temporary email service**. Visitors generate a random disposable email address, receive messages in a real-time inbox, and discard them when done — all without leaving your site. Unlike third-party services, Tempmails runs entirely on **your own server and IMAP mailbox**. You own the data, the domain, and the brand. --- 🔒 **No third-party email APIs** 📬 **Real IMAP inbox — not a simulation** 🎨 **Material Design 3 UI — beautiful out of the box** ⚡ **AJAX-powered — no page reloads** --- = 🚀 Quick Links = Everything you need to get started, get help, and stay connected: * 🌐 **Official Website** — [tempmails.cv](https://tempmails.cv/) — docs, roadmap, and addon announcements * 🎬 **Installation Tutorial** — Watch the step-by-step video guide below * 📺 **YouTube Channel** — [NeoSmartApps on YouTube](https://www.youtube.com/@NeoSmartApps101) — tutorials, walkthroughs, and new release demos * ☕ **Support the Project** — [Buy us a coffee via PayPal](https://paypal.me/growmify) — Tempmails is free forever; your support keeps development alive * 🖥️ **Need Hosting?** — Tempmails works best on a VPS or shared host with catch-all IMAP support. We recommend [Hostinger](https://www.hostinger.com/in?REFERRALCODE=neoparker) *(affiliate link — we earn a small commission at no extra cost to you)* = 🎬 Watch: Full Installation Tutorial = https://youtu.be/8SKRdyEUrog?si=KHfUT0KicbYphO1M --- = Core Features = **📨 Email Engine** * IMAP Email Fetching — connects to any catch-all IMAP mailbox * Auto Email Generation — random disposable addresses on your own domains * Real-time Inbox — AJAX-powered message viewer with configurable auto-refresh * Attachment Support — download files with 40+ allowed extensions **🎨 Design & UI** * Material Design 3 UI — modern, responsive inbox with Inter & Poppins fonts * White-labeled — fully rebrandable, no third-party branding in the UI * Design Panel — live color picker and label customization in admin **🛡️ Privacy & Data** * Soft Delete — messages are never hard-deleted; safe for compliance * Cookie-based sessions — no user accounts or registration required * Zero external data transmission — all data stays on your server **⚙️ WordPress Native** * Uses WP database, cron, options, nonces, and security APIs throughout * Settings API compliant admin panel * Full i18n/l10n support with `.pot` file included = Shortcode = Place the inbox anywhere on your site with one shortcode: `[tempmails_inbox]` This renders the full inbox UI — email generation, copy button, auto-refresh, message list, and message viewer modal. = Addon Ecosystem = Tempmails Core is **frozen infrastructure**. All new functionality is delivered via addons using a documented, stable hook system — your site never breaks on Core updates. Available addon hooks cover: email generation, message routing, inbox access control, multi-domain support, billing integration, and more. See the **Hooks** section below for the full reference. = Privacy = Tempmails stores temporary email addresses in **browser cookies** to maintain inbox sessions between page loads. No personal data is collected, stored against user accounts, or transmitted to any external service. See **External Services** below for details on the optional GitHub ecosystem feed. --- == Installation == = Minimum Requirements = * WordPress 5.8 or higher * PHP 7.4 or higher * PHP extensions: `imap`, `mbstring`, `json` * A mail server with catch-all forwarding configured on your domain = Step-by-Step Installation = 1. Upload the `tempmails` folder to `/wp-content/plugins/` or install via **Plugins → Add New → Upload Plugin** 2. Activate the plugin through **Plugins → Installed Plugins** 3. Go to **Tempmails → Settings → IMAP** and enter your mail server credentials: * **Host:** `mail.yourdomain.com` * **Port:** `993` (SSL) or `143` (TLS) * **Encryption:** SSL or TLS * **Username:** `catch-all@yourdomain.com` * **Password:** your IMAP mailbox password 4. Click **Test Connection** to verify the credentials 5. Click **Save Settings** 6. Create a new WordPress page and add `[tempmails_inbox]` 7. Publish — visitors can now generate and use temporary email addresses instantly = IMAP Catch-All Setup = Your mail server must have **catch-all email enabled** so that messages sent to any address `@yourdomain.com` land in the single mailbox Tempmails reads from. In cPanel, set the Default Address for your domain to deliver to your catch-all inbox: `*@yourdomain.com → catch-all@yourdomain.com` Hostinger users: enable catch-all under **hPanel → Email → Default Address**. New to Hostinger? [Get started here](https://www.hostinger.com/in?REFERRALCODE=neoparker) *(affiliate link)* — their hPanel makes IMAP catch-all setup straightforward even for beginners. = Server Cron (Recommended for Reliable Fetching) = WordPress cron only fires when your site receives traffic. For consistent email delivery, add a real server cron job in cPanel → Cron Jobs: `* * * * * wget -q -O - https://yoursite.com/wp-cron.php?doing_wp_cron >/dev/null 2>&1` Or using WP-CLI: `* * * * * cd /path/to/wordpress && wp cron event run --due-now >/dev/null 2>&1` --- == Frequently Asked Questions == = Does this plugin require a third-party email service? = No. Tempmails connects directly to your own IMAP mailbox. You need a mail server with catch-all forwarding — Hostinger, any cPanel-based host, or any standard IMAP server works. = What PHP extensions are required? = The `imap`, `mbstring`, and `json` extensions must be enabled on your server. Most shared hosting providers include these by default. The plugin will display a clear error and refuse to activate if any are missing. = Can I use my own domain names for generated addresses? = Yes. Go to **Tempmails → Settings → Domains** and add one domain per line. All listed domains must route their catch-all to your IMAP mailbox. = How is message deletion handled? = Tempmails uses **soft delete**. When a user deletes a message, the `to_address` field is changed to an internal tombstone value rather than removing the database row. Deleted messages never appear in inbox queries. This behavior is permanent and guaranteed across all versions. = Can I white-label the inbox UI? = Yes. All user-facing text is translation-ready and overridable via filters. The **Design Panel** under **Tempmails → Design** lets you change colors, button labels, empty state text, and border radius — with a live preview. = How do I build an addon? = Register your addon using the `tempmails_registered_addons` filter, then hook into any documented action or filter. Core is frozen — all new functionality must be delivered via addons. See the **Hooks** section for the full reference. = Emails are not appearing in the inbox = 1. Go to **Tempmails → Settings → IMAP** and click **Test Connection** 2. Verify catch-all forwarding is active on your mail server 3. Confirm WordPress cron is running — use the free **WP Crontrol** plugin to inspect scheduled events 4. Check **Tempmails → Addon Health** for any logged errors = How do I enable debug logging? = Add these two lines to `wp-config.php`: `define('WP_DEBUG', true);` `define('WP_DEBUG_LOG', true);` Tempmails logs all errors to the standard WordPress debug log at `/wp-content/debug.log` and to the **Addon Health** page in admin. --- == Screenshots == 1. Frontend inbox — email generation, copy button, and real-time message list 2. Message modal — full email content with attachment download support 3. Admin dashboard — statistics cards, IMAP status, and quick action buttons 4. Settings — General tab with fetch interval and retention controls 5. Settings — IMAP tab with connection credentials and live test button 6. Design panel — live preview with color pickers and label customization 7. Addon Health page — per-addon error log and hook status --- == Hooks == Tempmails exposes a complete hook system for addon developers. All hooks below are **stable and frozen** — they will not be renamed, removed, or have their signatures changed in any minor version. = Action Hooks = * `tempmails_loaded` — Core fully initialized; safe for addon bootstrap * `tempmails_core_ready` — fires after DB integrity check; passes Core version string * `tempmails_activated` — fires on plugin activation; safe for addon setup * `tempmails_deactivated` — fires on plugin deactivation * `tempmails_email_generated` — new address generated; params: `$email`, `$ip` * `tempmails_inbox_accessed` — user opened inbox; params: `$email`, `$ip` * `tempmails_message_received` — new message stored; params: `$message_id`, `$to_address` * `tempmails_message_marked_seen` — message read; params: `$message_id` * `tempmails_message_deleted` — soft delete triggered; params: `$message_id`, `$email` * `tempmails_cleanup_completed` — cron cleanup finished; params: `$deleted_count` * `tempmails_fetch_completed` — fetch cycle finished; params: `$results` array = Filter Hooks = * `tempmails_registered_addons` — register your addon for the Addons admin page * `tempmails_generated_email` — modify a generated address before returning it * `tempmails_available_domains` — modify the domain list available for generation * `tempmails_can_fetch_messages` — allow/block a fetch cycle; params: `$bool`, `$engine` * `tempmails_can_process_message` — allow/block a single message; params: `$bool`, `$message` * `tempmails_can_store_message` — allow/block DB insert; params: `$bool`, `$data` * `tempmails_can_read_inbox` — allow/block inbox access; params: `$bool`, `$email` * `tempmails_message_content` — filter body before display; params: `$content`, `$message_id` * `tempmails_default_settings` — modify default option values on activation * `tempmails_inbox_attributes` — modify shortcode default attributes * `tempmails_admin_dashboard_stats` — extend dashboard stat cards * `tempmails_settings_tabs` — add custom tabs to the Settings page --- == External Services == = Ecosystem Feed (Optional — Default On) = Tempmails fetches a public JSON file from GitHub to display addon and ecosystem information inside the WordPress admin panel. **What this connection does:** * Fires only when viewing Tempmails admin pages * Retrieves only public, non-personal JSON content * Transmits no user data, site URL, or any identifiable information * Results are cached locally for 1 hour to minimize requests Remote endpoint: https://raw.githubusercontent.com/ubermensch-site/tempmails-ecosystem/main/ecosystem.json Service provider: GitHub Privacy policy: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement To **disable this connection entirely**, uncheck **Ecosystem Feed** under **Tempmails → Settings → General**. Hardcoded fallback content is shown instead — no requests are made. = Google Fonts = The frontend inbox loads the **Inter** and **Poppins** typefaces and the **Material Symbols** icon font from Google Fonts CDN. **What this connection does:** * Fires only on pages where `[tempmails_inbox]` is rendered * Transmits the visitor's IP address to Google as part of a standard font request Service provider: Google Fonts Privacy policy: https://developers.google.com/fonts/faq/privacy To avoid this (e.g. for GDPR compliance), dequeue `tempmails-google-fonts` and load self-hosted font copies instead. --- == Changelog == = 1.0.7 - 2026-04-04 (Security Patch) = * Security: ajax_delete_message() — $_POST['message_id'] now wrapped with sanitize_text_field( wp_unslash() ); phpcs:ignore suppression comment removed = 1.0.7 - 2026-04-02 (Security Patch) = * Security: Removed raw `