=== FlexSlowMail ===
Contributors: rinkeshchandra
Tags: newsletter, email marketing, smtp, campaign, bulk email
Requires at least: 6.5
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Send bulk email campaigns from WordPress through your own SMTP server, paced slowly over time to protect deliverability.

== Description ==

FlexSlowMail is a self-hosted newsletter and bulk email plugin. Campaigns are sent through an SMTP server you control, and the plugin exists to solve one specific problem: sending a large list all at once is the fastest way to get your domain blacklisted.

Instead, FlexSlowMail paces delivery. You choose a batch size and an interval, and a WP-Cron job releases small groups of messages over minutes, hours or days, staying under the rate limits your mail provider enforces.

Nothing is routed through a third-party sending service. Your list stays in your database, and your mail goes out over your own SMTP credentials.

= Core features =

* **Campaign management** — create, edit, duplicate and delete campaigns with a full WordPress rich text editor.
* **Two sending modes in the free version** — Send Now, or Schedule for a specific date and time (timezone-aware).
* **Slow sending engine** — configurable batch size, sending interval, and maximum execution time per cron run, with a processing lock so runs never overlap.
* **Unlimited subscribers, campaigns and SMTP profiles** — the free version has no usage caps.
* **Multiple SMTP profiles** — store as many servers as you like and switch the active one with a click. Passwords are encrypted at rest with AES-256-CBC.
* **Test connection** — send a real test message before you trust a profile with a campaign.
* **CSV / TSV list import** — automatic email validation, de-duplication, and suppression filtering on import. Large lists are split into batches automatically.
* **Open and click tracking** — signed tracking links, so analytics cannot be forged and the redirect cannot be abused.
* **One-click unsubscribe** — token-verified, adds the address to the suppression list and immediately drops any queued messages for it.
* **Suppression list** — manual entries, CSV import, automatic unsubscribes, and optional auto-suppression on bounce.
* **Rate limiting and validation** — per-recipient-domain caps, a global daily ceiling, optional MX record checks, and optional disposable-address blocking.
* **GDPR controls** — configurable data retention and an automatic unsubscribe footer.
* **Debug log viewer** — colour-coded, filterable, downloadable, and off by default.

= FlexSlowMail Pro =

Pro is a separate download that adds:

* **Time Slots** — restrict sending to recurring windows by day of week and time of day, with automatic pause and resume outside the window.
* **Full campaign analytics** — per-campaign opens, unique opens, clicks, unique clicks and bounces.
* **SMTP plugin integration** — route campaigns through WP Mail SMTP, FluentSMTP, Post SMTP, Easy WP SMTP and others, so provider auth (Gmail OAuth2, SendGrid API, etc.) is handled by a plugin you already trust.

The free version is complete and unrestricted on its own. Pro adds features; it does not unlock the ones above.

= A note on deliverability =

This plugin gives you controls; the sending policy is yours. Warm up new sending domains, respect per-domain limits, honour unsubscribes promptly, and only mail people who asked to hear from you.

== Installation ==

1. In your WordPress admin, go to **Plugins → Add New** and search for "FlexSlowMail". Click **Install Now**, then **Activate**.
2. Go to **Flex Slow Mail → SMTP Settings** and add a profile for your mail server. Use **Test Connection** to confirm it works, then mark it active.
3. Go to **Flex Slow Mail → Email Lists** and upload a CSV or TSV file of addresses.
4. Go to **Flex Slow Mail → Campaigns → Add New**, write your message, assign one or more lists, and pick a send mode.
5. Check **Flex Slow Mail → Settings** to set your batch size and interval before starting the campaign.

Manual installation: upload the `flexslowmail` folder to `/wp-content/plugins/` and activate it from the Plugins screen.

== Frequently Asked Questions ==

= Does this send email through a third-party service? =

No. Campaigns go out over the SMTP server you configure. FlexSlowMail never routes your messages or your list through anyone else's infrastructure.

= Does WP-Cron need to be enabled? =

Yes. The sending queue is driven by WP-Cron. If you have set `DISABLE_WP_CRON` to true, configure a real system cron that hits `wp-cron.php` at least once a minute, otherwise campaigns will stall. Sites with little traffic should use a system cron regardless, because WP-Cron only fires when someone visits the site.

= How many subscribers can the free version handle? =

There is no limit built into the plugin. The practical ceiling is your mail provider's sending limits and your server's ability to run the cron job. Lists larger than 10,000 addresses are automatically split into batches, and you can change that threshold in Settings.

= How do I avoid being marked as spam? =

Set a conservative batch size and a generous interval, keep the per-domain cap low, publish SPF, DKIM and DMARC records for your sending domain, and never import a list the recipients did not opt in to. New domains should start at a very low volume and increase over days.

= Where are my uploaded lists stored? =

As CSV files under `wp-content/uploads/flexslowmail/lists/`, with unguessable filenames and server-level deny rules where the server supports them. They are never exposed through a public URL.

= What happens when someone unsubscribes? =

The address is added to the suppression list, and any messages still queued for that address are deleted immediately, so they will not receive the rest of the campaign. Future imports skip suppressed addresses automatically.

= Is the plugin translation-ready? =

Yes. All user-facing strings use the `flexslowmail` text domain and the plugin is set up for translation through translate.wordpress.org.

= Will upgrading break my existing tracking links? =

No. Version 1.1.0 introduced signed tracking links. Links in emails you already sent continue to record opens and clicks; they simply will not redirect to an off-site address that cannot be matched against the campaign they came from.

== Screenshots ==

1. The dashboard: campaign progress, queue depth, average open rate and system status at a glance.
2. The campaign editor, with list assignment, shortcodes, send-mode options and per-campaign analytics.
3. SMTP profile management, with a test-connection button before you trust a server with a campaign.
4. Uploading an email list, showing the accepted formats and the validation applied on import.
5. The suppression list, with reasons, CSV import and manual entry.
6. Sending settings: batch size, interval, rate limits, validation and GDPR data retention.

== External services ==

**Freemius**

This plugin uses Freemius (by Freemius, Inc.) to handle licensing and upgrades for FlexSlowMail Pro.

*In the free version, no data is transmitted by default.* Freemius runs in anonymous mode: it contacts `api.freemius.com` only if you explicitly opt in to sharing diagnostic data, or if you activate a Pro license key.

If you opt in, or when you activate a license, the following is sent to `api.freemius.com`: your site URL, the WordPress and PHP versions, the plugin version, your active theme and plugin list, and the email address of the administrator performing the action. This is used to validate licenses, deliver Pro updates, and report anonymous usage statistics.

You can opt out at any time from **Plugins → Installed Plugins**.

Freemius terms of service: https://freemius.com/terms/
Freemius privacy policy: https://freemius.com/privacy/

**Your SMTP server**

Campaign content, subject lines and recipient addresses are transmitted to whichever SMTP server you configure in the plugin's settings. That server is chosen and controlled by you; FlexSlowMail has no default and contacts no mail server until you supply credentials. Review your mail provider's own terms and privacy policy.

== Privacy ==

FlexSlowMail stores subscriber email addresses, unsubscribe records, and open/click events in your site's database. It does not send this data anywhere.

Open and click tracking records the recipient's email address, the campaign, and the clicked URL. Tracking can be disabled entirely under **Flex Slow Mail → Settings**. A configurable data retention setting (90 days by default) purges old analytics and queue rows automatically.

== Upgrade Notice ==

= 1.1.0 =
Security and compliance release. Tracking links are now cryptographically signed, stored list files are given unguessable names, and the free version's subscriber, campaign and SMTP profile limits have been removed entirely. Existing tracking links keep working.

== Changelog ==

= 1.1.0 =
* Removed all usage caps from the free version: subscribers, campaigns and SMTP profiles are now unlimited.
* Security: tracking links are now signed with an HMAC. Unsigned links can no longer forge analytics events, and the click redirect can no longer be pointed at an arbitrary third-party site.
* Security: fixed a cross-site request forgery hole on the Debug screen, where the "Run Cron Now" and "Reschedule Cron" actions ran without a nonce or capability check.
* Security: stored email list files now use unguessable filenames, so they are not enumerable on servers that ignore `.htaccess` (nginx, LiteSpeed). Existing files are renamed automatically on upgrade.
* Security: added `web.config` deny rules for IIS alongside the existing `.htaccess` rules.
* Security: list uploads are now validated by real file type rather than the browser-supplied MIME type.
* Removed a dead, unreachable request handler that contained an unvalidated redirect.
* Unsubscribing now deletes any still-queued messages for that address immediately, instead of waiting for the next cron run.
* Fixed time slots being rejected as "in the past" when the selected day was today and the window had already closed. Time slots recur weekly, so such a slot simply runs on its next matching day. This also fixes overnight windows (for example 22:00 to 02:00), which were rejected for most of the day.
* The plugin is now fully translatable. Most admin screens contained hardcoded English; the translation catalog grew from 189 strings to 393, and campaign statuses, suppression reasons and activity types are no longer shown as raw database values.
* Hardened input handling, output escaping and database queries across the plugin to meet WordPress coding standards.
* Pro features (Time Slots, full analytics, SMTP plugin integration) are no longer present in the free build.

= 1.0.24 =
* Update bundled Freemius SDK from 2.13.2 to 2.13.4

= 1.0.10 =
* Freemius licensing integration

= 1.0.0 =
* Initial release
