Matt Steady

Share a link once, then change where it points — without resending anything.
Swirv is a personal link manager for WordPress. Every link lives on your own domain (such as <code>yoursite.com/swirv/download</code>), and its destination is yours to change at any time. Send a link to 200 people today, swap its target tomorrow, and all 200 land in the new place — no third-party shortener, no resending, and never that “sorry, use this link instead” message.
<h4>Passes: a private link for every recipient</h4>
A Pass is a personalised version of a link — its own unguessable URL and a reference label (a supporter, a customer, a newsletter). Issue everyone their own Pass and they all inherit the parent link’s target. Change the link once and every Pass follows. Emailed a track download to your supporters, then need to make a tweak? Edit the target once, and every one of them now gets the fix.
<h4>What you can do</h4>
<ul>
<li>Redirect links on your own domain, e.g. <code>yoursite.com/swirv/download</code></li>
<li>Re-point any link after it has been shared — no dead links, no resending</li>
<li>Issue personalised Passes under any link, each with its own private URL</li>
<li>Group links into Campaigns, with optional public campaign pages</li>
<li>Track clicks with daily analytics charts — privacy-first, no visitor IPs stored</li>
<li>Generate QR codes for any link or campaign</li>
<li>Run Health Scans to catch dead, redirecting, or slow target URLs</li>
<li>Import and export everything as JSON/ZIP for backups and migrations</li>
<li>Optional prefixless links (<code>yoursite.com/download</code>), with clash-checking against existing pages</li>
</ul>
A companion plugin, Swirv Pro, adds advanced Pass controls — access limits, expiry, self-destruct — and more, for larger libraries and tighter workflows.
<h4>Privacy-first by design</h4>
Swirv keeps your link and click data on your own site. It never stores visitor IP addresses — a click records only a 2-letter country code — and Swirv URLs are served <code>noindex, nofollow</code> with a <code>no-referrer</code> policy. Detailed click tracking is optional and can be switched off entirely under Swirv → Settings → Data. Full disclosure of the minimal, opt-in external services Swirv can use is in the External services section below.
<h3>External services</h3>
Swirv stores a 2-letter ISO country code per click, for visitor-country analytics. It derives that code from Cloudflare’s <code>CF-IPCountry</code> request header when present, or otherwise by looking the visitor’s IP up against a local MaxMind GeoLite2-Country database if one has been installed. The raw IP is read only to derive the country code and is never written to the database in any form, hashed or otherwise. With neither source available, the country code is stored empty.
<h4>Requests to your target URLs</h4>
Swirv makes server-side HTTP requests to the target URLs you have added, in three situations: (1) when you save a Link, Swirv sends a HEAD request to learn the target’s MIME type, used to drive per-link image-target download behaviour; (2) Health scans send HEAD requests when you run them; (3) when a visitor clicks an image-typed Link that has the force-download behaviour active, Swirv fetches the image body server-side and streams it back to the visitor. In all three cases the destination server receives a request from your WordPress site. The save-time HEAD probe sends a User-Agent of <code>Swirv Target Probe/{version} (+{your_site_url}; content-type sniffer)</code>; the Health-scan and inline-download paths use the default WordPress HTTP API User-Agent. No visitor data, click data, or WordPress account information is sent in the body of these requests.
<h4>Cloudflare</h4>
Swirv reads Cloudflare’s HTTP_CF_IPCOUNTRY request header when your site is fronted by Cloudflare. Swirv does not send any data to Cloudflare; the header is set by Cloudflare’s edge on incoming requests as part of your site’s existing Cloudflare relationship. The only data Swirv extracts is the 2-letter ISO country code, used for visitor-country analytics on this install. If your site is not on Cloudflare, this code path is inert.
Service: Cloudflare (https://www.cloudflare.com) 
Terms of service: https://www.cloudflare.com/terms/ 
Privacy policy: https://www.cloudflare.com/privacypolicy/
<h4>MaxMind GeoLite2</h4>
Swirv can connect to MaxMind, Inc. to download the GeoLite2-Country database, used to map visitor IP addresses to a 2-letter country code for analytics. The database is stored locally on your server under <code>wp-content/uploads/swirv/geoip/</code> and every country lookup happens on your server against that local copy; Swirv never sends visitor IP addresses to MaxMind.
Swirv contacts MaxMind only after a site administrator has added their own MaxMind licence key under Swirv → Settings → Analytics → Geography and either (a) clicked the Download / update database now button, or (b) the monthly refresh cron has fired since the key was saved. Without a saved licence key, the cron fires but takes no action and Swirv makes no outbound request to MaxMind.
The licence key you enter is stored on your own server in the WordPress options table (as the <code>swirv_maxmind_license_key</code> option), in the same plain-text form WordPress core uses for other site credentials and API keys; Swirv applies no separate encryption to it. It is never transmitted anywhere except to MaxMind as the <code>license_key</code> parameter of the download request described below. Anyone with read access to your WordPress database (including other plugins running on the site) can read it, so treat your MaxMind key like any other site secret. You can clear it at any time by emptying the field and saving.
When downloading the database, Swirv issues a single HTTPS GET request to <code>https://download.maxmind.com/app/geoip_download</code> with three query-string parameters: <code>edition_id=GeoLite2-Country</code>, <code>license_key={your key}</code>, and <code>suffix=tar.gz</code>. The request uses the default WordPress HTTP API User-Agent (which includes your site URL, per WordPress core). No visitor data, click data, or WordPress account information is sent by Swirv as part of this download request.
Service: MaxMind GeoLite country database (https://www.maxmind.com) 
Terms of use: https://www.maxmind.com/en/terms-of-use 
Privacy policy: https://www.maxmind.com/en/privacy-policy 
GeoLite end-user licence agreement: https://www.maxmind.com/en/geolite/eula
<h4>swirv.org</h4>
Swirv links the admin to swirv.org (the Swirv project’s marketing and documentation site, operated by Matt Steady) in three places:
<ul>
<li>The About ↗ submenu item under Swirv in the WordPress admin sidebar opens https://swirv.org in a new tab. This is the Swirv project’s home page — project information, contact details, and links to documentation.</li>
<li>The Swirv Pro ↗ submenu item — visible only when the Swirv Pro companion plugin is not active — opens https://swirv.org/swirvfree/upgrade.html in a new tab. This is the page describing the Swirv Pro companion plugin.</li>
<li>The ★ Swirv Pro badges next to Pro-only features in the admin (the Settings → Analytics tab, the Passes and Analytics admin pages, and the Health Scan page) also open https://swirv.org/swirvfree/upgrade.html in a new tab.</li>
</ul>
These are user-initiated browser links, not server-side calls. Swirv does not send any visitor data, click data, site URL, or WordPress account information to swirv.org as part of these links — the connection happens in the user’s browser when they click the link. Standard web-server access logs on swirv.org (the visitor’s IP address, user-agent, referer) apply the same as any browser navigation to any site.
Service: swirv.org (the Swirv project’s marketing and documentation site) 
Terms of use: https://swirv.org/terms.html 
Privacy policy: https://swirv.org/privacy
<h4>A note on uptime-monitor names</h4>
Swirv ships a default “exclude monitor traffic” list (Settings → Analytics) containing names such as Pulsetic, UptimeRobot, Better Stack, Hyperping, StatusCake, and Pingdom. These are not external services Swirv connects to. They are text substrings Swirv matches against the User-Agent header of incoming requests to your own site, so that clicks from those uptime monitors are not counted in your analytics. No data is sent to any of these services, and no network connection is made.
<h3>Source Code and Bundled Libraries</h3>
Swirv ships two minified third-party JavaScript libraries and keeps all custom Swirv JavaScript readable and unminified.
<ul>
<li><code>admin/js/chart.umd.min.js</code> is Chart.js 4.5.1. Readable source is available at <code>https://www.npmjs.com/package/chart.js/v/4.5.1</code> and <code>https://github.com/chartjs/Chart.js/tree/v4.5.1</code>.</li>
<li><code>admin/js/qrcode.min.js</code> is node-qrcode 1.5.4, bundled from the browser entry point as an IIFE that exposes <code>window.QRCode</code>. Readable source is available at <code>https://www.npmjs.com/package/qrcode/v/1.5.4</code> and <code>https://github.com/soldair/node-qrcode/tree/v1.5.4</code>.</li>
</ul>

Swirv

Share a link once, change where it points later — no resending. Personalised Passes give each recipient their own private URL.

Beplus

<a href="https://giftflow.beplus-agency.cloud/" rel="nofollow ugc">Landing Page</a> | <a href="https://giftflow.beplusthemes.com/" rel="nofollow ugc">Live Demo</a>
GiftFlow is a powerful WordPress plugin designed to help organizations manage donations, donors, and fundraising campaigns efficiently. Built with modern WordPress standards and an extensible architecture, GiftFlow provides everything you need to accept donations, track campaigns, and manage donor relationships.
<h4>Key Features</h4>
<ul>
<li>
Donation Management
<ul>
<li>Custom post types for donations, donors, and campaigns</li>
<li>Comprehensive donor profiles with contact information</li>
<li>Donation history tracking</li>
<li>Transaction details and status management</li>
<li>Support for one-time and recurring donations</li>
</ul>
</li>
<li>
Payment Processing
<ul>
<li>Multiple payment gateway support (Stripe, PayPal)</li>
<li>Secure payment processing with PCI compliance</li>
<li>Direct bank transfer option</li>
<li>Real-time payment status updates</li>
<li>Webhook integration for payment notifications</li>
</ul>
</li>
<li>
Campaign Management
<ul>
<li>Create and manage unlimited donation campaigns</li>
<li>Set campaign goals and track progress in real-time</li>
<li>Campaign-specific donation forms</li>
<li>Campaign analytics and reporting</li>
<li>Visual progress indicators</li>
</ul>
</li>
<li>
Form Builder
<ul>
<li>coming soon </li>
</ul>
</li>
<li>
Reporting & Analytics
<ul>
<li>Admin dashboard with statistics</li>
<li>Export functionality</li>
</ul>
</li>
<li>
Gutenberg Blocks
<ul>
<li>Campaign display blocks</li>
<li>Donation form blocks</li>
<li>Campaign content blocks</li>
<li>Full block editor support</li>
</ul>
</li>
</ul>
<h4>Payment Gateways</h4>
GiftFlow supports multiple payment gateways through official SDKs:
<ul>
<li>Stripe – Direct integration using Stripe PHP SDK for secure credit/debit card processing</li>
<li>PayPal – Direct integration using PayPal JS SDK v6 and REST API v2 with Smart Buttons for seamless payment experience</li>
<li>Direct Bank Transfer – Manual payment option for bank transfers</li>
</ul>
Additional payment gateways can be added through the plugin’s extensible gateway architecture.
<h3>Development</h3>
This plugin uses Laravel Mix (a wrapper around Webpack) to compile and bundle JavaScript and CSS files for production.
<h4>Source Code</h4>
The original source code for all compiled JavaScript and CSS files can be found at: 
<a href="https://github.com/miketropi/giftflow" rel="nofollow ugc">https://github.com/miketropi/giftflow</a>
<h4>File Structure</h4>
In the <code>assets/js/</code> directory, the plugin follows this naming convention:
<ul>
<li><code>*.js</code> – Original, uncompiled source files (human-readable)</li>
<li><code>*.bundle.js</code> – Compiled/minified production files (generated by build process)</li>
</ul>
For example:
<ul>
<li><code>forms.js</code> → Source file</li>
<li><code>forms.bundle.js</code> → Compiled production file</li>
</ul>
The same pattern applies to all JavaScript files:
<ul>
<li><code>common.js</code> / <code>common.bundle.js</code></li>
<li><code>stripe-donation.js</code> / <code>stripe-donation.bundle.js</code></li>
<li><code>paypal-donation.js</code> / <code>paypal-donation.bundle.js</code></li>
<li><code>grecaptcha.js</code> / <code>grecaptcha.bundle.js</code></li>
</ul>
Only the <code>*.bundle.js</code> files are enqueued in production. The source <code>*.js</code> files are included in the repository for transparency and to comply with WordPress.org guidelines requiring human-readable source code.
<h4>Build Commands</h4>
To rebuild assets locally:
<pre><code>npm install - Install dependencies
npm run dev - Watch for changes and rebuild automatically during development
npm run build - Build for production (minified)<h3>External Services</h3>
</code></pre>
This plugin relies on the following third-party services to provide its functionality. These services are only used when explicitly enabled by the site administrator. By using these features, data may be transmitted to external servers. Please review the terms and privacy policies of each service before enabling them.
<h4>Stripe (stripe.com)</h4>
This plugin uses the Stripe payment gateway to process credit and debit card donations securely.
Service Provider: Stripe, Inc. 
Service URL: <a href="https://stripe.com" rel="nofollow ugc">https://stripe.com</a>
Data Transmitted:
<ul>
<li>Payment card information (processed directly by Stripe, not stored on your server)</li>
<li>Donation amount and currency</li>
<li>Donor name and email address</li>
<li>Billing address (if collected)</li>
<li>Transaction metadata (donation ID, campaign ID)</li>
</ul>
When Data is Sent:
<ul>
<li>When a donor submits a donation form using Stripe as the payment method</li>
<li>When processing refunds through the admin dashboard</li>
<li>When verifying webhook signatures for payment status updates</li>
</ul>
Legal:
<ul>
<li>Terms of Service: <a href="https://stripe.com/legal" rel="nofollow ugc">https://stripe.com/legal</a></li>
<li>Privacy Policy: <a href="https://stripe.com/privacy" rel="nofollow ugc">https://stripe.com/privacy</a></li>
</ul>
<h4>PayPal (paypal.com)</h4>
This plugin uses PayPal to process donations through PayPal accounts and PayPal Smart Payment Buttons. The plugin communicates with PayPal’s REST API using the following base URLs:
<ul>
<li>Production: <a href="https://api.paypal.com" rel="nofollow ugc">https://api.paypal.com</a></li>
<li>Sandbox (testing): <a href="https://api.sandbox.paypal.com" rel="nofollow ugc">https://api.sandbox.paypal.com</a></li>
</ul>
Service Provider: PayPal Holdings, Inc. 
Service URL: <a href="https://www.paypal.com" rel="nofollow ugc">https://www.paypal.com</a>
Data Transmitted:
<ul>
<li>Donation amount and currency</li>
<li>Donor name and email address</li>
<li>Order description and transaction metadata</li>
<li>Return URLs for payment completion</li>
</ul>
When Data is Sent:
<ul>
<li>When a donor initiates a donation using PayPal as the payment method</li>
<li>When creating and capturing PayPal orders via the REST API</li>
<li>When processing refunds through the admin dashboard</li>
</ul>
Legal:
<ul>
<li>Terms of Service: <a href="https://www.paypal.com/webapps/mpp/ua/useragreement-full" rel="nofollow ugc">https://www.paypal.com/webapps/mpp/ua/useragreement-full</a></li>
<li>Privacy Policy: <a href="https://www.paypal.com/webapps/mpp/ua/privacy-full" rel="nofollow ugc">https://www.paypal.com/webapps/mpp/ua/privacy-full</a></li>
</ul>
<h4>Google reCAPTCHA (google.com/recaptcha)</h4>
This plugin optionally uses Google reCAPTCHA to protect donation forms from spam submissions and automated abuse.
Service Provider: Google LLC 
Service URL: <a href="https://www.google.com/recaptcha" rel="nofollow ugc">https://www.google.com/recaptcha</a>
Data Transmitted:
<ul>
<li>User’s IP address</li>
<li>Browser user agent and plugins</li>
<li>Mouse movements and keystrokes on the page</li>
<li>JavaScript environment information</li>
<li>reCAPTCHA site key</li>
</ul>
When Data is Sent:
<ul>
<li>When a donation form with reCAPTCHA protection is loaded</li>
<li>When a donor interacts with or submits a protected donation form</li>
</ul>
Legal:
<ul>
<li>Terms of Service: <a href="https://policies.google.com/terms" rel="nofollow ugc">https://policies.google.com/terms</a></li>
<li>Privacy Policy: <a href="https://policies.google.com/privacy" rel="nofollow ugc">https://policies.google.com/privacy</a></li>
</ul>
<h4>Social sharing (Share block)</h4>
The GiftFlow Share block allows visitors to share campaign or page content to social networks. When share buttons are used, the browser may open or redirect to the following third-party URLs. No data is sent from your server to these services; the user’s browser loads the share URL with the page title and URL that the user chooses to share.
Services and URLs used:
<ul>
<li>Facebook – <a href="https://www.facebook.com/sharer/sharer.php" rel="nofollow ugc">https://www.facebook.com/sharer/sharer.php</a> (with <code>u</code> = shared URL)</li>
<li>X (Twitter) – <a href="https://twitter.com/intent/tweet" rel="nofollow ugc">https://twitter.com/intent/tweet</a> (with <code>url</code> and <code>text</code>)</li>
<li>LinkedIn – <a href="https://www.linkedin.com/sharing/share-offsite/" rel="nofollow ugc">https://www.linkedin.com/sharing/share-offsite/</a> (with <code>url</code>)</li>
<li>WhatsApp – <a href="https://api.whatsapp.com/send" rel="nofollow ugc">https://api.whatsapp.com/send</a> (with <code>text</code> containing title and URL)</li>
<li>Pinterest – <a href="https://pinterest.com/pin/create/button/" rel="nofollow ugc">https://pinterest.com/pin/create/button/</a> (with <code>url</code> and <code>description</code>)</li>
<li>Reddit – <a href="https://reddit.com/submit" rel="nofollow ugc">https://reddit.com/submit</a> (with <code>url</code> and <code>title</code>)</li>
<li>Telegram – <a href="https://t.me/share/url" rel="nofollow ugc">https://t.me/share/url</a> (with <code>url</code> and <code>text</code>)</li>
</ul>
Data transmitted: Only the page URL and title (or description) that the user is sharing, passed as query parameters in the share link. No data is sent to these services until the user clicks a share button.
When data is sent: When a visitor clicks a social share button in the Share block.
Legal (WhatsApp):
This plugin includes a sharing feature that allows users to share content via WhatsApp.
When the user clicks the WhatsApp share button, the plugin opens the WhatsApp sharing URL and sends the following data: 
– The page title 
– The page URL
This request is sent only when the user actively clicks the share button.
This service is provided by WhatsApp.
<ul>
<li>Terms of Service: <a href="https://www.whatsapp.com/legal/terms-of-service" rel="nofollow ugc">https://www.whatsapp.com/legal/terms-of-service</a></li>
<li>Privacy Policy: <a href="https://www.whatsapp.com/legal/privacy-policy" rel="nofollow ugc">https://www.whatsapp.com/legal/privacy-policy</a></li>
</ul>
<h4>Google Maps Platform (developers.google.com/maps)</h4>
This plugin optionally uses Google Maps to display campaign locations and geographic information.
Service Provider: Google LLC 
Service URL: <a href="https://developers.google.com/maps" rel="nofollow ugc">https://developers.google.com/maps</a>
Data Transmitted:
<ul>
<li>Map coordinates and location queries</li>
<li>User’s IP address (by Google when loading map tiles)</li>
<li>Google Maps API key</li>
</ul>
When Data is Sent:
<ul>
<li>When a page containing a Google Maps embed is loaded</li>
<li>When geocoding addresses for campaign locations</li>
</ul>
Legal:
<ul>
<li>Terms of Service: <a href="https://cloud.google.com/maps-platform/terms" rel="nofollow ugc">https://cloud.google.com/maps-platform/terms</a></li>
<li>Privacy Policy: <a href="https://policies.google.com/privacy" rel="nofollow ugc">https://policies.google.com/privacy</a></li>
</ul>
<h4>Important Privacy Notice</h4>
Site administrators are responsible for ensuring compliance with applicable privacy laws (such as GDPR) when using these third-party services. We recommend:
<ul>
<li>Disclosing the use of these services in your site’s privacy policy</li>
<li>Obtaining appropriate consent from users before processing their data</li>
<li>Reviewing each service’s data processing agreements</li>
</ul>

GiftFlow – Donation & Fundraising

A comprehensive WordPress plugin for managing donations, donors, and campaigns with modern features and extensible architecture.

Swirv vs GiftFlow – Donation & Fundraising