imsoftware

This plugins replaces the regular authentication of WordPress and offers instead the authentication of users via IMAP accounts. Password reset and retrieving are suppressed in order to avoid confussion.
The IMAP authentication server as well as an automatic padding of the domain to a user name can be set on the plugins setting page under Settings > IMAP Authentication. Furthermore, users having a IMAP account on the defined server can automatically be register if set so.
Contributors: Aaron Parecki, Riccardo Magliocchetti, Lorenz Schmid, Marius Müller

WP IMAP Auth

Use IMAP accounts to login in to WordPress. Replaces the regular authentication.

NeoSmartApps

neoparker007

<blockquote>
Self-hosted. Privacy-first. Fully yours.
</blockquote>
Tempmails turns your WordPress site into a self-hosted temporary email 
service. Visitors generate a random disposable email address, receive 
messages in a real-time inbox, and discard them when done — all without 
leaving your site.
Unlike third-party services, Tempmails runs entirely on your own server 
and IMAP mailbox. You own the data, the domain, and the brand.
🔒 No third-party email APIs 
📬 Real IMAP inbox — not a simulation 
🎨 Material Design 3 UI — beautiful out of the box 
⚡ AJAX-powered — no page reloads
<h4>🚀 Quick Links</h4>
Everything you need to get started, get help, and stay connected:
<ul>
<li>🌐 Official Website — <a href="https://tempmails.cv/" rel="nofollow ugc">tempmails.cv</a> — docs, 
roadmap, and addon announcements</li>
<li>🎬 Installation Tutorial — Watch the step-by-step video guide below</li>
<li>📺 YouTube Channel — <a href="https://www.youtube.com/@NeoSmartApps101" rel="nofollow ugc">NeoSmartApps on YouTube</a> 
— tutorials, walkthroughs, and new release demos</li>
<li>☕ Support the Project — <a href="https://paypal.me/growmify" rel="nofollow ugc">Buy us a coffee via PayPal</a> 
— Tempmails is free forever; your support keeps development alive</li>
<li>🖥️ Need Hosting? — Tempmails works best on a VPS or shared host with 
catch-all IMAP support. We recommend <a href="https://www.hostinger.com/in?REFERRALCODE=neoparker" rel="nofollow ugc">Hostinger</a> 
(affiliate link — we earn a small commission at no extra cost to you)</li>
</ul>
<h4>🎬 Watch: Full Installation Tutorial</h4>
<iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/8SKRdyEUrog?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe>
<h4>Core Features</h4>
📨 Email Engine
<ul>
<li>IMAP Email Fetching — connects to any catch-all IMAP mailbox</li>
<li>Auto Email Generation — random disposable addresses on your own domains</li>
<li>Real-time Inbox — AJAX-powered message viewer with configurable 
auto-refresh</li>
<li>Attachment Support — download files with 40+ allowed extensions</li>
</ul>
🎨 Design & UI
<ul>
<li>Material Design 3 UI — modern, responsive inbox with Inter & Poppins fonts</li>
<li>White-labeled — fully rebrandable, no third-party branding in the UI</li>
<li>Design Panel — live color picker and label customization in admin</li>
</ul>
🛡️ Privacy & Data
<ul>
<li>Soft Delete — messages are never hard-deleted; safe for compliance</li>
<li>Cookie-based sessions — no user accounts or registration required</li>
<li>Zero external data transmission — all data stays on your server</li>
</ul>
⚙️ WordPress Native
<ul>
<li>Uses WP database, cron, options, nonces, and security APIs throughout</li>
<li>Settings API compliant admin panel</li>
<li>Full i18n/l10n support with <code>.pot</code> file included</li>
</ul>
<h4>Shortcode</h4>
Place the inbox anywhere on your site with one shortcode:
<pre><code>[tempmails_inbox]
</code></pre>
This renders the full inbox UI — email generation, copy button, 
auto-refresh, message list, and message viewer modal.
<h4>Addon Ecosystem</h4>
Tempmails Core is frozen infrastructure. All new functionality is 
delivered via addons using a documented, stable hook system — your site 
never breaks on Core updates.
Available addon hooks cover: email generation, message routing, inbox 
access control, multi-domain support, billing integration, and more. 
See the Hooks section below for the full reference.
<h4>Privacy</h4>
Tempmails stores temporary email addresses in browser cookies to 
maintain inbox sessions between page loads. No personal data is collected, 
stored against user accounts, or transmitted to any external service. 
See External Services below for details on the optional GitHub 
ecosystem feed.
<h3>Hooks</h3>
Tempmails exposes a complete hook system for addon developers. All hooks 
below are stable and frozen — they will not be renamed, removed, or 
have their signatures changed in any minor version.
<h4>Action Hooks</h4>
<ul>
<li><code>tempmails_loaded</code> — Core fully initialized; safe for addon bootstrap</li>
<li><code>tempmails_core_ready</code> — fires after DB integrity check; passes Core 
version string</li>
<li><code>tempmails_activated</code> — fires on plugin activation; safe for addon setup</li>
<li><code>tempmails_deactivated</code> — fires on plugin deactivation</li>
<li><code>tempmails_email_generated</code> — new address generated; params: <code>$email</code>, 
 $ip</li>
<li><code>tempmails_inbox_accessed</code> — user opened inbox; params: <code>$email</code>, <code>$ip</code></li>
<li><code>tempmails_message_received</code> — new message stored; params: <code>$message_id</code>, 
 $to_address</li>
<li><code>tempmails_message_marked_seen</code> — message read; params: <code>$message_id</code></li>
<li><code>tempmails_message_deleted</code> — soft delete triggered; params: <code>$message_id</code>, 
 $email</li>
<li><code>tempmails_cleanup_completed</code> — cron cleanup finished; params: 
 $deleted_count</li>
<li><code>tempmails_fetch_completed</code> — fetch cycle finished; params: <code>$results</code> 
array</li>
</ul>
<h4>Filter Hooks</h4>
<ul>
<li><code>tempmails_registered_addons</code> — register your addon for the Addons admin 
page</li>
<li><code>tempmails_generated_email</code> — modify a generated address before returning 
it</li>
<li><code>tempmails_available_domains</code> — modify the domain list available for 
generation</li>
<li><code>tempmails_can_fetch_messages</code> — allow/block a fetch cycle; params: 
 $bool, <code>$engine</code></li>
<li><code>tempmails_can_process_message</code> — allow/block a single message; params: 
 $bool, <code>$message</code></li>
<li><code>tempmails_can_store_message</code> — allow/block DB insert; params: <code>$bool</code>, 
 $data</li>
<li><code>tempmails_can_read_inbox</code> — allow/block inbox access; params: <code>$bool</code>, 
 $email</li>
<li><code>tempmails_message_content</code> — filter body before display; params: 
 $content, <code>$message_id</code></li>
<li><code>tempmails_default_settings</code> — modify default option values on activation</li>
<li><code>tempmails_inbox_attributes</code> — modify shortcode default attributes</li>
<li><code>tempmails_admin_dashboard_stats</code> — extend dashboard stat cards</li>
<li><code>tempmails_settings_tabs</code> — add custom tabs to the Settings page</li>
</ul>
<h3>External Services</h3>
<h4>Ecosystem Feed (Optional — Default On)</h4>
Tempmails fetches a public JSON file from GitHub to display addon and 
ecosystem information inside the WordPress admin panel.
What this connection does:
<ul>
<li>Fires only when viewing Tempmails admin pages</li>
<li>Retrieves only public, non-personal JSON content</li>
<li>Transmits no user data, site URL, or any identifiable information</li>
<li>Results are cached locally for 1 hour to minimize requests</li>
</ul>
Remote endpoint: 
https://raw.githubusercontent.com/ubermensch-site/tempmails-ecosystem/main/ecosystem.json
Service provider: GitHub 
Privacy policy: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement
To disable this connection entirely, uncheck Ecosystem Feed under 
Tempmails → Settings → General. Hardcoded fallback content is shown 
instead — no requests are made.
<h4>Google Fonts</h4>
The frontend inbox loads the Inter and Poppins typefaces and the 
Material Symbols icon font from Google Fonts CDN.
What this connection does:
<ul>
<li>Fires only on pages where <code>[tempmails_inbox]</code> is rendered</li>
<li>Transmits the visitor’s IP address to Google as part of a standard font 
request</li>
</ul>
Service provider: Google Fonts 
Privacy policy: https://developers.google.com/fonts/faq/privacy
To avoid this (e.g. for GDPR compliance), dequeue <code>tempmails-google-fonts</code> 
and load self-hosted font copies instead.
<h3>Developers</h3>
This section documents internal implementation details, security practices, 
and notes for addon developers.
<h4>Security Hardening Log</h4>
All security changes are tracked here for auditing purposes.
2026-04-04 — Security Review Pass (v1.0.7 patch)
<ol>
<li>class-core.php — <code>ajax_delete_message()</code>: <code>$_POST['message_id']</code> 
was <code>wp_unslash()</code>-ed but not sanitized, with a <code>phpcs:ignore</code> 
suppression comment masking the warning. Now wrapped with 
 sanitize_text_field( wp_unslash( … ) ). Suppression comment removed.</li>
</ol>
2026-04-02 — Security Review Pass (v1.0.7 patch)
<ol>
<li>class-design.php — Removed raw <code><style></code> echo from <code>render_page()</code>. 
Static CSS moved to <code>assets/css/admin.css</code>.</li>
<li>class-design.php — <code>inject_css_variables()</code> refactored: replaced 
 echo “…” with <code>wp_add_inline_style('tempmails-admin', ...)</code>. 
All <code>$v()</code> return values now pass through <code>esc_attr()</code>.</li>
<li>class-design.php — <code>inject_frontend_css_variables()</code> refactored: 
all CSS values escaped with <code>esc_attr()</code>, <code>wp_strip_all_tags()</code> applied.</li>
<li>class-design.php — <code>wp_footer</code> fallback replaced raw <code>echo '<style>'</code> 
with a dummy registered style handle.</li>
<li>class-tempmails-shortcodes.php — Inline <code><script></code> replaced with 
 wp_add_inline_script(‘tempmails-frontend’, …).</li>
<li>class-ecosystem.php — Inline <code><script></code> replaced with 
 wp_add_inline_script(‘tempmails-admin’, …).</li>
<li>class-core.php — <code>ajax_mark_seen()</code>: sanitized with 
 sanitize_text_field( wp_unslash( … ) ).</li>
<li>class-admin.php — <code>save_settings()</code>: Raw <code>$_POST</code> replaced with 
 $clean_post = array_map(‘sanitize_text_field’, wp_unslash($_POST)).</li>
<li>class-email-generator.php — <code>get_emails()</code>: Cookie data sanitized 
with <code>array_values(array_filter(array_map('sanitize_email', $raw)))</code>.</li>
</ol>
<h4>Addon Development Notes</h4>
Hook Stability Guarantee
All hooks listed in the <code>== Hooks ==</code> section are frozen. Signatures will 
not change in any 1.x release. Breaking changes will only occur in a major 
version bump with a migration guide.
$clean_post in save_settings hooks
As of the 2026-04-02 security patch, both <code>tempmails_before_save_settings</code> 
and <code>tempmails_before_save_imap_settings</code> receive a sanitized copy of 
 $_POST. If your addon previously relied on raw values via these hooks, 
retrieve those fields directly from <code>$_POST</code> with appropriate sanitization.
CSS Variable Injection
<pre><code>inject_css_variables() now attaches inline CSS to the `tempmails-admin`
</code></pre>
style handle. If your addon dequeues <code>tempmails-admin</code>, Design color 
variables will not be applied on admin pages.
<pre><code>inject_frontend_css_variables() uses a priority waterfall:
</code></pre>
1. Attaches to <code>tempmails-frontend</code> if registered/enqueued 
2. Falls back to <code>tempmails-frontend-css</code> 
3. Registers a dummy handle <code>tempmails-design-vars</code> in <code>wp_footer</code> at 
 priority 1
<h4>File Structure</h4>
tempmails/ 
├── assets/ 
│ ├── css/ 
│ │ ├── admin.css 
│ │ ├── frontend.css 
│ │ └── ecosystem.css 
│ └── js/ 
│ ├── admin.js 
│ ├── admin-design.js 
│ └── frontend.js 
├── core/ 
│ ├── class-core.php 
│ ├── class-admin.php 
│ ├── class-design.php 
│ ├── class-ecosystem.php 
│ ├── class-email-generator.php 
│ └── class-addon-handler.php 
├── includes/ 
│ ├── class-tempmails-shortcodes.php 
│ ├── class-tempmails-database.php 
│ ├── class-tempmails-settings.php 
│ ├── class-tempmails-imap.php 
│ └── class-tempmails-fetcher.php 
└── tempmails.php

Tempmails

White-label temporary email platform. Let visitors generate disposable inboxes on your site — powered by your own IMAP server.

WP IMAP Auth vs Tempmails