GGPush Web Push

GGPush Web Push adds browser push notifications to WordPress without requiring a separate push-notification SaaS account.

The plugin generates VAPID keys on your server, stores browser subscriptions in your WordPress database, and sends encrypted Web Push messages directly from your WordPress server to each subscriber’s browser push service.

Features include:

• Modern non-modal subscription panel and animated notification launcher.
• Mobile-friendly compact subscription experience.
• The launcher is hidden for users who already have an active push subscription.
• Automatic VAPID key generation.
• Manual push notifications from the WordPress admin area.
• Optional automatic notifications when a new post is published.
• Push button in the post editor for published posts.
• Optional notification image from the WordPress Media Library.
• Active subscriber, campaign, successful delivery, failure, click and CTR statistics.
• Unique click counting per subscription and campaign.
• Automatic removal of expired push endpoints after 404/410 responses.
• HTTPS-only endpoint validation, SSRF protection and REST rate limiting.
• VAPID private-key encryption at rest using AES-256-GCM when supported by the server.
• No bundled third-party JavaScript or PHP framework.

External services and privacy

Web Push requires communication with the push service selected by the visitor’s browser. Depending on the browser and operating system, this may be a service operated by Google, Mozilla, Apple, Microsoft, or another browser/platform provider.

The plugin does not contact these services merely because it is installed. A visitor must explicitly click the notification opt-in control and grant browser notification permission before a push subscription is stored. When a site administrator sends a notification, the WordPress server sends the encrypted notification payload to the push endpoint supplied by that visitor’s browser.

Data involved in Web Push can include the browser-provided push endpoint, public subscription encryption keys, encrypted notification content, and VAPID authentication data. The plugin stores subscriptions and campaign/click statistics in the site’s own WordPress database. It does not send analytics or telemetry to the plugin author.