Stampy

Stampy is a self-hosted mailing-list plugin for WordPress. No external email service required — connect your own SMTP server and send directly from your site.

Features

• Double opt-in signup block — a Gutenberg block with email, configurable custom fields, consent checkbox, and list selection. Spam protection via honeypot, rate limiting, optional quiz challenge, Cloudflare Turnstile, and Friendly Captcha.

• Custom field management — define custom subscriber attributes (text, textarea, number, date, select, checkbox) with a self-service admin UI. Fields are validated on signup and usable as merge tags in campaigns.

• Subscriber management — admin list table with search, status filtering, list membership filtering, bulk actions, and prominent count display. Full per-subscriber profile editor for all attributes.

• List management — create and manage multiple mailing lists with subscriber memberships and subscriber counts.

• Block-editor campaign composer — compose newsletters in the WordPress block editor. The campaign sidebar plugin provides subject, target list selection, tracking override, send/cancel, progress, and preview — all in one place. Campaign duplication for reusing existing content as a template.

• SMTP connector — configure any SMTP server with TLS/SSL encryption and authentication. Test-send from the settings page. Passwords encrypted with libsodium.

• Batched background sending — Action Scheduler-powered sending with per-recipient personalization via merge tags, RFC 8058 one-click unsubscribe headers, and stuck-send detection.

• Open & click tracking — optional tracking pixel and link rewriting with HMAC-signed URLs. Per-campaign override. Disabled by default for privacy.

• Import & Export — export all subscribers or a specific list to CSV or JSON. Import subscribers from CSV or JSON with live preview, delimiter auto-detection, and merge-policy upsert.

• Submission log — optional consent audit trail logging every signup submission (email, fields, list IDs, consent text, timestamp). Searchable admin viewer. GDPR export/erase covered.

• GDPR compliance — personal data exporters and erasers for subscriber profiles, attributes, list memberships, pending signups, campaign recipient history, click tracking data, and submission log entries. Physical address field for CAN-SPAM compliance.

• Preference center — subscribers can manage their list memberships and unsubscribe from a self-hosted preference page.

• Uninstall cleanup — all data (tables, options, cron events, campaigns) is removed on plugin deletion (toggle in settings).

• Translation-ready — ships with a.pot template; community translations available via translate.wordpress.org once the plugin is hosted on WordPress.org.

External Services

Stampy optionally integrates with two third-party captcha services to protect your signup form from automated bot submissions. Both are disabled by default and only activated when you configure site and secret keys in Stampy → Settings. No data is sent to any external service unless you explicitly enable and configure one of these captcha providers.

Cloudflare Turnstile

When enabled, the Cloudflare Turnstile widget script is loaded from Cloudflare’s servers on pages containing the Stampy Signup block. The widget collects interaction data from the visitor’s browser (including mouse movements, keyboard timing, and other behavioral signals) and sends it to Cloudflare for bot detection. When the form is submitted, the Turnstile token is verified server-side via Cloudflare’s siteverify API, which sends the token, the configured secret key, and the visitor’s IP address to Cloudflare.

• Service: https://developers.cloudflare.com/turnstile/

• Terms of Service: https://www.cloudflare.com/website-terms/

• Privacy Policy: https://www.cloudflare.com/privacypolicy/

• Turnstile Privacy Addendum: https://www.cloudflare.com/turnstile-privacy-policy/

Friendly Captcha

When enabled, the Friendly Captcha widget script is bundled and served locally from the plugin’s assets/vendor/friendly-captcha/ directory (no external CDN dependency). The widget generates a proof-of-work puzzle that is solved in the visitor’s browser using its computing resources. When the form is submitted, the solution is verified server-side via Friendly Captcha’s siteverify API, which sends the solution and the configured API key to Friendly Captcha.

• Service: https://friendlycaptcha.com/

• Terms of Service: https://friendlycaptcha.com/legal/terms

• Privacy Policy: https://friendlycaptcha.com/legal/privacy/