Subscription Workflow

Purpose

The subscription form replaces the heavier Fluent Forms plugin with a small, performance-focused custom PHP workflow. It captures a name and email, validates the address via Reoon API, and stores valid subscriptions in a protected CSV file.

Related: the site also has a Contact Form using the same custom-PHP approach with Turnstile + Reoon + Zammad + Telegram + email.

Shortcode

[id86_subscribe]

Defined in the child theme functions.php. Renders a three-section card: ID86 logo, copy ("Stay in the loop"), and inline form with name, email, and subscribe button.

Front-End Rendering

The subscribe bar is rendered through the Site Footer GP Element (ID 3040). The shortcode output is placed inside:

<section class="id86-subscribe-bar">
  <div class="id86-shell">
    [id86_subscribe]
  </div>
</section>

The shortcode wrapper HTML is generated by id86_render_subscribe_form() which outputs either the form or the thank-you message.

Submission Flow

Visitor submits name and email
  -> honeypot validation (hidden field)
  -> WordPress nonce validation (CSRF)
  -> email syntax validation (is_email())
  -> Reoon power-mode verification
     -> If WP_Error: log to failed-verifications.csv, show error
     -> If !is_safe_to_send: log to failed-verifications.csv, show error
     -> If safe: save to email-subscriber-id86net.csv
  -> Telegram notification to subscriber_notification group
  -> on-page toast + thank-you message:
     "Thank you, {name}. We'll send you a monthly summary
      of our latest instant documentation, cheatsheets, and updates."

Security Controls

Layer	Mechanism
Honeypot	Hidden id86_hp field catches automated bots
Nonce	WordPress CSRF protection via id86_subscribe_nonce
Reoon	API verification requires is_safe_to_send = true (power mode)
Input sanitization	sanitize_text_field, sanitize_email, esc_attr, esc_html
CSV locking	flock(LOCK_EX) prevents concurrent write corruption
Directory protection	index.php placed in subscriber directory to prevent directory listing

Form States

State	Output
Initial	Form with name input, email input, subscribe button
Success	Thank-you message with user's name
Reoon error	Error message from Reoon API or "Please use a valid, deliverable email address."
Save failure	"Could not save. Please try again later."
Security failure	"Security check failed." or "Spam detected."

Function Reference

Function	Purpose
id86_subscribe_dir()	Creates/returns subscriber storage directory (dirname(ABSPATH, 2) . "/id86-subscribers")
id86_save_subscriber(name, email)	Appends name, email, IP, timestamp to subscribers.csv with flock
id86_save_failed_subscriber_csv(name, email, reason)	Logs failed Reoon verifications
id86_verify_email_reoon(email)	Calls Reoon API, returns parsed response or WP_Error
id86_reoon_verification_is_safe(verification)	Checks is_safe_to_send flag
id86_subscribe_phpmailer(phpmailer)	Configures PHPMailer with SMTP from WP options
id86_send_subscriber_telegram(name, email)	Bot API sendMessage (HTML parse mode, ID86 Contact prefix) to the subscriber notification group
id86_render_subscribe_form(atts)	Shortcode handler routing the full submission lifecycle

Telegram Notification

On successful subscription (Reoon-verified, CSV saved), a Telegram notification is sent to the shared subscriber_notification group — the same channel used by the opshell subscription form (main bot, rezriz_bot). It includes:

• Timestamp, IP Address, Name, Email
• Footer: "Saved to email-subscriber-id86net.csv."

Sent via id86_send_subscriber_telegram() using the Bot API sendMessage endpoint with HTML parse_mode. The message is prefixed ID86 Contact to distinguish it from opshell notifications in the same group.

Channel note: the subscription notification reuses the opshell subscriber bot/chat (id86_subscribe_telegram_bot_token / id86_subscribe_telegram_chat_id), separate from the contact form Telegram channel.

Failed Verification Recording

Emails that fail Reoon verification are recorded in failed-verifications.csv (never in the success CSV, and never trigger a Telegram notification). Verified in production 2026-08-09: submitting test@nonexistent-domain-12345.com (Reoon is_safe_to_send: false) appended a row with reason not_safe while email-subscriber-id86net.csv stayed unchanged. The file is created on demand by id86_save_failed_subscriber_csv() and synced to /home/rezriz/github/subscriber/id86.net/ every 15 minutes.

Auto-Responder Note

No auto-responder email is sent at present. SMTP configuration is fully retained and tested for a future opt-in email workflow. The id86_subscribe_phpmailer() and a future id86_send_subscriber_email() function inherited from the Opshell pattern are ready for use. Telegram notifications are active and sent to the shared subscriber group.