MeTransfer

File transfer block: send files with email link (admin) or receive uploads with admin notification (visitors).

Description

MeTransfer adds a block that turns a page into a simple file-transfer experience:

• As an admin: Add the block, choose files, enter a recipient email, and send. The recipient gets an email with a download link.
• As a visitor: Enter your email, receive a verification code, enter the code, then drop or choose files to send to the site owner. You get a code by email; the site admin gets a notification with a download link when you upload.

All transfers are recorded as Transfers in wp-admin (custom post type). You can view each transfer, see file status (on server or deleted), and delete uploaded files from the server when needed.

Functionality

• One block, two modes: Logged-in users with manage_options see the “send” flow (choose files, enter recipient email, send). Visitors see the “receive” flow (email + verification code, then upload).
• Block settings: In the editor you can set notification emails for the receive flow (who gets notified when a visitor uploads), optional transfer title/description labels, and overrides for success/error messages.
• Download links: No WordPress login required to download; links are token-based and validated server-side.
• Transfers list: Under Transfers in wp-admin you can open each transfer, download files, delete individual files or all files from the server, and resend notification emails (which issues a new link and invalidates the old one).
• Upload limit: The block respects WordPress’s maximum upload size (wp_max_upload_size()); the limit can be shown in block settings. File type rules follow WordPress’s allowed MIME types (see “File upload security” below).
• Email From address: Notification and verification emails are sent via wp_mail() with a From header built from your site title and admin email (where Settings → General → Administration Email Address is a valid email). Existing metransfer_*_email_headers filters can still override this if needed.

Development: verification code logging

If your server does not send email (e.g. local development), you can still test the visitor flow by logging the verification code instead of relying on email delivery.

Add these to your wp-config.php (both must be true for logging to run):

• define( 'WP_DEBUG', true );
• define( 'METRANSFER_DEV_LOG_CODE', true );

When both are set, the 6-digit verification code is written to your PHP error/debug log (e.g. wp-content/debug.log if WP_DEBUG_LOG is true, or your server’s error log). The plugin still attempts to send the code email; this option does not disable sending. Use it to copy the code from the log when testing without working mail.

To fully bypass sending and only log (e.g. avoid wp_mail errors in dev), use the filter metransfer_before_send_verification_code and return true after logging the code yourself.

Installation

1. Upload the plugin folder to /wp-content/plugins/ or install via WordPress admin.
2. Activate the plugin.
3. Add the MeTransfer block to any page or post.
4. (Optional) For development without working email, add METRANSFER_DEV_LOG_CODE and WP_DEBUG to wp-config.php as described above.

Frequently Asked Questions

Where are uploaded files stored?

Files are stored under wp-content/uploads/metransfer/ (by year/month, e.g. metransfer/2025/02/). There are no direct public URLs to these files; access is only through the plugin’s download link (token-based). Download links expire after 7 days; the files themselves are not deleted automatically (see “How long are files kept and how do I delete them?” below).

File upload security: what can and cannot be uploaded?

• What can be uploaded: Only file types allowed by WordPress’s allowed MIME types (the same list used for Media uploads). By default this includes common documents (e.g. PDF, Office), images, audio, video, and archives (e.g. ZIP). The list can be changed by other plugins or themes via the upload_mimes filter.
• What cannot be uploaded: Any type not in that list is rejected at upload. WordPress’s default list does not include executable or script types such as .php, .phtml, .phar, .exe, .bat, or .sh.
• Download protection: Even if a dangerous type were ever stored (e.g. via a custom MIME allowlist), the plugin never serves files with these extensions: php, phtml, php3, php4, php5, phar, exe, bat, sh. Single-file downloads return an error for those; in multi-file ZIPs they are omitted. Downloads are forced as attachments with safe headers.

How long are files kept on the server and how do I delete them?

• How long: Files stay on the server until you delete them. They are not removed automatically. The download link expires after 7 days (the recipient or admin can no longer use that URL), but the files remain in wp-content/uploads/metransfer/ until you delete them.
• How to delete: Go to Transfers in wp-admin, open a transfer, then either delete individual files (per-file “Delete” link) or use “Delete all files from server” to remove all files for that transfer. Permanently deleting the transfer post (e.g. from Trash) also deletes its files from the server and removes the transfer record.

Why don’t I receive the verification code email?

Ensure your site can send mail (e.g. SMTP plugin or server mail). For local/dev, use METRANSFER_DEV_LOG_CODE so the code is written to your debug log and you can copy it from there.

Changelog

1.0.4

• Security tightening.
• Improved use of nonces based on security review.
• Amended standards and references documentation.
• Updated notation and version.

1.0.3

• Excluded personal notes file from repository (.gitignore).
• License updated to GNU General Public License v3.0 (GPL-3.0).
• Minor updates and release packaging.

1.0.2

• Set explicit From header for notification and verification emails using the site title and admin email.

1.0.1

• Prevented transfer submission button in both send and receive flow from being double clicked.

1.0.0

• Initial release.
• Block: admin send to recipient with email link; visitor receive with email verification code.
• Custom post type Transfer to record each transfer and manage file status (on server / deleted).