manifest / ecommerce / hirezoot-application-fees

HireZoot Application Fees

Add paid application fees to HireZoot job listings. Collect payment via Razorpay (UPI/cards) or manual UPI + QR/UTR, redirect applicants to a payment page, and send receipt, confirmation, and reminder emails. GPL-licensed WordPress plugin by Sandip Das.

by Sandip Das · github.com/sandy5rr/hirezoot-application-fees · website

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/sandy5rr/hirezoot-application-fees/archive/refs/heads/main.zip

No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Readme github.com/sandy5rr/hirezoot-application-fees ↗

Optional application fees for HireZoot (WP Job Openings).

Applicants use the normal HireZoot form. If the job has a fee, the application is saved as payment pending, the candidate is redirected to a payment page, and emails are sent (receipt, paid confirmation, abandoned-payment reminder).

Version: 1.1.1
Requires: WordPress 6.0+, PHP 7.4+, HireZoot (WP Job Openings) active

Developer

Sandip Das
Fiverr: www.fiverr.com/sandy5rr

If needed, please connect for customization, support, or further development.

Why a separate plugin (not the theme)?

Survives theme switches
Keeps design themes focused on layout
Safe place for payment keys, webhooks, and fee logic
Reusable on any HireZoot site

Features

Area	What you get
Job edit	“Application Fee” meta box — enable, amount, label
Applications	Status: `none` / `pending` / `paid` / `failed` / `waived`
Admin	List column + side meta box; manual status override
Redirect	After apply → `/job-application-pay/{id}/?token=…`
Emails	Receipt + pay link; paid confirmation (applicant + admin); hourly reminder if still pending
Razorpay	Order create + Checkout.js + HMAC signature verify → paid
Manual UPI	UPI ID, browser-side QR (no third-party QR API), deep link, UTR form
Security	Pay token, rate-limited UTR, optional auto-complete off by default
Settings	Job Openings → Application Fees

Installation

Copy hirezoot-application-fees into wp-content/plugins/
Activate HireZoot Application Fees
Activate HireZoot (WP Job Openings) if not already
Job Openings → Application Fees — currency + Razorpay or Manual UPI
Edit a job → enable fee + amount
If payment links 404: Settings → Permalinks → Save

Payment flow

Apply (HireZoot form)
        ↓
awsm_job_application_submitted
        ↓
Fee job? ──no──► status: none (normal)
        │
       yes
        ↓
status: pending + deadline (5 min window) + pay token
        ↓
Redirect to payment page + receipt email (pay link)
        ↓
┌───────────────────┬────────────────────────────┐
│ Razorpay success  │ Manual: scan QR / pay UPI  │
│ (signature OK)    │ then submit UTR            │
└─────────┬─────────┴──────────────┬─────────────┘
          ↓                        ↓
     status: paid          UTR stored; paid only if
     + confirmation        “auto-complete” is enabled
     emails                AND within window (or HR marks paid)
          │
          ↓
If still pending after ~1 hour → reminder email (cron)

Configuration

Razorpay (recommended for real auto-confirm)

Create keys in the Razorpay Dashboard
Paste Key ID and Key Secret under Application Fees
Use test keys first
Currency INR for UPI

Manual UPI

Payment mode → Manual UPI + UTR
Enter UPI ID (VPA) and instructions
QR is generated in the applicant’s browser from a standard upi://pay?… intent
- Amount comes from server-side application meta
- Note (tn) looks like HZ{appId}{token} for bank-statement matching
Manual UTR auto-complete (optional, off by default):
- If enabled, UTR submitted within 5 minutes marks the application paid
- Security risk: a fake UTR can be typed — prefer HR verification or Razorpay

Security notes (QR & UTR)

Topic	Behaviour in 1.1.1
Third-party QR image APIs	Disabled — UPI payload is not sent to external QR hosts
Client-side QR	Drawn in-browser (qrcodejs); data stays on the page
Pay URL token	Required for page access (when set) and UTR POST
UTR rate limit	Max 8 attempts / 15 minutes per IP + application
UTR format	Normalized; length bounds enforced
Auto-complete on UTR	Default off; explicit setting + filter `hzaf_manual_utr_auto_paid`
True “paid?” detection	Only via Razorpay signature (or future webhooks). Banks do not notify WordPress on plain UPI

Recommendation: use Razorpay for production fees; use manual UPI + HR verify when you need a simple QR collect flow.

Emails

Event	Recipient	Content
Application + fee required	Applicant	Receipt, amount, payment link
Marked paid	Applicant	Confirmation + txn/UTR if present
Marked paid	Site admin	Who paid, job, amount
Still pending (~1h+)	Applicant	Reminder + payment link (once)

Uses wp_mail. For reliability, configure SMTP (e.g. FluentSMTP).

File structure

hirezoot-application-fees/
├── hirezoot-application-fees.php   # Bootstrap v1.1.1
├── readme.txt                      # WordPress.org-style readme
├── README.md                       # This file
├── includes/
│   ├── class-hzaf-plugin.php       # Settings helpers
│   ├── class-hzaf-job-meta.php     # Job fee meta box
│   ├── class-hzaf-application.php  # Status, redirect, 5-min deadline
│   ├── class-hzaf-payment.php      # Rewrite, Razorpay, UPI intent, UTR
│   ├── class-hzaf-emails.php       # Receipt / paid / reminder
│   ├── class-hzaf-admin.php        # Settings UI, columns, meta
│   └── class-hzaf-frontend.php     # Fee notice on apply form
├── templates/
│   └── payment-page.php            # Checkout + QR + timer
└── assets/
    ├── css/frontend.css
    └── js/frontend.js

Hooks (for developers)

Hook	When
`hzaf_application_pending_payment`	Application marked pending fee
`hzaf_application_paid`	Fee marked paid
`hzaf_payment_url`	Filter payment page URL
`hzaf_manual_utr_auto_paid`	Filter whether UTR auto-marks paid
`hzaf_payment_window_seconds`	Default `300` (5 minutes)
`hzaf_reminder_delay_seconds`	Default `HOUR_IN_SECONDS`
`hzaf_email_sent`	After each plugin email attempt

Changelog

1.1.1

Security: stop using third-party QR image APIs; browser-side QR only
Security: manual UTR auto-complete off by default (admin setting)
Security: pay token on UTR POST, rate limit, UTR sanitisation
Stronger UPI tn reference (HZ{id}{token}) + VPA validation
README / readme.txt updated

1.1.0

Redirect to payment page after fee applications
Applicant receipt, paid confirmation, abandoned-payment reminder emails
Manual UPI QR + 5-minute window
Razorpay verify → paid + emails

1.0.0

Initial release: job fees, Razorpay + manual UPI, application status, settings

License

GPL-2.0-or-later