A WordPress plugin that carries a site’s events into Telegram and lets people sign in with the same account. It was written for this site first, then generalised, and it is published as open source under GPL‑3.0.
Source, issues and releases: github.com/kostyasorokin/wp-telegram-integration
Signing in
Telegram Login is implemented as an OpenID Connect authorization code flow with PKCE, not as the copy-paste widget most plugins ship. The identity token is verified cryptographically before a WordPress session exists.
The flow remembers which browser started it. A callback link copied out of somebody else’s address bar cannot be replayed to hand over their account — the state cookie is per flow, and a mismatched one ends the attempt rather than logging anyone in.
Telegram returns no email address and no reliable avatar. Both gaps are filled deliberately: a new account is asked for an email once, and a profile photo is fetched only over HTTPS from Telegram’s own hosts.
Notifications
Content, comments, users, media, security, updates and Site Health each have their own switch, and WooCommerce adds orders, stock and cart events. Every message is assembled from a header the owner configures rather than from a fixed template.
Third-party integrations are not a hardcoded list. The plugin scans its own integrations directory, validates what it finds and caches the result, so adding support for another plugin is a file rather than an edit in six places.
Telling you when it breaks
A notification that fails leaves the reason behind — Telegram’s own words, the chat it was for, and the size of the message. The body is never stored, because a notification can carry a form submission.
Delivery state is reported through WordPress Site Health, so “notifications stopped arriving” is something the owner can see rather than something they eventually notice. A recovery from failure is recorded immediately instead of waiting out the success throttle.
Contact Form 7 gets a check of its own. An unbroken run of submissions rejected as spam is treated as evidence about the spam filter rather than about the senders — real spam arrives in bursts, a gate that refuses everything does not.
Built to be built on
Other plugins and themes get a small documented API: send a message, reach the Bot API directly, or register a webhook command. The login button helper returns an empty string when the plugin has not booted, when login is switched off and when the visitor is already signed in, so a template can echo it without a guard around it.
Every outbound call the plugin can make is disclosed in its readme, and the two settings that are dangerous on purpose say so in plain words and ship switched off.
Roles
Developer
Konstantin Sorokin
Work done
- Plugin architecture and PHP development
- Telegram Login over OpenID Connect with PKCE
- Notification layer for WordPress and WooCommerce events
- Contact Form 7, Mailchimp and WooCommerce integrations
- Bot API client and REST webhook endpoint
- Admin settings, Site Health checks and delivery log
- Russian and Ukrainian translations
- Documentation and open-source release