ifthenpay | Payments for Forminator

PHP Compatibility

Categories with Findings

Positive Observations

• Every wp_remote_get()/wp_remote_post() call in IfthenpayClient explicitly sets a 'timeout' (15s or 30s) rather than relying on the default, avoiding indefinite blocking.
• Primary settings are stored with update_option(..., false) so large/sensitive values (gateway keys, methods catalog) are kept out of the autoload cache.
• The webhook endpoint correctly early-returns on get_query_var( self::QUERY_VAR ) false, so it does not run on normal template requests.
• WebhookRegistrar uses a 15-minute transient (RETRY_LOCK) to throttle repeated re-registration attempts, and checks a cheap md5 hash before doing any HTTP work.
• AJAX handlers verify a nonce, and webhook/return-URL authenticity uses hash_equals() rather than loose comparison.
• Admin assets (ConnectSettings::enqueue_assets) are gated behind an is_settings_page() hook-suffix check rather than loading on all admin screens.
• IfthenpayField only renders a lightweight hidden marker on the frontend; payment initiation and entry creation happen out-of-band, keeping Forminator's render pipeline cheap.