WhoKnew Signal – Self-Hosted Web Push Notifications & PWA

WhoKnew Signal sends real push notifications directly from your WordPress site to every major browser – including iPhone and iPad – with no SaaS account, no Firebase, and no monthly subscription. One plugin. Completely yours.

Unlimited Subscribers in the Free Plugin

Grow your list without hitting a subscriber cap. Unlimited active subscribers are included in the free plugin – not a trial, not a temporary unlock, and not tied to a paid upgrade. Many WordPress push plugins and SaaS tools charge when your list grows (subscriber limits, paid tiers, or per-seat pricing). WhoKnew Signal stores every endpoint in your WordPress database and does not count subscribers against a paid quota.

• Unlimited subscribers (free) – 10, 1,000, or 100,000+ active subscribers on the same free plugin
• No per-subscriber fees – your hosting plan is the practical limit, not an artificial plugin cap
• Pro adds automation – Install on Phones, background sends, WooCommerce, analytics, and more (not a higher subscriber limit)

One Plugin That Does What Two Used to Require

Until now, getting iOS push notifications working on WordPress required two separate plugins: a PWA plugin (to set up your web app manifest and home screen icon) and a push notification plugin (to actually send the notifications). Then you had to make them work together.

WhoKnew Signal does both in a single, lightweight plugin.

The built-in Web App tab handles what standalone PWA plugins do: your manifest.json, app icon, theme color, display mode, and Apple touch icon meta tags. Visitors can add your site to their home screen manually; WhoKnew Signal Pro adds the [wkspn_install_buttons] shortcode for guided Android and iOS install buttons. Once installed as a PWA, visitors can receive push notifications on supported browsers.

If you have Super PWA, PWA for WP, or a similar plugin installed just to get iOS push working – you can replace it with WhoKnew Signal alone.

Self-Hosted Web Push on Your WordPress Server

WhoKnew Signal is built for site owners who want truly self-hosted web push notifications and a PWA (Progressive Web App) setup without a SaaS dashboard, without Firebase as your subscriber database, and without per-subscriber monthly fees.

Many WordPress push plugins route campaigns through a vendor API or store tokens off-site. SaaS tools like OneSignal and PushEngage are upfront about that model. WhoKnew Signal takes a different approach: subscriber endpoints live in your WordPress database, and campaigns are sent from your server using the open VAPID Web Push standard.

• Unlimited subscribers on free – no 250- or 2,000-subscriber paywall common in other push plugins
• VAPID web push – supported in Chrome, Firefox, Edge, Android, and Safari (including iOS when your site is installed to the home screen as a PWA)
• Subscriber data on your server – push tokens stay in your database; WhoKnew does not host your list
• Direct delivery from WordPress – your site sends encrypted payloads to each browser’s push endpoint (see External services below for FCM, Mozilla, and Apple delivery networks)
• Built-in PWA manifest – app name, icons, theme color, display mode, and Apple touch icon meta tags without a separate PWA plugin
• No WhoKnew account required for the free plugin – no license server, analytics phone-home, or vendor relay for sending

WhoKnew Signal Pro (sold separately at whoknew.io) adds Install on Phones, background campaign sends, rich images, WooCommerce automation, segmentation, analytics, scheduling, and optional SMS notifications via your own Twilio account.

Subscriptions That Actually Stay Subscribed

Most push notification plugins lose a subscriber the moment they clear their browser cache. WhoKnew Signal is built differently:

• Survives browser cache clears – subscriber status is stored in both a cookie and browser storage. If one is wiped, the other picks it up automatically. No popup re-appears, no duplicate entry.
• Self-healing subscriptions – if both are cleared but the browser still holds the push subscription, the plugin silently re-registers in the background on the next visit. The subscriber never sees a popup again. They just stay subscribed.
• No Firebase account required – subscription persistence uses your site storage, not a Google developer project for your subscriber list

Once someone subscribes, WhoKnew Signal is designed to keep them subscribed across cache clears without storing your audience on a third-party push SaaS.

Post Types

• Free – auto-send on publish for blog posts (unlimited subscribers)
• Pro – auto-send for additional public post types such as pages, WooCommerce products, events, and custom post types from other plugins

Free Features

• Unlimited active subscribers – no subscriber cap in the free plugin (a major difference from capped free tiers elsewhere)
• Truly self-hosted – subscriber data stored only in your WordPress database
• Works on Chrome, Firefox, Edge, Android, macOS Safari, iOS Safari (via PWA)
• iOS and macOS Safari included free – no upgrade, no extra fee
• Built-in PWA / Web App manifest – replaces Super PWA and similar plugins
• Auto-send on publish for blog posts (additional post types in Pro)
• App name, icons, theme color, display mode, and start URL – all configurable
• VAPID keys auto-generated on activation – no setup, no accounts
• Beautiful soft-ask subscription popup (fully customizable text and colors)
• Welcome notification sent automatically the moment someone subscribes
• Auto-send notification when a blog post is published (more post types in Pro)
• Manual campaign send from the admin dashboard
• Manual and auto-send campaigns (blocking in-tab send; Pro adds background queue)
• Multiple campaigns can send at the same time (default: up to 5 concurrent sends)
• Live send progress in the admin (Send Dock on Signal tabs and admin bar badge)
• Subscriber management with browser and platform tracking
• Campaign history with click tracking
• VAPID key backup and restore – migrate to a new server without losing subscribers
• Privacy-minded – self-hosted data, browser consent, copy-paste privacy policy text in Settings; optional link to WordPress account when logged in
• No WhoKnew SaaS account – the free plugin does not phone home; push delivery uses browser networks documented under External services

Pro Features (whoknew.io)

• Install on Phones shortcode and settings
• Background campaign sends (leave the admin tab)
• Rich notification banner images
• WooCommerce push notifications – order updates and abandoned cart to linked accounts; broadcasts for new products, back in stock, and price drops
• Advanced analytics dashboard with subscriber growth, browser breakdown, and best send time
• Smart subscriber segments – engagement, device, tenure, and Woo purchase behavior (combine when sending)
• A/B test two notification variants with automatic winner promotion
• Action buttons – clickable call-to-action on every notification
• Scheduled campaigns – send at a future date and time
• Background send performance profiles – tune concurrency for shared, VPS, or cloud hosting (Settings tab)
• Welcome drip sequence – automated onboarding for new subscribers
• Re-engagement campaigns – automatically re-engage inactive subscribers
• Rich notifications with large images
• UTM tracking – measure push traffic in Google Analytics
• TTL control – expire stale notifications automatically
• Subscriber import & export – full server migration support
• SMS notifications (optional) – send text messages via your own Twilio account; subscriber phone numbers stored on your server, no SaaS markup
• Priority support

How It Compares

Typical setup models for WordPress push (your experience may vary by vendor):

Unlimited subscribers on free plan * Vendor-hosted push plugins: Often capped (e.g. 250-2,000) * SaaS (OneSignal etc.): Tier / usage limits * WhoKnew Signal: Unlimited (free)

Subscriber list stored on your WordPress server * Vendor-hosted push plugins: Often no * SaaS (OneSignal etc.): No * WhoKnew Signal: Yes

Send from your WordPress server (VAPID) * Vendor-hosted push plugins: Often no * SaaS (OneSignal etc.): No * WhoKnew Signal: Yes

Requires vendor SaaS account to operate * Vendor-hosted push plugins: Often yes * SaaS (OneSignal etc.): Yes * WhoKnew Signal: No (free plugin)

iOS / Safari web push (PWA) * Vendor-hosted push plugins: Often paid add-on * SaaS (OneSignal etc.): Paid tiers * WhoKnew Signal: Included in free

Built-in PWA manifest * Vendor-hosted push plugins: No * SaaS (OneSignal etc.): No * WhoKnew Signal: Yes

Install buttons shortcode (iOS + Android) * Vendor-hosted push plugins: No * SaaS (OneSignal etc.): No * WhoKnew Signal: Yes (Pro)

SMS notifications * Vendor-hosted push plugins: No * SaaS (OneSignal etc.): Yes (managed SaaS) * WhoKnew Signal: Optional — BYO-Twilio (Pro)

Welcome notification * Vendor-hosted push plugins: Paid * SaaS (OneSignal etc.): Paid * WhoKnew Signal: Free

Discover all post types in UI * Vendor-hosted push plugins: No (manual) * SaaS (OneSignal etc.): Yes * WhoKnew Signal: Yes

Auto-send all post types * Vendor-hosted push plugins: No * SaaS (OneSignal etc.): Posts only * WhoKnew Signal: Yes

Price * Vendor-hosted push plugins: $50/yr+ * SaaS (OneSignal etc.): $19 – 228+/yr * WhoKnew Signal: Free / $80/yr Pro

Technical Notes

WhoKnew Signal uses the Web Push Protocol (RFC 8030), VAPID authentication (RFC 8292), and AES-128-GCM payload encryption (RFC 8291) – all implemented using PHP’s built-in OpenSSL functions. No external library, no Composer dependency.

The service worker is served via a WordPress query var (/?wkspn_sw=1) intercepted at init priority 1 with a Service-Worker-Allowed: / header, giving it origin-wide scope without placing any file in your web root. Compatible with all hosting environments including managed WordPress hosts.

Requirements

• WordPress 5.8 or higher
• PHP 7.4 or higher with OpenSSL extension
• HTTPS (SSL) – required by all browsers for Web Push

Privacy & Data

What WhoKnew Signal stores

WhoKnew Signal stores the following data only in your own WordPress database — nothing is ever sent to WhoKnew or any third-party server:

• Push subscription endpoint — an opaque URL generated by the visitor’s browser and their browser’s push delivery service (Google, Mozilla, or Apple). It cannot be traced back to an individual without access to their device.
• Browser name — e.g. Chrome, Firefox, Safari (detected from the user agent at subscription time).
• Platform — e.g. Windows, macOS, Android, iOS (detected from the user agent at subscription time).
• Subscription timestamp — the date and time the visitor subscribed.
• WordPress user ID (optional) — when the visitor is logged in, the subscription may be linked to their existing WordPress account on your site so account-related notifications (e.g. order updates with Pro) can reach that browser. The plugin does not store their name or email; it uses an account reference your site already has.
• Fail count and status — internal delivery health tracking.
• Click events (Pro) — click timestamps tied to the subscription endpoint for analytics and smart segments, not a separate marketing profile.

What WhoKnew Signal does NOT store

• No name or email address collected by this plugin for push subscriptions.
• No IP address stored for push subscriptions.
• No separate browsing history or off-site behavioral tracking.
• No subscriber push data transmitted to WhoKnew or any external analytics service.

Cookies and local storage

WhoKnew Signal sets one cookie and one localStorage key on the visitor’s browser:

• wkspn_dismissed (cookie, expires after 30 days by default) — remembers that the visitor dismissed or responded to the push notification permission prompt, so it does not reappear on every page load. This is strictly necessary for the plugin to function correctly.
• wkspn_subscribed (localStorage) — remembers the visitor’s subscription state across page loads and cache clears so subscribed visitors are never shown the prompt again. This is strictly necessary for the plugin to function correctly.

Neither item contains personal data. Both are classified as strictly necessary by all major GDPR cookie consent plugins. WhoKnew Signal automatically registers these with Complianz, CookieYes, Cookiebot, Cookie Notice by dFactory, and GDPR Cookie Consent by WebToffee — they will never be blocked by a « necessary cookies only » consent choice.

Site owner responsibilities

As the operator of your WordPress site, you are the data controller for any subscriber data collected. You should disclose WhoKnew Signal’s data collection in your site’s privacy policy. The following paragraph may be copied and adapted (the same text appears in Settings):

This site uses WhoKnew Signal(TM) to deliver web push notifications. When you choose to subscribe, your browser generates a unique, opaque subscription token (a push endpoint URL) stored only in our database on this server. No third party receives or processes that token. We also record browser type, device platform (e.g. Windows, macOS, Android, iOS), and the date you subscribed. This plugin does not collect your name, email address, or IP address for push subscriptions. If you are logged in when you subscribe, we may link that browser token to your existing WordPress account on this site so account-related notifications (such as order updates) can reach this device. That uses an account reference your site already holds; the plugin does not gather additional identity information. Your subscription data is never sold or shared with external parties for marketing.

Your subscription is voluntary and based on consent through your browser permission prompt. You may withdraw consent at any time by removing notification permissions for this site in your browser settings (locate [your site URL]). Logging out on this browser removes the link between the subscription and your WordPress account on this device; revoking browser notification permission stops delivery. For subscriptions that were never linked to an account, we cannot match push records to you by name or email alone. Withdrawal does not affect the lawfulness of notifications sent before you withdrew.

External services

Push delivery uses the Web Push protocol (VAPID). When you send a notification, your WordPress server contacts each subscriber’s browser push endpoint. Depending on the browser, that endpoint may be operated by:

• Google Firebase Cloud Messaging (FCM) — Chrome, Edge, and most Android browsers. Terms: https://firebase.google.com/terms/ — Privacy: https://firebase.google.com/support/privacy
• Mozilla autopush — Firefox. Privacy: https://www.mozilla.org/privacy/
• Apple Push Notification service — Safari and iOS PWA subscribers. Privacy: https://www.apple.com/legal/privacy/

WhoKnew Signal does not require you to create accounts with these providers. Your subscriber list stays in your WordPress database; only the encrypted notification payload and endpoint URL are transmitted at send time.

WhoKnew Terms and Privacy Policy

WhoKnew Signal is published by WhoKnew. Use of WhoKnew websites, Pro licenses, support, and related services is governed by:

• Terms of Service: https://whoknew.io/terms/
• Privacy Policy: https://whoknew.io/privacy/

Purchasing or activating WhoKnew Signal Pro requires agreement to these terms. The free plugin does not send subscriber push data to WhoKnew; see the sections above for what is stored on your server and what site owners should disclose to their visitors.