WebberZone Link Warnings v1.2.0: Force-external class support, configurable class names and more

Automatic external link detection works well for most links. But there are situations where it doesn’t: affiliate redirects, partner subdomains, tracking URLs that resolve off-site. The plugin sees an internal-looking domain and skips the warning entirely.

WebberZone Link Warnings v1.2.0 lets you override that. I’ve also made the exclusion class names configurable, patched an open-redirect vulnerability in the redirect endpoint, and fixed several bugs that were quietly breaking redirect URLs.

Force-external class support

I’ve added two new CSS classes: wzlw-force-external and wzlw-force-external-wrapper.

Add either to a link or its wrapper element, and the plugin treats it as external, regardless of what automatic detection decides. Both class names are configurable under Settings > Advanced, so you can match an existing convention if your theme or codebase already uses a specific convention.

Configurable class names

The wzlw-no-icon and wzlw-no-icon-wrapper exclusion classes are now configurable under Settings > Advanced as well. Previously, they were hard-coded, which caused friction when they clashed with a theme or another plugin. You can now set whatever class name works for your setup.

Security: HMAC-signed redirects

The redirect endpoint now requires an HMAC signature on every URL. Unsigned or tampered URLs are rejected outright, preventing open-redirect abuse.

If you’re using the redirect warning method, signed URLs are generated automatically. Nothing to configure.

Bug fixes

Several redirect-related issues were quietly causing problems:

• Redirect URLs with HMAC signatures were broken by the double-encoding of the & separator in HTML output.
• Redundant URL encoding in get_redirect_url() produced malformed redirect URLs.
• The same-host check now normalises hostnames before comparison. Variants like EXAMPLE.COM or example.com. (trailing dot) are now correctly treated as internal.
• Excluded domains now match correctly when entered with a scheme or trailing path. For example, https://example.com/path will now exclude example.com as expected.

Upgrade notes

No database changes or settings migration in this release. Update and you’re done.

If you’re using redirect warnings, the HMAC security fix alone is worth updating for.