Review Reminders for WooCommerce

Reviews are the cheapest thing a shop can do to sell more, and most shops never ask for them. Gatemi Review Reminders asks: a message a while after the parcel arrives, with one link that lets the customer review what they bought without signing in, and a photo they can add from their phone.

Three rules govern the plugin, and each of them is a real failure of this category.

The link identifies an order, and can review nothing else. The token is an HMAC over the order id and the order's own key, signed with your site's auth salts — it cannot be minted from an order number, and rotating an order's key closes every link already emailed for it. The form offers only that order's products, and a product id posted to it is intersected with what the order actually bought. A plugin that trusts a product id in a query string is one where anybody can five-star anything.

An uploaded photo is bytes from a stranger. The type is checked against the file itself rather than the name the browser sent, so shell.php.jpg is refused; SVG is deliberately not on the allowlist, because it is a document that can carry script; the count and the size are capped where files are accepted, not merely in the form; and a photo belongs to its review, so deleting the review takes it with it.

Never ask about something they no longer have. Every reminder is judged when it is due, not when the order was marked delivered: an order refunded or cancelled in the meantime is skipped, a line refunded in full drops out, and a product the customer has already reviewed is not asked about again. "How did you get on with your purchase?" for an order you refunded last week is the worst email this kind of plugin sends.

Also

* A sequence of reminders — ask again a fortnight later, in different words * A single-use thank-you coupon when a review is approved, bound to the address that earned it * Products and categories you never ask about — gift cards, services * An unsubscribe link on every message, as a signed token rather than an address * One order is asked once per reminder: the claim is written on the order before anything is mailed, so two overlapping cron runs cannot both ask

Every license includes

• One year of updates and priority support, delivered straight to your WordPress dashboard.
• Use on 1, 5 or 25 sites depending on your license — local, staging and development sites are always free.
• 30-day money-back guarantee — full refund, no questions asked.
• Keeps working after expiry — if you choose not to renew, the plugin keeps running exactly as installed; it simply stops receiving updates and support until you do.

Requires WordPress 6.4+ · PHP 7.4+ · tested up to WordPress 7.0. Works with the classic and block checkout alike.