Welcome email & lead magnet

One email lands in every new subscriber's inbox the moment they sign up — a warm welcome, optionally with a download link to your lead magnet attached.

The welcome email

Newsletter → Settings → Welcome Email. Three controls:

• Send welcome email — on by default. Off only if you have an external welcome flow you do not want duplicated.
• Subject — the inbox subject line.
• Body — plain text with line breaks. Saved as-is and rendered as paragraphs in the actual HTML email.

Placeholders

• {first_name} — subscriber first name (or “there” if not collected)
• {email} — subscriber email
• {site_name} — your WP site title
• {from_name} — your configured From name (Newsletter → Settings → General)

A welcome that actually gets read

The default body asks the new subscriber to reply with “hi” — which trains their email client that you're a real person and gets future issues into the primary inbox instead of Promotions. Keep that reply prompt. It is the highest-leverage line in the whole email.

The lead magnet

Optionally attach a downloadable file to the welcome email — a PDF checklist, a course pack, a zip, an ebook, anything in the supported list. Newsletter → Settings → Lead Magnet.

• Send lead magnet — toggle on.
• Display name — friendly name used in the email copy (“here is your Newsletter Starter Kit“). Renders into the {display_name} placeholder.
• File — upload. Allowed extensions: zip, pdf, epub, mp3, mp4, m4a, docx, xlsx, pptx, png, jpg, jpeg. Stored in a private folder under wp-content/uploads/otts-lead-magnets/ with a 64-character random filename and a deny-all .htaccess. Direct URL access is blocked on Apache/LiteSpeed.
• Link expiry — days a download URL stays valid. Default 365.

How delivery works

When a subscriber joins, the welcome email auto-appends:

“One more thing — here is [display_name], as promised: [signed download URL]”

The URL is signed with HMAC-SHA256 keyed by AUTH_KEY + the subscriber's email + an expiry timestamp. One email per signup — no second "here is your download" message.

Expired links auto-refresh

If a subscriber clicks an expired link, the plugin verifies the signature is still valid (proving the link came from you), looks up the email in the subscriber table, and if they are still active, generates a fresh signed URL and emails it to them automatically. Rate-limited to one regeneration per email every two minutes. Zero manual intervention.

Next: Pro plugin.