Skip to main content

Wow, Handshakable Downloads!

You are just one handshake away!
Latest Version
0.2.5
Requires
Joomla 5+, PHP 8.1 or newer
Release date
14 October 2026
Made for
Joomla
License
GPL-2.0-or-later
Price

Demo page
Require visitors to accept your terms and conditions before they download a file in Joomla. Terms in six languages and download counts per file.

What's new in version 0.2.5

  • Security: Only known file types are served (documents, archives, images, audio, video, some design and 3D formats); .sql, .bak and other types are refused
  • Changed: The Dashboard status is measured: it shows whether Joomla runs the plugin and whether the builder element was registered
  • Fixed: A shortcode inside a text area, such as the frontend article editor, is no longer replaced; saving the article keeps the shortcode
Comingsoon

    Description

    Put your terms and conditions in front of every download with Wow, Handshakable Downloads! Visitors accept them in a popup before they can open a file, and the acceptance is checked on the server before the download link works.

    Display download lists or buttons, customize terms per language or per element, and choose whether consent lasts for a session or is required before every download. Easy to use, multilingual and built for YOOtheme Pro.

    Feature request

    What is the next feature for this plugin?

    Submit your idea or vote on existing ones.

      Changelog

      v0.2.5
      Changed
      • The status on the Dashboard tab is now measured. It shows whether Joomla
      Fixed
      • A {yc_handshake} shortcode inside a text area, such as the article editor
      Security
      • The plugin only serves known file types: documents, archives, images,
      v0.2.4
      Changed
      • Rate limiting counts per visitor session, with a ceiling per hour for the
      • The plugin description in Extensions no longer says "server-side
      Fixed
      • A visitor with a new or expired session gets the "session expired"
      Security
      • Files in a folder that an .htaccess closes are no longer served. Before
      • Consent is stored per set of terms. Accepting the terms of one element no
      • Download tickets are bound to the visitor session and work once.
      v0.2.3
      Changed
      • Licensed under GPL-2.0-or-later. LICENSE.txt holds the full GPL text and
      • The update site is now called "Wow, Handshakable Downloads! Updates".
      • Contact address is This email address is being protected from spambots. You need JavaScript enabled to view it..
      • Builder element icons use the product colour #0F766E.
      Fixed
      • The README no longer says the file path is hidden. Files stay reachable
      • The help text of the language field under terms overrides now explains
      v0.2.2
      Fixed
      • Consent popup title no longer inherits the theme heading colour; on
      v0.2.1
      Added
      • Installer keeps the plugin ordering after plg_system_yootheme so the
      Fixed
      • Plugin and installer script class names now keep the underscores from
      • Request parameters renamed from p/s/t to hp/hs/ht: YOOtheme Pro
      • com_ajax results are now registered through AjaxEvent::addResult()
      v0.2.0
      Added
      • YOOtheme Pro builder element "Wow, Handshakable Downloads" (parent) with
      • Consent popup (terms and conditions) with checkbox gate; consent scope
      • Server-side enforcement: com_ajax endpoint with HMAC-signed payloads,
      • {yc_handshake file="..." title="..." flag="nl" size="yes" mode="each"
      • Optional file size display (localised units) and optional country
      • Download counter per file in #__yc_wow_handshakable_downloads_stats (no
      • Terms texts in six languages (en-GB, nl-NL, de-DE, fr-FR, es-ES,
      • Installer: auto-enable, defensive schema creation, media manager
      Security
      • CSRF token required on all consent/ticket writes (5.1/6.7).
      • Path validation with realpath against allowed roots, blocked
      • Timing-safe HMAC comparisons; tickets expire after 120 seconds.