=== Leadite ===
Contributors: akava
Tags: contact form, lead management, form submissions, leads, crm
Requires at least: 6.2
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 0.3.10
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html
Donate link: https://buymeacoffee.com/akava

Save every contact form submission in one inbox. Organize, search and export leads from CF7, Elementor, WPForms, Gravity, Ninja & Fluent.

== Description ==

Every time someone fills in a form on your WordPress site, **Leadite** saves that submission as a lead you can actually work with — instead of losing it in your email inbox. It collects contact form submissions from Contact Form 7, Elementor Pro Forms, WPForms, Ninja Forms, Gravity Forms and Fluent Forms into one place, so you have a single, searchable list of everyone who ever contacted you.

Think of it as a simple, self-hosted CRM for your form leads: one inbox, one export, one dashboard — no matter which form plugin your visitors used, and no monthly subscription.

Your leads never leave your website — everything is stored in your own WordPress database, not on someone else's servers. No third-party account required to get started.

= Key features =

**Unified inbox**
* All leads from all forms in one searchable, sortable, filterable table
* List view and Kanban board (drag-and-drop by status)
* Bulk actions: mark read / unread / spam / closed, delete, star / unstar
* Full-text search across all submitted field values
* Filter by source, form, status, date range, starred flag, and tag (Pro)

**Single lead view**
* All submitted field values in a clean key-value table
* Metadata sidebar: source, form, IP, referer, page URL, browser, language, UTM/gclid attribution
* Status selector with direct AJAX update
* Starred toggle
* Assign to team member (Pro)
* Internal notes and chronological timeline (Pro)
* Private attachments — gated download with audit log entry per download
* Quick actions: Reply by Email, WhatsApp

**Dashboard**
* KPI cards: total leads, today, this week, unread, week-over-week growth
* SVG area chart: leads over time (30 days)
* Donut chart: leads by status
* Top active forms leaderboard
* Recent submissions table

**Export**
* CSV (UTF-8 BOM, Excel-compatible, formula injection protection)
* XLSX (native PhpSpreadsheet, auto-sized columns)
* JSON (structured, UTF-8)
* XML (well-formed, control characters stripped)

All formats include canonical columns (name, email, phone), every submitted field, UTM data, and metadata.

**Integrations**
* Google Sheets — POST to any Apps Script / webhook URL
* Outbound Webhook — structured `lead.created` JSON payload (Make, Zapier, n8n, custom CRM)
* Telegram — almost instant HTML notification with direct admin link

All outbound HTTP requests are non-blocking (fire-and-forget) and SSRF-guarded.

**Privacy and security**
* Custom capability `manage_leads` — granted to administrators on activation; grantable to any role
* Nonces on every form, AJAX action, and download link
* All queries via `$wpdb->prepare()` — no raw interpolation
* Attachments stored behind deny-all `.htaccess` and `web.config`; served only through a signed AJAX endpoint with path-traversal guard
* GDPR-ready: integrates with the WordPress personal-data tools — export or erase all leads for a given e-mail address via Tools → Export / Erase Personal Data; suggests Privacy Policy text
* Data retention (auto-purge): optionally delete leads older than N days on a daily schedule — full cascade including attachments; "Closed & Spam only" safety mode
* IP anonymisation setting (last octet / last 80 bits zeroed) — configurable in Settings → General, enabled by default
* SSRF guard: HTTPS-only, resolves all A + AAAA records, blocks all RFC 1918 / loopback / link-local / carrier-grade NAT ranges
* Deduplication: identical lead within 5 minutes is silently dropped

**Migration / import**
One-click import from Flamingo, CFDB7, Elementor Pro built-in submissions, Contact Form DB — Elementor, and Fluent Forms.

**White-label (agency)**
Lock brand name and icon via `wp-config.php` constant `Leadite_BRAND`. (Pro feature)

= Pro features =

Leadite Pro adds starred leads, lead assignment, internal notes, activity timeline, tag management, tag filtering, white-label branding, field mapper overrides, and a WP-CLI command family (`wp leadite list / export / stats / purge / delete`) for terminal and automation workflows.

= Who is Leadite for? =

If people contact you through a form on your WordPress site, Leadite is for you:

* **Small businesses & freelancers** who want every enquiry in one place instead of buried in email.
* **Local businesses** collecting quote requests, bookings and callback forms.
* **Agencies** managing contact form submissions across client sites.
* **Anyone** who needs a simple, free CRM for WordPress contact form leads — without paying for a monthly SaaS.

= Why choose Leadite over email notifications? =

Email notifications get lost, buried and forgotten. Leadite turns each form submission into a trackable lead with a clear status, so nothing slips through the cracks. You get a searchable history of everyone who ever contacted you, one-click export for your records, and a simple pipeline from New to Closed — all inside your own WordPress dashboard, with your data staying on your own server.

== Installation ==

1. Upload the plugin zip via **Plugins → Add New → Upload Plugin** and activate.
2. The **Leadite** menu appears in the WordPress sidebar.
3. Submit any form on the front end — the lead appears in the inbox immediately.

No configuration required for basic lead capture. Google Sheets, Telegram, and webhook integrations are opt-in from **Leadite → Settings**.

= Requirements =

* WordPress 6.2 or higher
* PHP 7.4 or higher
* MySQL 5.7 / MariaDB 10.2 or higher

== External Services ==

Leadite connects to third-party services **only when the admin explicitly enables each integration** in Leadite → Settings. No data is sent by default on activation.

**Freemius (licensing & updates).** Leadite uses the Freemius SDK to power the optional Pro upgrade: license activation, secure checkout and Pro updates. On first activation you are shown an explicit opt-in screen; if you skip it, nothing is sent to Freemius and the plugin keeps working normally. When you opt in or activate a Pro license, Freemius receives basic site data (site URL, WordPress and plugin versions, admin e-mail) needed to provide the service. See the [Freemius Terms of Use](https://freemius.com/terms/) and [Privacy Policy](https://freemius.com/privacy/).

= Google Sheets (opt-in) =

**When:** Immediately after a new lead is stored, if Google Sheets integration is enabled.
**What is sent:** All submitted form field values (name, email, phone, message, etc.), form name, source plugin identifier, lead creation timestamp.
**Sent to:** The Google Apps Script web app URL that the admin enters in Leadite → Settings → Google Sheets. This is a URL you deploy and control; it is not a Google-owned endpoint. The script itself may write data to your Google Sheet via the Google Sheets API.
**Service:** Google Workspace / Google Apps Script. Privacy policy: https://policies.google.com/privacy
**Admin control:** Can be disabled at any time in Leadite → Settings → Google Sheets.

= Telegram (opt-in) =

**When:** Immediately after a new lead is stored, if Telegram notifications are enabled.
**What is sent:** A formatted text message containing the submitted field values (name, email, phone, message, etc.), form name, source plugin, and a link to the lead in your WordPress admin panel. No passwords or sensitive credentials are transmitted as field values.
**Sent to:** The Telegram Bot API (api.telegram.org) using the bot token you provide. The message is delivered to the Telegram chat ID you configure.
**Service:** Telegram. Privacy policy: https://telegram.org/privacy
**Admin control:** Can be disabled at any time in Leadite → Settings → Pro → Telegram.

= Outbound Webhook (opt-in) =

**When:** Immediately after a new lead is stored, if a webhook URL is configured.
**What is sent:** A structured JSON payload (`lead.created` event) containing all submitted field values, form name, source plugin identifier, lead ID, and creation timestamp.
**Sent to:** The HTTPS URL entered by the admin (e.g., a Make/Zapier/n8n scenario, or a custom CRM endpoint). Leadite validates that the URL is HTTPS and does not point to private/internal IP ranges (SSRF guard).
**Service:** The third-party service of your choice (Make, Zapier, n8n, custom endpoint).
**Admin control:** Can be disabled at any time by clearing the Webhook URL in Leadite → Settings → Webhook.

= What Leadite does NOT do =

* Leadite does not connect to any external service by default.
* Leadite does not send data to the plugin author's servers.
* Leadite itself does not use any analytics, tracking pixels, or telemetry, and never sends your leads or form data anywhere.
* The bundled Freemius SDK (licensing and updates for the optional Pro version) connects to freemius.com only after an explicit opt-in on the activation screen or a license activation. Skipping the opt-in keeps the plugin fully functional.
* All lead data is stored exclusively in your WordPress database.

== Privacy Policy ==

Leadite itself does not collect, store, or transmit any data outside your WordPress installation, except through the explicitly opt-in integrations described in the **External Services** section above.

**Data stored locally:**

* Submitted form field values (name, email, phone, message, and any other fields your forms collect)
* IP address of the form submitter (anonymized by default — last octet zeroed for IPv4, last 80 bits zeroed for IPv6)
* Browser user-agent string
* Referring URL and page URL
* UTM campaign parameters (if present in the page URL)
* Language code of the page

**Who can access this data:**

Only WordPress users with the `manage_leads` capability (granted to Administrators by default). The capability can be granted to other roles by the site administrator.

**Data deletion:**

If **Delete all Leadite data on uninstall** is enabled in Settings → General, all lead data, notes, audit logs, and settings are permanently removed when the plugin is deleted. Individual leads can also be deleted from the leads list.

**For GDPR compliance:**

* Enable IP anonymization in Settings → General (on by default for new installations).
* Enable the uninstall cleanup option if you want a clean removal.
* Use the **Anonymize existing stored IPs** button to retroactively anonymize IP addresses stored before the setting was enabled.



== Frequently Asked Questions ==

= Is Leadite free? =

Yes. The version on WordPress.org is free and fully functional: it captures submissions from all supported form plugins, gives you the unified inbox, Kanban board, search, filtering and export to CSV, XLSX, JSON and XML. An optional Pro version adds team features (assignments, notes, tags), automation and integrations.

= How do I save Contact Form 7 submissions to the database? =

Install Leadite and activate it alongside Contact Form 7. From that moment, every CF7 submission is automatically saved as a lead in the Leadite inbox — no configuration and no changes to your existing forms. The same applies to Elementor, WPForms, Ninja Forms, Gravity Forms and Fluent Forms.

= Does Leadite replace my form plugin? =

No. Leadite is a passive collector that hooks into your existing form plugin's submission event. It does not add any forms to your site; it only stores and displays the data that your form plugin already collects.

= Will it work if I use multiple form plugins at the same time? =

Yes. Leadite handles all six supported form plugins simultaneously. Each lead shows its source plugin in the source column.

= Where are attachments stored? =

Attachments are copied into a private `uploads/Leadite/` directory protected by deny-all `.htaccess` (Apache) and `web.config` (IIS). They are never accessible via direct URL; all downloads are gated through a signed admin endpoint.

= Does Leadite log GDPR-relevant actions? =

Yes. Every file download is logged with the user ID and timestamp. Status changes, assignments, and notes are recorded in the activity timeline (Pro).

= Can I delete all data when uninstalling? =

Yes. Enable "Delete all Leadite data on uninstall" in Settings → General. When checked, all tables, options, transients, user meta, capabilities, and physical files are removed when you delete the plugin from the Plugins page.

= How does IP anonymisation work? =

When enabled (default: on), the last octet of IPv4 addresses is zeroed (e.g. `203.0.113.42` → `203.0.113.0`), and the last 80 bits of IPv6 addresses are zeroed. The full IP is used only during the current request for deduplication purposes and is never stored.

= Can I anonymise IP addresses in existing lead records? =

Yes. Go to Settings → General → scroll to the "Data Privacy" section and click "Anonymize stored IP addresses". A batch process will zero out stored IPs for all existing leads. This action is irreversible.

== Screenshots ==

1. Leads inbox — list view with filters, bulk actions, and quick-status selector
2. Leads inbox — Kanban board view with drag-and-drop
3. Single lead detail — field values, metadata sidebar, and status control
4. Dashboard — KPI cards, lead volume chart, and status donut chart
5. Settings — General, Google Sheets, Telegram, Webhook, Field Mapper, Attachments tabs

== Changelog ==

= 0.3.10 =
* Polished JSON export output and tightened output escaping across all export formats.
* Small stability and compatibility improvements.

= 0.3.0 =
* Added a read-only Field Mapper screen so you can see exactly how every form field is detected.
* Added GDPR tools: export or erase a person's leads by e-mail from Tools → Export / Erase Personal Data.
* Added Data Retention: optionally auto-delete leads older than a number of days you choose.
* Added a quick-guide popup and handy links in the admin footer.
* Refreshed the admin interface and menu icon.

= 0.2.0 =
* Added the Kanban board view with drag-and-drop by status.
* Added an overdue-leads badge in the admin menu.
* Broadened compatibility (WordPress 6.2+) and hardened database and file handling.
* Speed and reliability improvements across the inbox.

= 0.1.0 =
* First public release.
* Collects submissions from Contact Form 7, Elementor Pro Forms, WPForms, Ninja Forms, Gravity Forms and Fluent Forms into one unified inbox.
* Statuses, starring, full-text search and filtering by source, form, date and more.
* Single lead view with all fields, metadata and quick Reply-by-Email / WhatsApp actions.
* Export leads to CSV, XLSX, JSON and XML.
* Dashboard with KPI cards and charts.
* One-click import from Flamingo, CFDB7, Elementor and Fluent Forms.
* Private, gated attachment storage and configurable IP anonymisation.

== Upgrade Notice ==

= 0.3.10 =
Recommended for all users: refined exports and general polish.