WP Manifestindependent plugin directory
manifest / forms / weblynx-lead-manager

WebLynx Lead Manager

A lightweight WordPress lead and inquiry manager demonstrating PHP, WordPress hooks, REST API, AJAX, security, and plugin development.

by Mharlex Perpuse · github.com/mharlexperpuse/weblynx-lead-manager · website

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/mharlexperpuse/weblynx-lead-manager/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/mharlexperpuse/weblynx-lead-manager ↗

WebLynx Lead Manager is a lightweight WordPress plugin for storing and managing website inquiries inside the WordPress admin area.

It demonstrates practical WordPress/PHP development patterns including custom post types, secure admin forms, REST API submissions, AJAX actions, validation, authorization, and extensibility hooks.

Features

  • Private Lead custom post type
  • Lead details meta box
  • Lead status workflow
  • Custom admin columns
  • AJAX "Mark as Contacted" action
  • REST API lead submission
  • Honeypot anti-spam protection
  • Basic IP-based rate limiting
  • WordPress actions and filters
  • Custom extensibility hooks
  • Secure uninstall cleanup

REST API

Endpoint:

POST /wp-json/wlfm/v1/leads

Example request:

{
  "name": "Jane Doe",
  "email": "jane@example.com",
  "phone": "+1 555 555 0199",
  "message": "I would like to discuss a new website.",
  "website": ""
}

The website field is an anti-spam honeypot and should remain empty for legitimate submissions.

A successful request returns HTTP 201.

Rate limiting

The endpoint allows up to 5 submissions from the same IP address within a 10-minute window.

This sample uses WordPress transients for simplicity. In a high-traffic production environment, the rate-limiting layer could be moved to an edge proxy, firewall, persistent cache, or dedicated anti-abuse service.

WordPress hooks

Core examples:

add_action( 'init', array( $this, 'register_lead_post_type' ) );
add_action( 'rest_api_init', array( $this, 'register_rest_routes' ) );
add_action( 'wp_ajax_wlfm_mark_contacted', array( $this, 'ajax_mark_contacted' ) );
add_filter( 'manage_wlfm_lead_posts_columns', array( $this, 'add_lead_columns' ) );

Custom extension points:

do_action( 'wlfm_lead_created', $post_id, $request );
do_action( 'wlfm_lead_marked_contacted', $lead_id );
apply_filters( 'wlfm_allowed_statuses', $statuses );

Security practices

The plugin demonstrates:

  • Nonce verification
  • AJAX nonce verification
  • Capability checks
  • Sanitization
  • Escaping
  • REST argument validation
  • Honeypot spam detection
  • IP-based rate limiting
  • Avoidance of untrusted forwarded-IP headers

Installation

  1. Copy the weblynx-lead-manager folder into /wp-content/plugins/.
  2. Activate WebLynx Lead Manager in WordPress.
  3. Open Leads in the WordPress admin menu.
  4. Create leads manually or submit them through the REST API.

Project structure

weblynx-lead-manager/
├── weblynx-lead-manager.php
├── uninstall.php
├── includes/
│   └── class-wlfm-plugin.php
├── assets/
│   ├── css/
│   │   └── admin.css
│   └── js/
│       └── admin.js
├── CHANGELOG.md
└── README.md

Development notes

This project keeps its scope intentionally small so the implementation can be reviewed quickly. The emphasis is on readable WordPress/PHP code, security-conscious request handling, and use of core WordPress APIs rather than external dependencies.

Author

Mharlex Perpuse

GitHub: https://github.com/mharlexperpuse

Portfolio: https://weblynxforge.dev