WebLynx Lead Manager

WebLynx Lead Manager is a lightweight WordPress plugin for storing and managing website inquiries inside the WordPress admin area.

It demonstrates practical WordPress/PHP development patterns including custom post types, secure admin forms, REST API submissions, AJAX actions, validation, authorization, and extensibility hooks.

Features

• Private Lead custom post type
• Lead details meta box
• Lead status workflow
• Custom admin columns
• AJAX "Mark as Contacted" action
• REST API lead submission
• Honeypot anti-spam protection
• Basic IP-based rate limiting
• WordPress actions and filters
• Custom extensibility hooks
• Secure uninstall cleanup

REST API

Endpoint:

POST /wp-json/wlfm/v1/leads

Example request:

{
  "name": "Jane Doe",
  "email": "jane@example.com",
  "phone": "+1 555 555 0199",
  "message": "I would like to discuss a new website.",
  "website": ""
}

The website field is an anti-spam honeypot and should remain empty for legitimate submissions.

A successful request returns HTTP 201.

Rate limiting

The endpoint allows up to 5 submissions from the same IP address within a 10-minute window.

This sample uses WordPress transients for simplicity. In a high-traffic production environment, the rate-limiting layer could be moved to an edge proxy, firewall, persistent cache, or dedicated anti-abuse service.

WordPress hooks

Core examples:

add_action( 'init', array( $this, 'register_lead_post_type' ) );
add_action( 'rest_api_init', array( $this, 'register_rest_routes' ) );
add_action( 'wp_ajax_wlfm_mark_contacted', array( $this, 'ajax_mark_contacted' ) );
add_filter( 'manage_wlfm_lead_posts_columns', array( $this, 'add_lead_columns' ) );

Custom extension points:

do_action( 'wlfm_lead_created', $post_id, $request );
do_action( 'wlfm_lead_marked_contacted', $lead_id );
apply_filters( 'wlfm_allowed_statuses', $statuses );

Security practices

The plugin demonstrates:

• Nonce verification
• AJAX nonce verification
• Capability checks
• Sanitization
• Escaping
• REST argument validation
• Honeypot spam detection
• IP-based rate limiting
• Avoidance of untrusted forwarded-IP headers

Installation

1. Copy the weblynx-lead-manager folder into /wp-content/plugins/.
2. Activate WebLynx Lead Manager in WordPress.
3. Open Leads in the WordPress admin menu.
4. Create leads manually or submit them through the REST API.

Project structure

weblynx-lead-manager/
├── weblynx-lead-manager.php
├── uninstall.php
├── includes/
│   └── class-wlfm-plugin.php
├── assets/
│   ├── css/
│   │   └── admin.css
│   └── js/
│       └── admin.js
├── CHANGELOG.md
└── README.md

Development notes

This project keeps its scope intentionally small so the implementation can be reviewed quickly. The emphasis is on readable WordPress/PHP code, security-conscious request handling, and use of core WordPress APIs rather than external dependencies.

Author

Mharlex Perpuse

GitHub: https://github.com/mharlexperpuse

Portfolio: https://weblynxforge.dev