WP Lead Sync

A custom WordPress plugin that captures lead/enquiry submissions, stores them within WordPress, and synchronises the data with an external API endpoint.

---

Overview

WP Lead Sync demonstrates:

• ✅ Custom Post Type (CPT) usage for storing leads
• ✅ Secure form handling with nonce verification
• ✅ Input sanitisation and output escaping
• ✅ External API communication using the WordPress HTTP API
• ✅ Admin interface for monitoring sync status and view leads
• ✅ Configurable API endpoint via settings

---

Installation

1. Clone or download this repository.
2. Place the wp-lead-sync folder inside:
   wp-content/plugins/
3. Log in to the WordPress Admin panel.
4. Navigate to Plugins → Installed Plugins.
5. Activate WP Lead Sync.

---

Usage

Display the Lead Form

Add the following shortcode to any page or post: [lead_form] This will render a simple enquiry form containing:

• Name
• Email
• Message

---

How It Works

When a user submits the form:

1. The request is validated and protected using a WordPress nonce.
2. All inputs are sanitised using WordPress sanitisation functions.
3. A new lead_submission custom post is created.
4. Email, message, and sync status are saved as post meta.
5. The plugin attempts to send the lead data to the configured external API endpoint.
6. The API response and sync status are stored for review.

---

Viewing Leads

In the WordPress admin panel:

• Navigate to Lead Sync → Lead Sync Status
• View all captured leads
• Click View to see full lead details and sync status

---

API Synchronisation

By default, the plugin sends a POST request to:
https://jsonplaceholder.typicode.com/posts

This endpoint can be modified via:
Lead Sync → Settings

Example JSON Payload

json { "name": "John Doe", "email": "john@example.com", "message": "Example enquiry message" }

What the Plugin Stores

• Sync status: pending, success, failed, or skipped
• Raw API response for debugging

---

Testing the API Integration

For testing purposes, you may use a request inspection service such as https://webhook.site.

1. Visit the website.
2. You will see a unique URL generated, e.g.:
   https://webhook.site/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
3. Copy that URL and paste it into the plugin’s API Endpoint setting.
4. Submit the form and you will see the JSON payload and headers received by the endpoint.

---

Security Considerations

• Nonce verification protects against CSRF attacks
• All inputs are sanitised before storage
• All admin outputs are properly escaped
• The Custom Post Type is non-public and not accessible on the frontend
• API endpoint URL is sanitised before being saved

---

Assumptions & Trade-offs

• Leads are stored as a Custom Post Type rather than a custom database table for simplicity and maintainability.
• API synchronisation occurs immediately during submission instead of being processed asynchronously.
• A retry mechanism for failed API requests is not implemented in this version.
• Advanced spam prevention (e.g., CAPTCHA) is not included.

---

Potential Improvements

With additional time, the following enhancements could be implemented:

• Asynchronous API syncing using WP-Cron or background processing
• Retry mechanism for failed sync attempts
• Enhanced logging interface
• Spam protection and rate limiting
• REST API endpoint for headless integration
• Unit and integration tests

---

Author

Muti