Leadite

Every time someone fills in a form on your WordPress site, Leadite saves that submission as a lead you can actually work with — instead of losing it in your email inbox. It collects contact form submissions from Contact Form 7, Elementor Pro Forms, WPForms, Ninja Forms, Gravity Forms and Fluent Forms into one place, so you have a single, searchable list of everyone who ever contacted you.

Think of it as a simple, self-hosted CRM for your form leads: one inbox, one export, one dashboard — no matter which form plugin your visitors used, and no monthly subscription.

Your leads never leave your website — everything is stored in your own WordPress database, not on someone else’s servers. No third-party account required to get started.

Key features

Unified inbox
* All leads from all forms in one searchable, sortable, filterable table
* List view and Kanban board (drag-and-drop by status)
* Bulk actions: mark read / unread / spam / closed, delete, star / unstar
* Full-text search across all submitted field values
* Filter by source, form, status, date range, starred flag, and tag (Pro)

Single lead view
* All submitted field values in a clean key-value table
* Metadata sidebar: source, form, IP, referer, page URL, browser, language, UTM/gclid attribution
* Status selector with direct AJAX update
* Starred toggle
* Assign to team member (Pro)
* Internal notes and chronological timeline (Pro)
* Private attachments — gated download with audit log entry per download
* Quick actions: Reply by Email, WhatsApp

Dashboard
* KPI cards: total leads, today, this week, unread, week-over-week growth
* SVG area chart: leads over time (30 days)
* Donut chart: leads by status
* Top active forms leaderboard
* Recent submissions table

Export
* CSV (UTF-8 BOM, Excel-compatible, formula injection protection)
* XLSX (native PhpSpreadsheet, auto-sized columns)
* JSON (structured, UTF-8)
* XML (well-formed, control characters stripped)

All formats include canonical columns (name, email, phone), every submitted field, UTM data, and metadata.

Integrations
* Google Sheets — POST to any Apps Script / webhook URL
* Outbound Webhook — structured lead.created JSON payload (Make, Zapier, n8n, custom CRM)
* Telegram — almost instant HTML notification with direct admin link

All outbound HTTP requests are non-blocking (fire-and-forget) and SSRF-guarded.

Privacy and security
* Custom capability manage_leads — granted to administrators on activation; grantable to any role
* Nonces on every form, AJAX action, and download link
* All queries via $wpdb->prepare() — no raw interpolation
* Attachments stored behind deny-all .htaccess and web.config; served only through a signed AJAX endpoint with path-traversal guard
* GDPR-ready: integrates with the WordPress personal-data tools — export or erase all leads for a given e-mail address via Tools → Export / Erase Personal Data; suggests Privacy Policy text
* Data retention (auto-purge): optionally delete leads older than N days on a daily schedule — full cascade including attachments; “Closed & Spam only” safety mode
* IP anonymisation setting (last octet / last 80 bits zeroed) — configurable in Settings → General, enabled by default
* SSRF guard: HTTPS-only, resolves all A + AAAA records, blocks all RFC 1918 / loopback / link-local / carrier-grade NAT ranges
* Deduplication: identical lead within 5 minutes is silently dropped

Migration / import
One-click import from Flamingo, CFDB7, Elementor Pro built-in submissions, Contact Form DB — Elementor, and Fluent Forms.

White-label (agency)
Lock brand name and icon via wp-config.php constant Leadite_BRAND. (Pro feature)

Pro features

Leadite Pro adds starred leads, lead assignment, internal notes, activity timeline, tag management, tag filtering, white-label branding, field mapper overrides, and a WP-CLI command family (wp leadite list / export / stats / purge / delete) for terminal and automation workflows.

Who is Leadite for?

If people contact you through a form on your WordPress site, Leadite is for you:

• Small businesses & freelancers who want every enquiry in one place instead of buried in email.
• Local businesses collecting quote requests, bookings and callback forms.
• Agencies managing contact form submissions across client sites.
• Anyone who needs a simple, free CRM for WordPress contact form leads — without paying for a monthly SaaS.

Why choose Leadite over email notifications?

Email notifications get lost, buried and forgotten. Leadite turns each form submission into a trackable lead with a clear status, so nothing slips through the cracks. You get a searchable history of everyone who ever contacted you, one-click export for your records, and a simple pipeline from New to Closed — all inside your own WordPress dashboard, with your data staying on your own server.

External Services

Leadite connects to third-party services only when the admin explicitly enables each integration in Leadite → Settings. No data is sent by default on activation.

Freemius (licensing & updates). Leadite uses the Freemius SDK to power the optional Pro upgrade: license activation, secure checkout and Pro updates. On first activation you are shown an explicit opt-in screen; if you skip it, nothing is sent to Freemius and the plugin keeps working normally. When you opt in or activate a Pro license, Freemius receives basic site data (site URL, WordPress and plugin versions, admin e-mail) needed to provide the service. See the Freemius Terms of Use and Privacy Policy.

Google Sheets (opt-in)

When: Immediately after a new lead is stored, if Google Sheets integration is enabled.
What is sent: All submitted form field values (name, email, phone, message, etc.), form name, source plugin identifier, lead creation timestamp.
Sent to: The Google Apps Script web app URL that the admin enters in Leadite → Settings → Google Sheets. This is a URL you deploy and control; it is not a Google-owned endpoint. The script itself may write data to your Google Sheet via the Google Sheets API.
Service: Google Workspace / Google Apps Script. Privacy policy: https://policies.google.com/privacy
Admin control: Can be disabled at any time in Leadite → Settings → Google Sheets.

Telegram (opt-in)

When: Immediately after a new lead is stored, if Telegram notifications are enabled.
What is sent: A formatted text message containing the submitted field values (name, email, phone, message, etc.), form name, source plugin, and a link to the lead in your WordPress admin panel. No passwords or sensitive credentials are transmitted as field values.
Sent to: The Telegram Bot API (api.telegram.org) using the bot token you provide. The message is delivered to the Telegram chat ID you configure.
Service: Telegram. Privacy policy: https://telegram.org/privacy
Admin control: Can be disabled at any time in Leadite → Settings → Pro → Telegram.

Outbound Webhook (opt-in)

When: Immediately after a new lead is stored, if a webhook URL is configured.
What is sent: A structured JSON payload (lead.created event) containing all submitted field values, form name, source plugin identifier, lead ID, and creation timestamp.
Sent to: The HTTPS URL entered by the admin (e.g., a Make/Zapier/n8n scenario, or a custom CRM endpoint). Leadite validates that the URL is HTTPS and does not point to private/internal IP ranges (SSRF guard).
Service: The third-party service of your choice (Make, Zapier, n8n, custom endpoint).
Admin control: Can be disabled at any time by clearing the Webhook URL in Leadite → Settings → Webhook.

What Leadite does NOT do

• Leadite does not connect to any external service by default.
• Leadite does not send data to the plugin author’s servers.
• Leadite itself does not use any analytics, tracking pixels, or telemetry, and never sends your leads or form data anywhere.
• The bundled Freemius SDK (licensing and updates for the optional Pro version) connects to freemius.com only after an explicit opt-in on the activation screen or a license activation. Skipping the opt-in keeps the plugin fully functional.
• All lead data is stored exclusively in your WordPress database.

Privacy Policy

Leadite itself does not collect, store, or transmit any data outside your WordPress installation, except through the explicitly opt-in integrations described in the External Services section above.

Data stored locally:

• Submitted form field values (name, email, phone, message, and any other fields your forms collect)
• IP address of the form submitter (anonymized by default — last octet zeroed for IPv4, last 80 bits zeroed for IPv6)
• Browser user-agent string
• Referring URL and page URL
• UTM campaign parameters (if present in the page URL)
• Language code of the page

Who can access this data:

Only WordPress users with the manage_leads capability (granted to Administrators by default). The capability can be granted to other roles by the site administrator.

Data deletion:

If Delete all Leadite data on uninstall is enabled in Settings → General, all lead data, notes, audit logs, and settings are permanently removed when the plugin is deleted. Individual leads can also be deleted from the leads list.

For GDPR compliance:

• Enable IP anonymization in Settings → General (on by default for new installations).
• Enable the uninstall cleanup option if you want a clean removal.
• Use the Anonymize existing stored IPs button to retroactively anonymize IP addresses stored before the setting was enabled.