FAIR

Federated and Independent Repositories

Nexus Lead Suite

Plugin Banner

Nexus Lead Suite

by Mostafij Emon

Download
Description

Nexus Lead Suite is a high-performance WordPress plugin for agencies and site owners who need lead capture, on-site engagement, and actionable analytics without slowing down the front end.

From a single admin hub you can:

  • Build and manage lead forms, popup campaigns, and automated email templates tied to visitor events.
  • Review the Activities timeline—clicks, submissions, mail status, and popup triggers—with export to PDF for reporting.
  • Configure button-class rules (popup:, mail:, notify:) and use the Visual Editor on Activities to inspect and tune front-end behavior safely.
  • Track interactions in custom database tables while keeping public scripts lightweight (vanilla JavaScript only on the front end).

The admin experience is a modern single-page app (React + Vite, shipped as compiled assets) with modular PHP under the hood for REST APIs, mail delivery, and secure data storage.

  • Modular architecture designed for performance and security.
  • Admin tools built as a modern single-page experience.
  • Public-facing scripts use vanilla JavaScript only (no front-end framework bloat).

External services

This plugin can connect to the third-party services listed below. None of them are contacted unless you explicitly enable the matching feature and enter your own credentials. With a default installation the plugin makes no outbound requests at all.

Google reCAPTCHA

When reCAPTCHA is enabled on a form, the visitor’s browser loads Google’s reCAPTCHA script and sends a response token to your WordPress site on form submit. Your server then sends that token (and your site/secret keys) to Google’s verification API to confirm the submission is not automated spam.

  • Service: Google reCAPTCHA (Google LLC)
  • Endpoints: https://www.google.com/recaptcha/
  • Data sent: reCAPTCHA response token, site key, secret key (server-side), and the visitor IP address as required by Google’s API
  • When: on page load and on form submit, only on forms where you enabled reCAPTCHA
  • Terms of Service: https://policies.google.com/terms
  • Privacy Policy: https://policies.google.com/privacy

Cloudflare Turnstile

When Turnstile is enabled on a form, the visitor’s browser loads Cloudflare’s Turnstile widget and sends a response token to your WordPress site on form submit. Your server then sends that token (and your site/secret keys) to Cloudflare’s siteverify endpoint to validate the submission.

  • Service: Cloudflare Turnstile (Cloudflare, Inc.)
  • Endpoints: https://challenges.cloudflare.com/
  • Data sent: Turnstile response token, site key, secret key (server-side), and the visitor IP address as required by Cloudflare’s API
  • When: on page load and on form submit, only on forms where you enabled Turnstile
  • Terms of Service: https://www.cloudflare.com/website-terms/
  • Privacy Policy: https://www.cloudflare.com/privacypolicy/

Google Website Translator

If you turn on the language switcher in Accessibility & Language settings, the visitor’s browser loads Google’s Website Translator widget so page text can be machine-translated. Translation is performed on Google’s servers and cannot be done locally by the plugin.

  • Service: Google Website Translator (Google LLC)
  • Endpoints: https://translate.google.com/translate_a/element.js
  • Data sent: the page text the visitor asks to translate, plus the request metadata Google’s widget collects (IP address, user agent)
  • When: only on front-end page views, and only while the language switcher setting is enabled
  • Terms of Service: https://policies.google.com/terms
  • Privacy Policy: https://policies.google.com/privacy

AI chat providers (optional AI Chatbot feature)

The AI Chatbot is disabled by default. If you enable it and choose a provider in Settings -> AI Chatbot, your server sends chat requests to that provider’s API using the API key you supply. The provider generates the reply and, where supported, the embedding vectors used to search your own site content; this processing cannot be performed locally by the plugin.

Data sent on each request: the visitor’s message, recent conversation turns, the system prompt you configured, and matching excerpts of your own published content. When training the knowledge base, the text of your published posts, pages and products is sent to the selected embedding provider. Requests are made only while the AI Chatbot is enabled and a provider and key are configured. No data is sent to any provider you have not selected.

You select exactly one chat provider (and optionally one embedding provider) from:

  • OpenAI (OpenAI, L.L.C.) – https://api.openai.com/v1 – Terms: https://openai.com/policies/terms-of-use – Privacy: https://openai.com/policies/privacy-policy
  • Anthropic Claude (Anthropic PBC) – https://api.anthropic.com/v1 – Terms: https://www.anthropic.com/legal/consumer-terms – Privacy: https://www.anthropic.com/legal/privacy
  • Google Gemini (Google LLC) – https://generativelanguage.googleapis.com/v1beta – Terms: https://ai.google.dev/gemini-api/terms – Privacy: https://policies.google.com/privacy
  • Groq (Groq, Inc.) – https://api.groq.com/openai/v1 – Terms: https://groq.com/terms-of-use – Privacy: https://groq.com/privacy-policy
  • DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.) – https://api.deepseek.com/v1 – Terms: https://cdn.deepseek.com/policies/en-US/deepseek-open-platform-terms-of-service.html – Privacy: https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html
  • Mistral AI (Mistral AI SAS) – https://api.mistral.ai/v1 – Terms: https://legal.mistral.ai/terms – Privacy: https://legal.mistral.ai/terms/privacy-policy
  • Together AI (Together Computer, Inc.) – https://api.together.xyz/v1 – Terms: https://www.together.ai/terms-of-service – Privacy: https://www.together.ai/privacy
  • OpenRouter (OpenRouter, Inc.) – https://openrouter.ai/api/v1 – Terms: https://openrouter.ai/terms – Privacy: https://openrouter.ai/privacy
  • xAI Grok (X.AI LLC) – https://api.x.ai/v1 – Terms: https://x.ai/legal/terms-of-service-enterprise – Privacy: https://x.ai/legal/privacy-policy
  • Voyage AI (Voyage AI Innovations, Inc., embeddings only) – https://api.voyageai.com/v1 – Terms: https://www.voyageai.com/tos – Privacy: https://www.voyageai.com/privacy

Alternatively you may point the AI Chatbot at a self-hosted Nexus AI Server (FastAPI + Ollama) running on infrastructure you control. In that mode the plugin sends the same data only to the base URL you enter; no third party is involved.

Google Gmail / Workspace SMTP (OAuth 2.0)

If you choose the Gmail mailer in Settings -> SMTP, the plugin sends outbound site email through Google’s servers and uses Google’s OAuth 2.0 endpoints to obtain and refresh an access token with the client ID and secret you supply.

  • Service: Google Gmail API / OAuth 2.0 (Google LLC)
  • Endpoints: https://accounts.google.com/o/oauth2/v2/auth, https://oauth2.googleapis.com/token, https://mail.google.com/
  • Data sent: your OAuth client ID and secret, authorization and refresh tokens, and the contents of the emails your site sends
  • When: only while the Gmail mailer is enabled and connected
  • Terms of Service: https://policies.google.com/terms
  • Privacy Policy: https://policies.google.com/privacy

Microsoft 365 / Outlook SMTP (OAuth 2.0)

If you choose the Outlook mailer in Settings -> SMTP, the plugin sends outbound site email through Microsoft’s servers and uses Microsoft’s OAuth 2.0 endpoints to obtain and refresh an access token with the client ID and secret you supply.

  • Service: Microsoft 365 / Outlook (Microsoft Corporation)
  • Endpoints: https://login.microsoftonline.com/common/oauth2/v2.0/authorize, https://login.microsoftonline.com/common/oauth2/v2.0/token, https://outlook.office.com/
  • Data sent: your OAuth client ID and secret, authorization and refresh tokens, and the contents of the emails your site sends
  • When: only while the Outlook mailer is enabled and connected
  • Terms of Service: https://www.microsoft.com/en-us/servicesagreement
  • Privacy Policy: https://privacy.microsoft.com/privacystatement

Your own SMTP server and webhook endpoints

Any custom SMTP host, or any CRM / webhook URL you enter in the form or global settings, is an endpoint you choose and control. The plugin POSTs the sanitized form submission payload only to URLs you have entered yourself. It is your responsibility to ensure those destinations comply with your privacy policy.

The plugin does not contact the author’s servers, does not include analytics or telemetry, and does not load fonts or flag images from third-party CDNs. Language-switcher flags use local Unicode emoji. All webfonts ship inside the plugin (assets/fonts/) under the SIL Open Font License 1.1 and are served from your own site.

Source Code

The WordPress admin single-page app is distributed as a production build:

  • assets/admin/js/main.js — JavaScript bundle (minified; built with Vite and React)
  • assets/admin/css/main.css — compiled styles (built with Vite)

The complete human-readable source (JSX components, styles, and build configuration) is shipped inside this plugin package and is sufficient to rebuild every compiled asset without any external download:

  • admin/src/ — all React/JSX components and styles
  • admin/package.json — exact build dependencies
  • admin/vite.config.js — build configuration

Public front-end scripts under public/js/ are already unminified.

The same source is also mirrored in the project’s public repository: https://github.com/Mostafijemon24/Nexus-Lead-Suite

To rebuild the admin assets from the source included in this package:

  1. cd admin (inside the extracted plugin folder)
  2. Run npm ci
  3. Build for production: npm run build
  4. Output is written to assets/admin/js/main.js and assets/admin/css/main.css (see admin/vite.config.js).

For local development with hot reload, run npm run dev and add define( 'nexulesuite_VITE_DEV', true ); to wp-config.php (see admin/class-admin-app.php).

Data removal

The optional uninstall cleanup removes custom tables (wp_nexulesuite_interactions, wp_nexulesuite_submissions), plugin options (forms, settings, SMTP, migrations, etc.), and transients whose names start with nexulesuite_. Uploaded media files are not deleted automatically.

  1. Upload the plugin files to the /wp-content/plugins/nexus-lead-suite directory, or install the plugin through the WordPress plugins screen directly.
  2. Activate the plugin through the ‘Plugins’ screen in WordPress.
  3. Use the Nexus Lead Suite menu in the admin area to configure the plugin.
Does this plugin work with any theme?

Yes. Public assets are loaded only where needed to reduce theme conflicts.

How do I remove all plugin data when uninstalling?

By default, uninstalling leaves the database tables and options in place so accidental deletes do not wipe leads.

To remove everything on uninstall:

  1. While the plugin is still active, run: wp option update nexulesuite_erase_on_uninstall 1 (or set the same option to 1 in the database), or
  2. Add to wp-config.php before deleting the plugin: define( 'nexulesuite_UNINSTALL_DELETE_DATA', true );

Then delete the plugin from the Plugins screen. On multisite, if any site has the option set to 1, all sites in the network are cleaned when the plugin is removed network-wide.

Back to top