Title: Deftmind Hookwright – Webhooks, REST API, Data Display & AI Chat Author: deftmindlabs Published: 04.08.2026 Last modified: 08.08.2026 --- ჩადგმების ძებნა ![](https://ps.w.org/deftmind-hookwright/assets/banner-772x250.png?rev=3633579) ![](https://ps.w.org/deftmind-hookwright/assets/icon-256x256.png?rev=3633579) # Deftmind Hookwright – Webhooks, REST API, Data Display & AI Chat ავტორი: [deftmindlabs](https://profiles.wordpress.org/deftmindlabs/) [ჩამოტვირთვა](https://downloads.wordpress.org/plugin/deftmind-hookwright.1.1.0.zip) * [დეტალები](https://ka.wordpress.org/plugins/deftmind-hookwright/#description) * [მიმოხილვა](https://ka.wordpress.org/plugins/deftmind-hookwright/#reviews) * [დაყენება](https://ka.wordpress.org/plugins/deftmind-hookwright/#installation) * [დეველოპმენტი](https://ka.wordpress.org/plugins/deftmind-hookwright/#developers) [მხარდაჭერა](https://wordpress.org/support/plugin/deftmind-hookwright/) ## აღწერა Deftmind Hookwright is the bridge between your website and the automation platform you already use. What happens on your site goes out as a webhook; what your workflow sends back is displayed on your pages. The logic stays where you built it. That is the whole idea. This plugin is not a workflow builder and does not try to be one – you already have n8n, Make, Zapier, a self-hosted tool or a script of your own, with connectors this plugin could never match. What has been missing is the piece that joins them to WordPress without a developer. **Send what happens on your site.** A visitor opening a page, clicking a button, following a link, or submitting a form – each can become a webhook to an address you choose. Rules are written in plain terms: which pages, which element. No JavaScript to write, and no analytics company in the middle taking a copy as it passes. The destination and its credentials stay on your server and never reach a visitor’s browser. **And what happens inside WordPress.** Publishing a post or page, approving a comment, someone registering – each can fire the same webhook, with no rules to write at all. A post fires the first time it is published and only the first time, so taking something back to draft and publishing it again does not send it twice. Every event says whether it came from the site or from a visitor’s browser, so one workflow can handle both. **Act on a landing page.** If a checkout sends buyers to `/thank-you/?order_id=1234`, name that parameter and your workflow receives the value directly. One rule replaces a subscription to something that only forwards events for you. **Bring the results back.** Point any workflow at the plugin’s secure endpoint. Payloads arrive into named channels and appear on any page through shortcodes, as formatted articles, data tables, or live-updating feeds. **Ask, and show the answer.** Add a form to any page. Submissions are proxied through your own server to your webhook, and the reply renders in place without a page reload. If your platform cannot answer on the connection the form opened – or the work takes minutes – callback mode hands it a one-time return URL to post the answer back to instead. **Private AI chat, without vendor lock-in.** Turn on conversation mode and a form becomes a threaded chat. Each turn sends the running conversation to your workflow, so a retrieval-augmented (RAG) pipeline can answer with context. The intelligence stays in your workflow: no API keys stored in WordPress, any model or vector database, and no third-party chat service in the middle. **Anonymous and ephemeral by design.** Visitors need no account. Nothing about a conversation is written to your database; the thread lives in the visitor’s browser and is gone on reload. For sites answering sensitive questions, that is a feature, not a limitation. **Works with the form you already have.** If your site already uses a form plugin, add a couple of data attributes to its markup and Hookwright handles the round trip without replacing anything. #### Built for safety * Inbound endpoint disabled until you set a shared secret, then verified with a timing-safe comparison. * Payload content is escaped or sanitised on every path. Markdown is parsed in safe mode and then filtered again through WordPress’s own post sanitiser. * Outbound requests use WordPress’s protected HTTP functions, which reject internal and reserved addresses. * Rate limiting, honeypot spam trapping, size caps and request timeouts on public endpoints. * Event tracking is off by default, scoped to administrator-configured path rules, checks same-origin browser requests, and requires an explicit consent signal by default. Every event is re-checked against the saved rules on the server, so the rules visible in the page source cannot be edited to send something else. #### Where data goes This plugin only contacts the URLs you configure. It sends nothing to the plugin author, contains no tracking, and makes no external requests of its own. It is not an AI product and calls no AI service of its own: any intelligence comes from the workflow you point it at. #### Privacy, and event tracking in particular Event tracking (Flow C) is off until you turn it on, and it is the one feature that can put personal data into a payload. What it does: * Events go only to the webhook URL you set. Nothing reaches the plugin author. * No cookie is set and no visitor identifier is created. Campaign attribution is kept in the visitor’s own browser for the length of their session and is never written to your database. * Form field values are never collected. The visible text of a clicked element is included, so avoid selectors that wrap text you would not want forwarded. * Nothing about an event is stored on your site. It is forwarded and forgotten. * Consent is required by default: tracking begins only once your consent tool signals it. You can turn that requirement off if your jurisdiction and what you collect allow it. The part that deserves a decision rather than a default: **a URL can carry personal data in its query string.** If a redirect lands visitors on `/thank-you/?email=someone@ example.com`, that address is part of the page URL and will be sent – and on that visitor’s next tracked click it appears again as the referrer, because the referrer is simply the page they came from. Two settings control this: a list of query parameters to capture deliberately (empty by default, so nothing is extracted unless you name it), and an option to remove query strings from both the page URL and the referrer URL. Where you can, use an order or customer reference and look the person up on the other side rather than sending an email address anywhere. **Nothing is hashed.** Whatever you choose to capture arrives at your webhook readable and stays readable in your workflow tool’s execution history. Hashing would not help: an email address can be recovered from its hash by simply trying addresses, so it would remain personal data – and it would no longer be usable for the thing you captured it for. A reference you can look up is the better answer. You are the data controller for whatever you choose to collect. Disclose it in your privacy policy and obtain consent where the law that applies to you requires it. #### Third-party code This plugin bundles Parsedown 1.7.4 by Emanuil Rusev (https://parsedown.org), used in safe mode to render Markdown. Parsedown is MIT licensed and the full licence text is reproduced in `includes/class-hookwright-markdown.php`. The class is renamed so it cannot collide with another plugin bundling its own copy; it is otherwise unmodified. #### Deftmind Hookwright Pro An optional add-on that lets your automation act on the site, rather than only feed it. Incoming payloads become real WordPress posts or pages – titles, Markdown bodies, categories, tags and featured images mapped to native fields, including custom post types and custom fields – and the reply your workflow sends back to a form can be saved the same way. It also signs outbound requests, so the receiving end can verify nothing was altered in transit. Details and download: https://deftmindlabs.com/hookwright/ Documentation: https://deftmindlabs.com/docs-reference/ ## ეკრანული სურათები [⌊Ask a question on any page. Your own workflow answers, and the reply renders in place - formatted, with no page reload.⌉⌊Ask a question on any page. Your own workflow answers, and the reply renders in place - formatted, with no page reload.⌉[ Ask a question on any page. Your own workflow answers, and the reply renders in place – formatted, with no page reload. [⌊Conversation mode turns the same form into a threaded chat. Each turn sends the running conversation to your workflow, so it can answer with context. Nothing is stored on your site.⌉⌊Conversation mode turns the same form into a threaded chat. Each turn sends the running conversation to your workflow, so it can answer with context. Nothing is stored on your site.⌉[ Conversation mode turns the same form into a threaded chat. Each turn sends the running conversation to your workflow, so it can answer with context. Nothing is stored on your site. [⌊Three ways to get the answer back: wait for it, send one way and ignore the reply, or - for a workflow that takes minutes - let it post the answer to a one-time return URL.⌉⌊Three ways to get the answer back: wait for it, send one way and ignore the reply, or - for a workflow that takes minutes - let it post the answer to a one- time return URL.⌉[ Three ways to get the answer back: wait for it, send one way and ignore the reply, or – for a workflow that takes minutes – let it post the answer to a one-time return URL. [⌊One screen connects your site to any automation platform. Your webhook address and any token stay on the server and never reach a visitor's browser.⌉⌊One screen connects your site to any automation platform. Your webhook address and any token stay on the server and never reach a visitor's browser.⌉[ One screen connects your site to any automation platform. Your webhook address and any token stay on the server and never reach a visitor’s browser. [⌊Payloads pushed in from your automation arrive in named channels, with a ready- to-copy shortcode and every displayable field detected for you.⌉⌊Payloads pushed in from your automation arrive in named channels, with a ready-to-copy shortcode and every displayable field detected for you.⌉[ Payloads pushed in from your automation arrive in named channels, with a ready-to- copy shortcode and every displayable field detected for you. [⌊Choose which pages and buttons to watch, in plain language. Matching visits and clicks go straight to your automation - no JavaScript to write, and no third-party analytics service in the middle.⌉⌊Choose which pages and buttons to watch, in plain language. Matching visits and clicks go straight to your automation - no JavaScript to write, and no third-party analytics service in the middle.⌉[ Choose which pages and buttons to watch, in plain language. Matching visits and clicks go straight to your automation – no JavaScript to write, and no third-party analytics service in the middle. ## დაყენება 1. Upload the plugin through Plugins > Add New > Upload, or install from the plugin directory. 2. Activate it. 3. Open Deftmind Hookwright in the admin menu and configure a webhook URL, an inbound secret, or both. 4. Place `[hookwright_display]` or `[hookwright_form]` on a page using a Shortcode block. ## ხდკ ### Do I need a specific automation platform? No. Anything that can send or receive an HTTP request with JSON works, whether that is a hosted automation service, a self-hosted workflow tool, or your own script. ### Does this include an AI? No, and deliberately so. Hookwright is the interface; your workflow supplies the intelligence. That means no API keys stored in WordPress and no lock-in to one AI vendor. ### Are chat conversations stored? No. The conversation exists only in the visitor’s browser for the life of the page. Nothing is written to your database and nothing is sent to the plugin author. ### Where do I get help? Use this plugin’s support forum on WordPress.org. It helps to say what you expected, what happened instead, which response handling mode the form uses, and anything listed under Recent send problems on the Settings screen. ### How do I report a security issue or a bug? Email support@deftmindlabs.com. Please report security problems privately rather than in the public forum, and allow time for a fix to ship before disclosing them. This address is for security reports and bug reports only – for help using the plugin, the support forum above is the faster route. ### My workflow takes longer than the request timeout Use Callback response handling. The plugin hands your workflow a one-time return URL in the payload; the workflow accepts the request, does its work, and posts the answer back whenever it is ready. The visitor keeps waiting on the page, and no PHP worker is held open in the meantime. ### Can I fire a webhook when someone lands on a page after checkout? Yes, and that is what the Events screen is for. Under Deftmind Hookwright > Events, add a rule with the trigger _Page loaded_ and the page URL pattern of your landing page, for example `/thank-you/`. Set your webhook URL at the top of the same screen and enable it. If the redirect carries data you need, name those parameters in **Capture query parameters**. A visitor arriving at `/thank-you/?order_id=1234` then produces a payload containing `"query": { "order_id": "1234" }`, which your workflow can act on directly. Prefer an order or customer reference over an email address or a name. A reference means the personal data stays where it already lives and your workflow looks it up; putting an email address in a URL writes it into your server logs, the visitor’s browser history, and your workflow tool’s execution logs. If you do capture one, tick the option to remove the query string from the page URL so it is sent once rather than twice, and make sure your privacy policy says so. ### I updated the plugin and something looks wrong Clear your caching plugin and any CDN cache, then reload with a hard refresh (Ctrl +Shift+R or Cmd+Shift+R). Page caches often keep serving old HTML and old JavaScript after an update. ### My payload shows as a table instead of formatted text Set the default under Deftmind Hookwright > Settings, choose a mode on the form, or add the attribute directly, for example `[hookwright_display render="markdown"]`. The shortcode attribute always wins. In auto mode the plugin renders an article when it recognises a text field in the payload and a table otherwise. ### Does it work with my automation platform? Yes. Payload shapes are normalised rather than assumed: wrapper objects such as `{" data":{...}}` are unwrapped, key names are matched loosely so `postTitle` and `post_title` both work, and category or tag lists are accepted as arrays, JSON-encoded strings, arrays of objects, or plain delimited text. ### My shortcode shows “No data yet” The channel name in the shortcode must match the channel your webhook sends exactly. Check Deftmind Hookwright > Channels for the names actually received, then clear your page cache. ### Payload HTML shows as plain text That is intentional. Raw HTML in a payload is escaped rather than rendered, because payload content is treated as untrusted. Send Markdown instead. ## მიმოხილვები There are no reviews for this plugin. ## მონაწილეები & დეველოპერები “Deftmind Hookwright – Webhooks, REST API, Data Display & AI Chat” ღია პროგრამული უზრუნველყოფაა. შემდეგმა ადამიანებმა წვილი შეიტანეს მის განვითარებაში. მონაწილეები * [ deftmindlabs ](https://profiles.wordpress.org/deftmindlabs/) [გადათარგმნეთ Deftmind Hookwright – Webhooks, REST API, Data Display & AI Chat თქვენს ენაზე.](https://translate.wordpress.org/projects/wp-plugins/deftmind-hookwright) ### დაინტერესებული ხართ დეველოპმენტით? [დაათვალიერეთ კოდი](https://plugins.trac.wordpress.org/browser/deftmind-hookwright/), შეამოწმეთ [SVN რეპო](https://plugins.svn.wordpress.org/deftmind-hookwright/), ან გამოიწერეთ [შექმნის ჟურნალი](https://plugins.trac.wordpress.org/log/deftmind-hookwright/): [RSS](https://plugins.trac.wordpress.org/log/deftmind-hookwright/?limit=100&mode=stop_on_copy&format=rss). ## ცვლილებები #### 1.1.0 **Events – send what happens on your site to your automation** * **New: website events.** Page loads, clicks on a button or link, and followed links can each fire a webhook. Rules are written in plain terms – which pages, which element – so no JavaScript is involved. Off until you enable it, scoped to the paths you name, and requiring a consent signal by default. * **New: WordPress events.** Publishing a post or page, approving a comment, or someone registering can fire the same webhook, with no rules to write. Every event carries a `source` of `browser` or `wordpress`, so one workflow can handle both. * A post fires the **first time it is published and only the first time**. Taking it back to draft and publishing again does not send it twice, an import does not fire one webhook per imported item, autosaves and revisions are ignored, and password-protected posts are never sent. Comments are sent once when approved, whether immediately or later from moderation. Spam is never sent. * The payload says _what_ happened – id, type, title, link, author, date, categories, tags and a short excerpt. It deliberately does not carry the full post body; a workflow that needs the content can read it from the REST API. * **Capture named query parameters** from a landing URL, so a checkout redirecting to `/thank-you/?order_id=1234` can drive a workflow directly. Empty by default: nothing is extracted unless you name it, and an option removes query strings from the page and referrer URLs entirely. * **Email addresses are off by default** in comment and registration events, behind one explicit setting. **Cost controls** * Every submission can cost you money at the other end, and nothing showed how many you were having. Settings gains a per-form daily submission cap, a per-conversation message cap, and a usage table showing today’s and this month’s figures per form. All caps default to none. * Over its cap, a form tells the visitor it is unavailable today and shows your usual fallback message. Nothing is sent onward, so a breach costs nothing. * The largest inbound payload accepted is now a setting rather than a fixed number, defaulting to the same 256 KB as before. **Waiting, and giving up on waiting** * The request timeout can be set as high as 60 seconds, up from 30. The default is unchanged at 8. If your host stops PHP first, the settings screen warns you before a visitor finds out. * Added a **Stop waiting** control to forms and chat, so a visitor gets their form back instead of watching a spinner. It stops the page waiting; it cannot recall a request already sent. * After 30 seconds the waiting message says the reply is taking longer than usual, so a slow workflow reads as progress rather than as something that has quietly failed. **Fixes** * **Messages from the Settings screen were never displayed.** A rejected webhook URL vanished silently, and an inbound secret under 16 characters was refused while the previous one was quietly kept – so you could update your workflow to match a secret this site never stored, and inbound would fail with no explanation anywhere. * **Rate limiting counted every visitor as one** behind a reverse proxy or CDN, since they all arrive from the same address. A new Server environment setting reads the real address from your proxy’s headers. Off by default. * Long unbroken strings – URLs, REST paths, shortcodes – no longer force a horizontal scrollbar across a chat thread or a reply. * Uninstalling now removes the markers written against posts and comments, and per-user notice dismissals. **For developers** * New `hookwright:rendered` JavaScript event, fired on `document` once a reply has rendered, carrying the content element, the export menu, the reply data and the mode. Add-ons extending a reply now have a supported way in instead of searching the page for one. `hookwright:response` is unchanged and still fires on the form with the raw data. * New `hookwright_delivery` action after every outbound request, for add-ons keeping a delivery history. This plugin stores nothing itself. * Both documented in HOOK-API.md. #### 1.0.0 * First public release. * Two-way connection to any automation platform: a form sends a visitor’s question to your workflow and renders the reply in place, and an authenticated endpoint receives payloads for display. * Three ways to receive a reply – wait for it, send one way, or Callback, where a workflow that cannot answer on the open connection posts its answer to a one- time return URL instead. Suits platforms that cannot respond to an incoming webhook, and workflows that run for minutes. * Conversation mode turns a form into a threaded chat, sending the running conversation to your workflow each turn. Nothing is stored on the site. * Incoming payloads arrive in named channels and display through shortcodes as articles, tables or live-updating feeds. * Bridge mode adds the same round trip to a form you already have, using data attributes on your own markup. * Secure by default: the inbound endpoint stays closed until a secret of at least 16 characters is set, outbound URLs are checked against private and reserved ranges, all rendered content is escaped or sanitised, and the plugin contacts nothing but the addresses you configure. ## მეტა * Version **1.1.0** * Last updated **5 საათის წინ** * Active installations **10-ზე ნაკლები** * WordPress version ** 6.0, ან უფრო მაღალი ** * Tested up to **7.0.3** * PHP version ** 7.4, ან უფრო მაღალი ** * Language * [English (US)](https://wordpress.org/plugins/deftmind-hookwright/) * Tags * [AI](https://ka.wordpress.org/plugins/tags/ai/)[automation](https://ka.wordpress.org/plugins/tags/automation/) [chat](https://ka.wordpress.org/plugins/tags/chat/)[rest-api](https://ka.wordpress.org/plugins/tags/rest-api/) [webhook](https://ka.wordpress.org/plugins/tags/webhook/) * [დამატებითი ხედი](https://ka.wordpress.org/plugins/deftmind-hookwright/advanced/) ## რეიტინგები No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/deftmind-hookwright/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/deftmind-hookwright/reviews/) ## მონაწილეები * [ deftmindlabs ](https://profiles.wordpress.org/deftmindlabs/) ## მხარდაჭერა გაქვთ კომენტარი? გჭირდებათ დახმარება? [მხარდაჭერის ფორუმის ნახვა](https://wordpress.org/support/plugin/deftmind-hookwright/) ## შემოწირულობა გსურთ ამ ჩადგმის განვითარების მხარდაჭერა? [ შეწირეთ თანხა ამ ჩადგმას ](https://selar.com/showlove/deftmindlabs)