Rewind Form Bridge for Brevo

Two jobs, both done properly.

Brevo SMTP, without a second plugin. Point wp_mail() at Brevo and your
site’s email — order receipts, password resets, form notifications — leaves
through an account that is actually allowed to send it, instead of your host’s
unauthenticated mail(). Choose the Brevo API over HTTPS (works on hosts that
block outbound SMTP ports) or the classic Brevo SMTP relay. Off until you
switch it on, so installing this plugin never silently reroutes your mail.

Every form submission becomes a Brevo contact. Brevo’s own plugin only
syncs contacts from Brevo’s own sign-up forms — anything a visitor types into
WPForms, Formidable, Contact Form 7 or Forminator never reaches your lists.
Map a form to a Brevo list once, and from then on every submission is added
automatically, with the right values in the right contact attributes, a record
of the consent the visitor gave, and a log entry you can open when something
looks wrong.

Disclaimer: Rewind Form Bridge for Brevo is an independent, third-party plugin.
It is not affiliated with, endorsed by, or an official partner of Brevo
(Sendinblue SAS). “Brevo” and “Sendinblue” are trademarks of their respective
owner. This plugin simply connects to the publicly documented Brevo API using
an API key you create in your own Brevo account.

What it does

• Brevo SMTP or Brevo API for site email. One toggle, a sender address,
  and wp_mail() goes out through Brevo. Delivery failures are recorded and
  shown on the dashboard instead of vanishing. Optional and off by default.
• Maps any field to any attribute. Pick a form field, pick a Brevo contact
  attribute, done. No paywall on the mapping UI.
• Type coercion that stops silent data loss. Brevo accepts a request whose
  value does not match the attribute’s declared type — and then quietly drops
  the value. No error, no warning, an empty field. This plugin validates and
  converts every value against the attribute’s real type before sending, so a
  date lands as a date and a number lands as a number.
• Phone numbers normalised to E.164. Brevo rejects or mis-stores a bare
  local number. Set a default country and local numbers are converted to the
  international form Brevo expects.
• Consent capture, on by default. A feed will not send anything unless a
  consent checkbox is mapped and ticked. You can switch that off per feed, and
  the screen tells you plainly what you are switching off.
• A real delivery log. Every submission gets a row: status, HTTP code,
  Brevo’s error code translated into a sentence a human can act on, and the
  exact request and response bodies. Retry a failed delivery from the log.
• Failure alerts. After a run of consecutive failures, an email goes out so
  a revoked API key does not silently swallow a month of sign-ups.
• Never calls the API behind your back. No request is made on activation,
  on admin page loads, or before you save a key. Lists and attributes are
  cached and refreshed only when you ask.

Supported form plugins

• WPForms (Lite and Pro)
• Formidable Forms (Lite and Pro)
• Contact Form 7
• Forminator

Each integration is written against that plugin’s own submission hook, so
composite fields are handled properly: a WPForms, Formidable or Forminator
Name field exposes its first, middle and last parts as separate mappable
values, and Address fields expose street, city, state, postal code and
country. The adapter layer is public — additional form plugins can be added by
filtering rbfb_adapters.

Your API key

Brevo API keys are account-wide — Brevo does not offer scoped keys. The key is
stored in the options table, shown in the dashboard as its last four characters
only, and never included in a REST response, a log entry or an export. If you
would rather keep it out of the database entirely, define it in wp-config.php
and the field becomes read-only:

define( 'RBFB_API_KEY', 'your-key-here' );

External Services

This plugin connects to Brevo, a third-party email marketing and transactional
email service, because sending your form submissions to Brevo is the entire
purpose of the plugin. No request is ever made until you enter your own Brevo
API key.

Brevo API — https://api.brevo.com/v3 (service homepage: https://www.brevo.com/)

What is sent, and when:

• When you click “Test connection”: nothing but your API key, to
  GET /account, to confirm the key works and to read your account name.
• When you open the field-mapping screen and ask to refresh: your API key, to
  GET /contacts/lists, GET /contacts/folders and GET /contacts/attributes,
  to read back the lists and contact attributes in your account. Results are
  cached locally for 15 minutes.
• When you create a contact attribute from the mapping screen: the attribute
  name and type, to POST /contacts/attributes/{category}/{name}.
• When a visitor submits a form you have mapped: the submitted email address,
  the form values you mapped to Brevo attributes, and the IDs of the lists you
  chose, to POST /contacts.
• Only if you switch on “Site email”: your API key, to GET /senders, to read
  back the verified sender addresses on your Brevo account so you can pick one.
• Only if you switch on “Site email” with the API transport: the recipients,
  subject and body of the emails your site sends via wp_mail(), to
  POST /smtp/email.

Brevo SMTP relay — smtp-relay.brevo.com

Only if you switch on “Site email” and choose the SMTP transport. Your SMTP
login, SMTP key, and the recipients, subject and body of each outgoing email
are sent to Brevo’s relay over an authenticated TLS connection.

By using this plugin you are sending data to Brevo, and Brevo’s own terms
govern that data:

• Terms of Service: https://www.brevo.com/legal/termsofuse/
• Privacy Policy: https://www.brevo.com/legal/privacypolicy/

The plugin makes no other outbound request. It contacts no analytics service,
no licensing server, and no CDN — fonts and scripts are all served from your
own site.

Privacy

The plugin stores three tables in your own database: mapped feeds, a delivery
log (submitted values, request and response bodies, capped at 64KB each), and a
consent record (email address, the exact consent wording the visitor saw, the
page URL and the visitor’s IP address).

Consent records exist so you can prove a subscription was asked for, which is
why nothing is deleted when you uninstall unless you first tick “Delete all
plugin data when the plugin is uninstalled” on the Settings screen. Log entries
can be cleared at any time from the Logs screen.

Source Code

The admin dashboard is a React application compiled with @wordpress/scripts.
Everything in assets/ is build output — assets/admin.js, its stylesheets,
and the hashed font files in assets/fonts/. The complete, unminified source
those are built from ships inside this plugin, in src/, including the
original font files in src/admin/fonts/. Nothing has to be downloaded to
inspect or rebuild it.

To rebuild from the plugin folder:

1. npm install
2. npm run build

That reads src/admin/index.js and rewrites assets/.

No minified or obfuscated third-party code is bundled. React, ReactDOM, the JSX
runtime and every @wordpress/* package are loaded from the copies WordPress
core already ships, declared as script dependencies in
assets/admin.asset.php.

Credits

• Poppins by Indian Type Foundry and Jonny Pinhorn, licensed under the SIL Open
  Font License 1.1 (https://scripts.sil.org/OFL) and self-hosted.
• Portions of the React component kit are derived from Ninja Drive by
  Plugininja, licensed GPL-2.0-or-later.

See LICENSE.txt in the plugin folder for the full list of bundled assets and
their licences.