Deftmind Hookwright – Webhooks, REST API, Data Display & AI Chat

Deftmind Hookwright is the bridge between your website and the automation platform you already use. What happens on your site goes out as a webhook; what your workflow sends back is displayed on your pages. The logic stays where you built it.

That is the whole idea. This plugin is not a workflow builder and does not try to be one – you already have n8n, Make, Zapier, a self-hosted tool or a script of your own, with connectors this plugin could never match. What has been missing is the piece that joins them to WordPress without a developer.

Send what happens on your site. A visitor opening a page, clicking a button, following a link, or submitting a form – each can become a webhook to an address you choose. Rules are written in plain terms: which pages, which element. No JavaScript to write, and no analytics company in the middle taking a copy as it passes. The destination and its credentials stay on your server and never reach a visitor’s browser.

And what happens inside WordPress. Publishing a post or page, approving a comment, someone registering – each can fire the same webhook, with no rules to write at all. A post fires the first time it is published and only the first time, so taking something back to draft and publishing it again does not send it twice. Every event says whether it came from the site or from a visitor’s browser, so one workflow can handle both.

Act on a landing page. If a checkout sends buyers to /thank-you/?order_id=1234, name that parameter and your workflow receives the value directly. One rule replaces a subscription to something that only forwards events for you.

Bring the results back. Point any workflow at the plugin’s secure endpoint. Payloads arrive into named channels and appear on any page through shortcodes, as formatted articles, data tables, or live-updating feeds.

Ask, and show the answer. Add a form to any page. Submissions are proxied through your own server to your webhook, and the reply renders in place without a page reload. If your platform cannot answer on the connection the form opened – or the work takes minutes – callback mode hands it a one-time return URL to post the answer back to instead.

Have the questions written for you. You do not have to type a field spec by hand. Copy this plugin’s instructions into whatever AI chat you already use, describe the form in plain words, and upload the JSON it replies with – the fields, the label and the button text fill themselves in, and the plugin tells you anything in the result it would otherwise have ignored without complaint. Nothing leaves your site to make that happen. If you would rather not copy back and forth, point the plugin at a webhook of your own and it will do the asking for you.

Private AI chat, without vendor lock-in. Turn on conversation mode and a form becomes a threaded chat. Each turn sends the running conversation to your workflow, so a retrieval-augmented (RAG) pipeline can answer with context. The intelligence stays in your workflow: no API keys stored in WordPress, any model or vector database, and no third-party chat service in the middle.

Anonymous and ephemeral by design. Visitors need no account. Nothing about a conversation is written to your database; the thread lives in the visitor’s browser and is gone on reload. For sites answering sensitive questions, that is a feature, not a limitation.

Works with the form you already have. If your site already uses a form plugin, add a couple of data attributes to its markup and Hookwright handles the round trip without replacing anything.

Built for safety

• Inbound endpoint disabled until you set a shared secret, then verified with a timing-safe comparison.
• Payload content is escaped or sanitised on every path. Markdown is parsed in safe mode and then filtered again through WordPress’s own post sanitiser.
• Outbound requests use WordPress’s protected HTTP functions, which reject internal and reserved addresses.
• Rate limiting, honeypot spam trapping, size caps and request timeouts on public endpoints.
• Event tracking is off by default, scoped to administrator-configured path rules, checks same-origin browser requests, and requires an explicit consent signal by default. Every event is re-checked against the saved rules on the server, so the rules visible in the page source cannot be edited to send something else.

Where data goes

This plugin only contacts the URLs you configure. It sends nothing to the plugin author, contains no tracking, and makes no external requests of its own. It is not an AI product and calls no AI service of its own: any intelligence comes from the workflow you point it at.

Privacy, and event tracking in particular

Event tracking (Flow C) is off until you turn it on, and it is the one feature that can put personal data into a payload. What it does:

• Events go only to the webhook URL you set. Nothing reaches the plugin author.
• No cookie is set and no visitor identifier is created. Campaign attribution is kept in the visitor’s own browser for the length of their session and is never written to your database.
• Form field values are never collected. The visible text of a clicked element is included, so avoid selectors that wrap text you would not want forwarded.
• Nothing about an event is stored on your site. It is forwarded and forgotten.
• Consent is required by default: tracking begins only once your consent tool signals it. You can turn that requirement off if your jurisdiction and what you collect allow it.

The part that deserves a decision rather than a default: a URL can carry personal data in its query string. If a redirect lands visitors on /thank-you/?email=someone@example.com, that address is part of the page URL and will be sent – and on that visitor’s next tracked click it appears again as the referrer, because the referrer is simply the page they came from. Two settings control this: a list of query parameters to capture deliberately (empty by default, so nothing is extracted unless you name it), and an option to remove query strings from both the page URL and the referrer URL. Where you can, use an order or customer reference and look the person up on the other side rather than sending an email address anywhere.

Nothing is hashed. Whatever you choose to capture arrives at your webhook readable and stays readable in your workflow tool’s execution history. Hashing would not help: an email address can be recovered from its hash by simply trying addresses, so it would remain personal data – and it would no longer be usable for the thing you captured it for. A reference you can look up is the better answer.

You are the data controller for whatever you choose to collect. Disclose it in your privacy policy and obtain consent where the law that applies to you requires it.

Third-party code

This plugin bundles Parsedown 1.7.4 by Emanuil Rusev (https://parsedown.org), used in safe mode to render Markdown. Parsedown is MIT licensed and the full licence text is reproduced in includes/class-hookwright-markdown.php. The class is renamed so it cannot collide with another plugin bundling its own copy; it is otherwise unmodified.

Deftmind Hookwright Pro

An optional add-on that lets your automation act on the site, rather than only feed it. Incoming payloads become real WordPress posts or pages – titles, Markdown bodies, categories, tags and featured images mapped to native fields, including custom post types and custom fields – and the reply your workflow sends back to a form can be saved the same way. It also signs outbound requests, so the receiving end can verify nothing was altered in transit.

Details and download: https://deftmindlabs.com/hookwright/

Documentation: https://deftmindlabs.com/docs-reference/