Wynko connects your WordPress site to your Laposta account, then gets out of the way.

Once you’ve entered your API key, you get two things you can drop anywhere on your site: a signup form that adds people straight to one of your Laposta lists, and a campaigns list that shows the newsletters you’ve most recently sent.

No embed codes. No iframes. Just your own site, with your own styling.

Full documentation for every screen, plus the hooks and filters for developers, lives at https://getwynko.com/docs/.

Signup forms that can’t get out of sync

Pick a Laposta list, and Wynko builds the form from that list’s own fields. If Laposta says a field is required, it’s required here too. If a dropdown has five options in Laposta, it has those same five options on your site. You can’t accidentally build a form that Laposta will reject, because the form is always built from what Laposta actually accepts.

Wynko ships only the bare structural CSS. Colours, fonts and spacing come from your theme, and you can adjust them with CSS custom properties if you want to fine-tune.

Subscribe from forms you already have

Wynko also bridges other form plugins to Laposta. Bundled integrations for Contact Form 7 and HTML Forms — off until you switch one on under Wynko Integrations — let an existing form subscribe people to a list by adding a single checkbox. Any plugin or theme can register its own integration the same way, so the list isn’t limited to those two.

Campaigns block

Add the Wynko: Campaigns block to any post or page and it shows a simple list of links to your most recently sent campaigns. Choose how many to show, which list they come from, the order, and what each line says. There’s no front-end CSS at all here — your theme styles it completely.

Your API key, handled carefully

Your Laposta API key is the key to your whole mailing list, so Wynko treats it carefully.

It’s checked before it’s saved. Wynko asks Laposta whether the key works before storing it. A wrong key is rejected right away instead of quietly failing later.
It’s never shown back to you. Once saved, the key isn’t printed into the settings page, so it can’t be read off your screen or pulled out of the page source.
It’s encrypted at rest, when your server allows it. If the sodium PHP extension is available (bundled with PHP since 7.2, so almost always) and your site has real WordPress security salts, the key is sealed with authenticated encryption before it’s written to the database — a raw database export or a SQL-injection leak doesn’t hand over a usable key. See the FAQ for exactly what this does and doesn’t protect against.
You can keep it out of your database entirely. This is the safest option, and the one we recommend. Add one line to your wp-config.php file — define( 'WYNKO_API_KEY', 'your-laposta-api-key' ); — and the key lives there instead. A key defined this way never touches your database, so it can’t leak through a database backup, a stray export, or a database-level breach. If a key is defined in wp-config.php, it always wins — Wynko won’t let a saved value quietly override it.
It never shows up in the log. The activity log records what happened, never your key.

Prefer environment variables? Every Wynko setting, not just the key, can come from an environment variable or a wp-config.php constant — see the FAQ for the full list. That means staging and production can each have their own configuration, deployed with your code, instead of someone remembering to click through the settings screen on every site.

Built-in spam and abuse protection

Signup forms are public by nature, so every submission is checked and metered before anything reaches Laposta:

Rate limiting, per visitor and per form. Submissions are counted over a rolling time window. Once a cap is hit, further submissions are turned away until the window passes; nothing is sent to Laposta, and nothing is lost, since a genuine visitor can simply try again once it does. Both caps and the window are adjustable, and the counters can be reset instantly.
A hidden honeypot field catches simple bots: if it’s filled in, the visitor sees the ordinary success message, but nothing is actually sent to Laposta.
Every value is re-validated on your server, against the list’s real field definitions in Laposta — required fields, allowed choices, number and date ranges, text length and patterns. What your browser enforces is a convenience for real visitors; what Wynko enforces server-side is what actually decides whether a signup goes through.
“Already subscribed” stays private by default. Telling an anonymous visitor that an address is already on the list turns a form into a way to test whether someone is subscribed. Wynko shows the same success message either way, unless you turn that off for a specific form.

Keeping an eye on things

Activity log — see key checks, connection checks, syncs and signups, at whatever level of detail you want. Filter it on screen, or download it as a .txt to attach to a support request. It never contains your API key, and signup entries never contain anyone’s email address or answers.
Email alerts — get an email when something goes wrong, at most once an hour so your inbox stays sane. Switched off by default.
System report — a quick health check of WordPress, PHP, your database, PHP modules and your server, each flagged against what Wynko is tested with. It warns you about anything unusual, but never blocks you. Downloadable, again, for support.
Multisite friendly — each site in the network has its own settings, its own Laposta account, its own log and its own alerts. Uninstalling cleans up after itself across the whole network.

Source code and contributing

Full documentation is at https://getwynko.com/docs/. Development happens at https://github.com/FlexBorder/wynko — issues and pull requests are welcome.

Laposta is a trademark of its respective owner. This plugin is developed independently by FlexBorder Co., Ltd with Laposta’s permission and is not an official Laposta product.

External services

This plugin connects to the Laposta API (https://api.laposta.nl), a third-party email marketing service. Laposta is the whole point of the plugin: it is how signup forms add subscribers to your mailing lists and how the campaigns block shows what you’ve sent.

Wynko contacts Laposta:

When you save or verify your API key — your API key is sent to confirm it works before it’s stored.
When campaign data is fetched or refreshed — to list your most recently sent campaigns.
When a visitor submits a signup form — the email address and the other field values that visitor typed in are sent to Laposta, along with the visitor’s IP address and the path of the page they submitted from, so the subscriber can be added to the chosen list. Nothing else about the visitor is sent, and nothing is sent at all unless a visitor actually submits the form. A signup made through a bundled integration sends the same kind of data for the same reason.

Wynko doesn’t store signups on your own site, and its own server-side code makes no request to any host other than Laposta’s.

Laposta’s terms of service: https://www.laposta.nl/en/terms-and-conditions
Laposta’s privacy policy: https://www.laposta.nl/en/privacy-statement

The admin screens also show a handful of outbound links you may click, which your browser — not Wynko — then requests: Laposta’s own help article on getting an API key (docs.laposta.org) and list-management page (app.laposta.nl); WordPress core’s reference docs on security salts (developer.wordpress.org); the plugin’s own documentation site, linked from its row on the Plugins screen (getwynko.com); the plugin’s GitHub issue tracker, linked from the About and Integrations screens for bug reports and integration requests (github.com); the plugin’s WordPress.org support forum, linked from the About screen (wordpress.org/support); and, also on the About screen, a link to another plugin’s page on the official directory (wordpress.org). None of these run unless you click them, and none of them are third-party services Wynko itself connects to.

Wynko for Laposta