Kontelio connects a flexible WordPress contact form to email, Telegram and the WhatsApp Cloud API. Enable any combination of channels, or send private notifications that link to an encrypted local inbox.<\/p>\n\n
Hosting, email providers and Meta may charge. WhatsApp needs business onboarding, a Cloud API number, token and approved template, not a personal account. No affiliation with Telegram, WhatsApp or Meta; no legal-compliance guarantee.<\/p>\n\n
Enable Extended privacy per channel. It sends only a generic notice, site name and admin link: no visitor name, email, phone, subject or answers. Email omits visitor Reply-To. Provider credentials and routing metadata remain necessary. Channels with this mode off still receive full content.<\/p>\n\n
If an active channel uses extended privacy, validated details are stored in this site's database using AES-256-GCM before delivery. OpenSSL is required. Storage failure blocks ALL channels; there is no plaintext fallback. Successful storage counts as acceptance even if notifications fail. Check the inbox and diagnostics; there is no retry queue.<\/p>\n\n
Links contain an ID, not an access token. Access requires WordPress login and manage_options. No public\/search\/REST exposure. Admins can delete inquiries; WordPress personal-data export\/erasure matches email fields.<\/p>\n\n
Retention: 30 days by default, 1\u201336500 whole days or 0 permanently. Unsupported timestamp ranges are rejected. Changes affect NEW inquiries only. Expired items become unreadable and receive bounded hourly\/admin cleanup. WP-Cron needs visits or server cron. Permanent items remain until deletion\/uninstall; backups may retain copies.<\/p>\n\n
Encryption uses WordPress security salts. Losing\/changing keys makes existing inquiries unreadable; securely back them up. Database plus keys permit decryption. Use HTTPS; protect accounts, hosting and backups. Disabling privacy leaves existing inquiries.<\/p>\n\n
Use text, email, telephone, textarea, select or checkbox fields. Set labels, placeholders, requirements, widths and up to 20 options. Original fields are removable; consent stays separate. Editing needs JavaScript; submissions do not. Unknown\/removed fields are ignored; at least one answer is required.<\/p>\n\n
Full-content email\/Telegram include ordered labelled answers; the first completed valid email supplies Reply-To only for full-content email. Limits: 12,000 combined characters, plus field limits; full-content Telegram 4,000 UTF-16 units; full-content WhatsApp 500 labelled characters and 900 across five parameters. Provider content limits exclude privacy notifications. Oversized submissions are rejected, not truncated.<\/p>\n\n
Use Seamless embedding removes the outer card, keeping fields\/maximum width. Match colors to your theme. Preview never saves\/sends; tests send notifications. Presets preserve content and privacy settings.<\/p>\n\n Set the consent link's label, URL and tab behavior. New installations follow the WordPress language; English is the source and fallback language. Existing saved language choices and custom text are preserved. A complete German translation is maintained separately in the repository translations\/ directory and a separate language-pack ZIP. Translation catalogs are not included in the installable plugin ZIP. Until a WordPress.org German language pack is available, copy kontelio-de_DE.mo to wp-content\/languages\/plugins\/ and choose German or a German WordPress locale. Without an installed matching language pack, the plugin displays English. German language packs are distributed through WordPress.org once the translations are approved.<\/p>\n\n Providers are contacted for enabled deliveries, requested tests and Telegram confirmation, never form\/preview views. They see the server connection and routing\/account data; notifications omit visitor IPs. Tests use sample data or a privacy notification with an inbox overview link, never the administrator's email as sample content.<\/p>\n\n Email<\/strong><\/p>\n\n Use WordPress mail or your provider's SMTP host. Sender\/recipient are separate. SMTP supports STARTTLS\/implicit TLS and password\/app-password login with certificate verification. No OAuth client is included. Settings affect this plugin only; existing mail integrations may take over. Full content includes labelled answers and optional visitor Reply-To; privacy sends notice, site name and admin URL. Provider\/recipient retention applies. Acceptance does not prove arrival.<\/p>\n\n Telegram Bot API<\/strong><\/p>\n\n Uses WhatsApp Business Platform \/ Meta Cloud API<\/strong><\/p>\n\n Uses Full-content-only setups create no inquiry archive. Keyed IP\/request hashes enforce five attempts\/ten minutes; done status lasts one hour, locks two minutes, health 24 hours and Telegram codes ten minutes. No raw IP is stored. Optional email logs: up to 50 events\/seven days, containing time, method, context, result and safe error category. No addresses, subjects, bodies, passwords or raw server replies. Admins can clear\/disable logs. Hosting\/software may keep other records.<\/p>\n\n SMTP passwords use salt-based encryption or Folder migration: back up the database and WordPress keys, deactivate an earlier build and remove its folder via FTP\/file manager without uninstall; then install the kontelio\/ ZIP. Do NOT use WordPress Delete on the old plugin: uninstall removes inquiries. Activate only the new build and verify saved settings\/inquiries. Keep site keys unchanged.<\/p>\n\n If WordPress.org directory details are unavailable, the plugin provides a local details fallback. Tsambasis & Tsambasis opens https:\/\/tsambasis.net\/ when clicked.<\/p>\n\n Create a bot with @BotFather and save its token. Send the TSCB-... code to the intended private chat and confirm within ten minutes; \/start alone is insufficient. For groups\/channels or existing webhooks, enter the chat ID manually and grant posting permissions. Webhooks are not removed.<\/p>\n\n Enter Graph version (default v24.0), production token, Phone Number ID, international recipient, template name\/language. Full-content templates require five positional body variables and at most 124 fixed-text characters. No header, button or named parameters.<\/p>\n\n Privacy needs its separate approved two-variable template, e.g. No. Unofficial signal-cli needs a maintained service.<\/p><\/dd>\n Do not cache\/block admin-ajax.php or admin pages. Without JavaScript, exclude form pages from long-lived caching. Changed fields may require reload. Shared IPs share quotas; distributed attacks need hosting protection.<\/p><\/dd>\n\n<\/dl>\n\n\n[kontelio]<\/code>. Existing [contact_bridge]<\/code> shortcodes from earlier development builds remain supported; use [kontelio]<\/code> for new content. Override an instance with theme=\"light|dark|auto\"<\/code>, shape=\"rounded|square\"<\/code>, heading=\"Your heading\"<\/code> or embedded=\"true|false\"<\/code>.<\/p>\n\n{privacy_link}<\/code> positions it; otherwise it is appended. Without a URL it is text. Executable HTML\/URL schemes are rejected.<\/p>\n\nExternal services<\/h4>\n\n
https:\/\/api.telegram.org\/bot<TOKEN>\/sendMessage<\/code>: token, chat ID and full content or privacy notification. Link previews are disabled. Requested getUpdates<\/code> confirmation saves a private chat only after matching the admin's temporary code. Chat members can read messages; bot chats are not Secret Chats.<\/p>\n\n\n
https:\/\/graph.facebook.com\/<API_VERSION>\/<PHONE_NUMBER_ID>\/messages<\/code>: Bearer token, sender ID, operator number, template name\/language and parameters. Full content uses five body parameters: name, email, subject, labelled details, site name. Privacy requires a SEPARATE approved template with two: site name, admin URL. Meta\/recipient process this data; the recipient must agree to notifications. Meta determines approval, availability and charges.<\/p>\n\n\n
Other stored data<\/h4>\n\n
TSCB_SMTP_PASSWORD<\/code>; changed salts require re-entry. Messenger tokens are unencrypted, non-autoloading options, or use TSCB_TELEGRAM_TOKEN<\/code> \/ TSCB_WHATSAPP_TOKEN<\/code> in wp-config.php. Protect backups. Uninstall removes inquiries, database runtime data and logs; settings\/credentials only if enabled. External-cache keys expire. Provider messages, backups and wp-config constants need separate handling.<\/p>\n\n\n\n
[kontelio]<\/code> to a Shortcode block.<\/li>\nTelegram<\/h4>\n\n
WhatsApp<\/h4>\n\n
New inquiry on {{1}}. Open securely: {{2}}<\/code>. Meta decides approval. Switching privacy off uses the configured five-variable template.<\/p>\n\n\n\n
Is Signal supported?<\/h3><\/dt>\n
Can caching or spam affect the form?<\/h3><\/dt>\n
1.0.0<\/h4>\n\n
\n