/ Plugin Category

/ E-commerce & Shopping

/ LeadConnector

LeadConnector

By LeadConnector

E-commerce & Shopping /

LeadConnector Review - In-Depth Analysis

LeadConnector helps you add a chat widget and funnel pages to your WordPress site. Capture leads effectively with integrated forms.

Performance Overview

WPS Score

6.81/10

User Rating

2.3/5 (based on 12+ reviews)

Active Installations

20,000+

Update Frequency

Average It is calculated using the weighted average of same category plugins.

Security Score

5 / 10 (Medium Risk) It is calculated using the weighted average of all versions.

What It Does

The LeadConnector plugin helps you install the text to chat widget to your WordPress website to drive better conversions. It allows you to embed LeadConnector funnel pages to capture visitor information like email and phone, ensuring you do not miss out on any leads.

This plugin connects you to the LeadConnector CRM through APIs and scripts to render the widgets and generate leads from your website. It is highly recommended to read LeadConnector's privacy policy and Terms of Service.

Comparing to Alternatives

LeadConnector is a specialized plugin designed to integrate HighLevel CRM features into WordPress sites. While it stands out for its seamless integration, it faces some challenges compared to other lead generation plugins.

Top alternatives

LeadConnector

Strengths

Easy integration with HighLevel CRM features
Supports chat widgets and funnel pages within WordPress
No coding required for setup
Improves lead capture via email and phone
SEO tags work well on funnels

Weaknesses

Occasional bugs and glitches reported
Connection setup can require multiple attempts
Limited to HighLevel CRM ecosystem
No pro version with advanced features

User Sentiment Analysis

User feedback highlights both the plugin's ease of use and some reliability issues.

Positive highlights

"Easy to set up and helped integrate chat widgets and funnel pages seamlessly" - vaibhavkole
"Provides very easy integration to GHL features" - zeroware09
"Seamless integration, easy setup, and reliable performance" - sauravagrawal2807
"Simple, stable, and feature-rich plugin" - jaisalghl
"Super easy to use and works perfectly" - bhuvanghl

Common complaints

Bugs and glitches persist over long-term use
Connecting account often requires multiple tries and cache clearing

Weaknesses

Setup can be frustrating due to connection issues
Limited troubleshooting support evident from comments

Who Should Use This?

Best for

Users who rely on HighLevel CRM and want a straightforward way to integrate its features like chat widgets and funnels into their WordPress site without coding.

Not ideal for

Those seeking a highly stable plugin with extensive support or users not using HighLevel CRM, as the plugin is tightly coupled with that ecosystem.

Pricing & Value

Free version includes

The free version offers essential integration features for syncing forms, chat widgets, and funnel pages with HighLevel CRM, suitable for most users needing basic functionality.

Final Verdict

LeadConnector is a valuable tool for WordPress users invested in the HighLevel CRM ecosystem, providing easy integration of key features without coding.

However, users should be prepared for occasional bugs and connection challenges, and there is no premium version to access advanced features or dedicated support.

Other Notable Features

Here are a few other notable features of this free LeadConnector plugin.

lead generation

chat widget

funnel integration

Screenshots

FAQ

Yes. You need an active LeadConnector account and a connected location to use the CRM-connected features.

What it is: LeadConnector’s public widget and asset host. It serves browser-loaded JavaScript / iframes for embeds, allowlisted admin REST proxy targets, and optional funnel tracking-code downloads supplied by LeadConnector during import.
Front-end browser triggers (visitor’s browser contacts the host directly):
- [leadconnector_phone_number_pool id="…"] shortcode loads https://api.leadconnectorhq.com/loc/{locationId}/pool/{poolId}/number_pool.js and https://api.leadconnectorhq.com/js/user_session.js.
- [leadconnector_form id="…"] shortcode renders an iframe pointing at https://api.leadconnectorhq.com/widget/form/{formId}.
- [leadconnector_survey id="…"] shortcode renders an iframe pointing at https://api.leadconnectorhq.com/widget/survey/{surveyId}.
- [leadconnector_quiz id="…"] shortcode renders an iframe pointing at https://api.leadconnectorhq.com/widget/quiz/{quizId}.
- [leadconnector_calendar slug="…"] shortcode renders an iframe pointing at https://api.leadconnectorhq.com/widget/booking/{slug}.
- The shortcodes also enqueue https://link.msgsndr.com/js/form_embed.js (see the link.msgsndr.com block below) which is what allows the iframes to resize.
Data the visitor’s browser sends to api.leadconnectorhq.com when those embeds load: the configured identifier in the URL (location/pool/form/survey/quiz/calendar slug), plus whatever the visitor’s browser includes automatically (IP address, User-Agent, Referer, language headers, and any cookies the host previously set in this browser). Anything the visitor subsequently types into an embedded LeadConnector form, survey, quiz, calendar booking, or chat is submitted directly from the visitor’s browser to LeadConnector’s services and is governed by the LeadConnector privacy policy.
Funnel display trigger: if a published funnel step is configured to redirect to an api.leadconnectorhq.com URL, the visitor’s browser is redirected there. In native mode, the funnel HTML is fetched from app.leadconnectorhq.com, but scripts or stylesheets inside that upstream HTML may reference api.leadconnectorhq.com; those assets are re-emitted only when they pass the native-mode allowlists documented below.
Admin server-to-server triggers:
- Certain admin REST data pulls (calendar lists, reviews widget metadata, related lookups) target api.leadconnectorhq.com with the OAuth bearer.
- The admin REST proxy accepts direct_endpoint=true only for an allowlisted LeadConnector URL. If an administrator action requests an allowlisted full URL on api.leadconnectorhq.com, WordPress performs a server-side GET to that URL.
- During funnel import / publish, WordPress may fetch a LeadConnector-supplied tracking-code download URL on this host.
What is not sent by the plugin itself: WordPress admin credentials, WordPress secrets, WordPress auth cookies, other plugins’ data. The plugin does not proxy visitor input through PHP; it embeds the iframes/scripts directly.
Service: provided by LeadConnector LLC.
Service terms: https://www.leadconnectorhq.com/terms2
Privacy policy: https://www.leadconnectorhq.com/privacy-policy

What it is: LeadConnector’s customer-facing application host. The funnel HTML that gets rendered as a WordPress page lives here.
Admin triggers: the funnel import / refresh flow performs an authenticated wp_remote_get() against https://app.leadconnectorhq.com/{path} to fetch the funnel step HTML so it can be stored in WordPress. The OAuth bearer is sent; the visitor never sees this request. The admin UI may also open connected LeadConnector app screens in the administrator’s browser, and the admin REST proxy may request an allowlisted full URL on this host.
Optional server-side tracking download: during funnel import / publish, WordPress may fetch a LeadConnector-supplied tracking-code download URL on this host.
Front-end triggers depend on the funnel page’s configured display mode (set per funnel post):
- iframe mode – The visitor’s browser loads https://app.leadconnectorhq.com/{funnelStepPath} inside an <iframe>. The visitor’s browser sends its IP, User-Agent, Referer, and any cookies LeadConnector has previously set. Visitor interactions with the funnel happen on LeadConnector.
- native mode – WordPress fetches the funnel HTML server-side via wp_remote_get() and re-emits it inside the current document. The visitor’s browser then loads any LeadConnector-owned sub-resources (scripts, stylesheets, images, fonts) that the funnel HTML references; those sub-resource loads carry the visitor’s IP, User-Agent, and Referer to whichever LeadConnector host they target.
- redirect mode – The visitor is 301-redirected to a https://app.leadconnectorhq.com/{funnelStepPath} URL (or to an admin-configured white-label host). All subsequent traffic happens entirely on the LeadConnector side; WordPress is no longer in the path.
What is not sent: WordPress secrets, WordPress auth cookies, other plugins’ data. The native-mode fetch does not include any visitor identifier.
Service: provided by LeadConnector LLC.
Service terms: https://www.leadconnectorhq.com/terms2
Privacy policy: https://www.leadconnectorhq.com/privacy-policy

LeadConnector funnel posts have two display modes that are configured per-funnel inside the funnel editor:

iframe — the funnel HTML is embedded inside an <iframe src="…leadconnectorhq.com…"> on the WordPress page. The browser treats the funnel as a separate origin: its scripts, cookies, storage, and DOM are isolated from the WordPress site and from every other plugin/theme on the site. This is the safest display mode and is the default for the majority of funnels.
native — the funnel HTML is fetched server-side via wp_remote_get() against an allowlisted LeadConnector host, parsed, sanitized via wp_kses() against a strict allowlist, and emitted inline on the WordPress page. Any <script> and <style> blocks extracted from the upstream HTML are re-emitted via the WordPress script/style APIs (wp_print_inline_script_tag(), wp_add_inline_style()) so the funnel’s CSS selectors and JavaScript run intact. This mode exists for one explicit reason: funnels that take payments (Stripe, PayPal, Apple Pay) and other in-page integrations refuse to run inside an <iframe> for PCI / 3D Secure reasons, so the funnel content must be rendered on the WordPress origin for the checkout to complete.

When a funnel is displayed in native mode, vendor-authored LeadConnector CSS and JavaScript loads and executes on your WordPress origin. This is a deliberate trust extension from the WordPress site to LeadConnector, comparable to embedding Stripe.js or Google Tag Manager directly. To make that boundary explicit and auditable, the plugin applies the following layered controls (since 3.0.32):

Admin opt-in toggle (default: enabled). Native rendering is gated on a single site-wide option (leadconnector_native_mode_allowed). When it is OFF, every funnel post with display_method = native is silently downgraded to the iframe display path so no remote LeadConnector JavaScript runs on the WP origin. Site owners who do not run payment funnels (or who want a stricter security posture) can switch the toggle off. Administrators see a persistent admin notice describing the current state.
Per-host <script src> allowlist. Any <script src> URL extracted from the upstream funnel HTML is validated against a host allowlist before it is enqueued. Entries may be exact hostnames (applepay.cdn-apple.com, connect.facebook.net) or subdomain wildcards (*.foo.com matches any direct or nested subdomain of foo.com but never the apex). The default allowlist covers (a) *.leadconnectorhq.com and the apex leadconnectorhq.com — this includes app, services, rest, api, backend, widgets, marketplace, stcdn (LC static CDN that hosts the funnel runtime bundles, intl-tel-input, libphonenumber-js), and images (LC’s funnel image proxy), (b) LeadConnector-operated sibling brands (*.msgsndr.com, msgsndr.com, *.reputationhub.site, reputationhub.site), (c) LC’s media-storage CDN (*.filesafe.space), (d) the Google-hosted CDNs LC funnels commonly load static assets and fonts from (*.googleapis.com, *.gstatic.com), (e) Bunny Fonts — LC’s default privacy-focused font CDN (*.bunny.net), (f) the payment-processor JS that funnel checkouts integrate with (*.stripe.com, *.stripe.network, *.paypal.com, *.paypalobjects.com, applepay.cdn-apple.com), and (g) the tag managers / analytics that funnels commonly embed (*.googletagmanager.com, *.google-analytics.com, connect.facebook.net, *.facebook.net). Off-allowlist <script src> URLs are dropped entirely; the surrounding markup is still rendered. Sites that need to register additional payment-processor or analytics hosts can use the leadconnector_funnel_allowed_script_hosts filter (which accepts both exact hosts and *.host.tld wildcard entries).
Content-Security-Policy <meta> tag. Every native-mode funnel page emits a <meta http-equiv="Content-Security-Policy" …> tag inside <head> so that browsers enforce a strict policy on subsequent fetches. The default policy:
- Pins default-src to 'self'.
- Limits script-src to the same wildcard host allowlist described in (2) — <script src> URLs outside the allowlist are blocked at the browser layer in addition to being stripped at the server layer.
- Uses style-src 'self' 'unsafe-inline' https:, img-src 'self' data: blob: https:, font-src 'self' data: https:, and media-src 'self' data: blob: https:. Stylesheets, images, fonts, and media have effectively no JS-execution surface in modern browsers, and funnels routinely pull these from a long tail of vendor-chosen CDNs (Bunny Fonts, Google Fonts, the merchant’s own CDN, payment-processor checkouts, embedded video preview hosts, etc.). The dangerous CSS payloads (expression(…), behavior:, -moz-binding, javascript: URIs in url()) are already neutralized by sanitize_extracted_inline_css() before any remote CSS is enqueued, so this directive is defense-in-depth rather than the primary control.
- Scopes connect-src and form-action to the same wildcard host allowlist plus https: to allow legitimate vendor telemetry / form endpoints while still blocking data: / blob: / http: exfil.
- Scopes frame-src to the canonical funnel-embed providers (*.leadconnectorhq.com, *.msgsndr.com, Stripe Elements, PayPal Smart Buttons, YouTube, YouTube no-cookie, Vimeo, Google).
- Forbids <object> / Flash / legacy plugins outright (object-src 'none').
- Refuses to be framed off-origin (frame-ancestors 'self') — clickjacking guard.
- Pins base-uri 'self' so a future malicious <base href> can’t rewrite every relative URL on the document to an attacker-controlled host.
- Sites can extend or replace the directive map with the leadconnector_native_mode_csp_directives filter; returning an empty array disables CSP emission for the request.
Inline CSS allowlist sanitization (3.0.32). Inline <style> content extracted from the upstream funnel HTML is passed through LeadConnector_Admin::sanitize_extracted_inline_css() before reaching wp_add_inline_style(). The sanitizer strips embedded HTML tag fragments (</style>, <script>, <iframe>, …), legacy CSS XSS vectors (expression( … ), -moz-binding, IE behavior:), and dangerous URI schemes (javascript:, vbscript:, livescript:, mocha:, jar:, file:, phar:). data: URIs are restricted to image/*, font/*, and application/font-* MIME types. @import rules are dropped entirely (external stylesheets continue through the <link rel=stylesheet> branch with esc_url() and an explicit http/https protocol allowlist).
No WordPress secret cross-over. Native rendering never reads LOGGED_IN_KEY, LOGGED_IN_SALT, LOGGED_IN_COOKIE, SECURE_AUTH_COOKIE, or AUTH_COOKIE. The deferred custom-values write that used to forward those cookies through a plugin-generated loopback request was removed in 3.0.32 and replaced with a wp_schedule_single_event() cron handler.

If you do not run funnels that need payment processors or other in-page integrations, the safest configuration is: flip the “Allow native funnel rendering” toggle off in LeadConnector settings. Every native funnel will then be served via the iframe path, and the WordPress origin will not execute any remote LeadConnector JavaScript.

The plugin ships with a public OAuth client ID constant (LEAD_CONNECTOR_OAUTH_CLIENT_ID) used only to start the LeadConnector authorization flow. It is not a secret. Sites may override it in wp-config.php:

define( 'LEAD_CONNECTOR_OAUTH_CLIENT_ID', 'your-client-id' );

Debug logging is off by default. Enable it for support sessions only:

define( 'LEADCONNECTOR_DEBUG', true ); in wp-config.php, or
Enable WordPress core WP_DEBUG + WP_DEBUG_LOG.

When logging is enabled the plugin writes daily files to:

WP_CONTENT_DIR/leadconnector-logs/leadconnector-YYYY-MM-DD.log (default)
Override with define( 'LEADCONNECTOR_LOG_DIR', '/path/outside/webroot/leadconnector-logs' );

OAuth tokens, refresh tokens, API keys, SMTP passwords, the OAuth code query parameter, and Authorization: headers are redacted by the logger before lines are written. Context payloads larger than 2 KB are truncated. The directory is created with an index.php stub and (under Apache) a .htaccess “Deny from all” file.

Under nginx or Caddy the generated .htaccess is ignored. Add the following snippet to your server block (adjust paths to match your install):

location ^~ /wp-content/leadconnector-logs/ {     deny all;     return 403; }

For Caddy:

@leadconnectorLogs path /wp-content/leadconnector-logs/* respond @leadconnectorLogs 403

For Apache 2.4+ where the .htaccess has been allowed, the bundled directive uses the modern Require all denied directive automatically.

Contributors and developers

“LeadConnector” is open source software. The following people have contributed to this plugin.

Free Version Docs

WPS

6.81

Average

Ratings

2.3 out of 5 | 12

Version

4.0.1

Last updated

6 days ago

Active installations

20,000+

WordPress version

7.0 or higher

PHP version

7.4 or higher

Languages

Other plugins you might like

WooCommerce

By Automattic

WPS

8.16

Very Good

4.5/5

4.8k+reviews

7M+

active installation

Tested with

7.0

Akismet Anti-spam: Spam Protection

By Automattic

WPS

7.74

Very Good

4.7/5

1.2k+reviews

6M+

active installation

Tested with

7.0

MC4WP: Mailchimp for WordPress

By Danny van Kooten

WPS

7.47

Very Good

4.8/5

1.5k+reviews

1M+

active installation

Tested with

7.0

Smash Balloon Social Photo Feed – Easy Social Feeds Plugin

By Syed Balkhi

WPS

7.07

Very Good

4.9/5

4.3k+reviews

1M+

active installation

Tested with

7.0

WooPayments: Integrated WooCommerce Payments

By WooCommerce

WPS

7.26

Very Good

3.2/5

151+reviews

900k+

active installation

Tested with

7.0

Google for WooCommerce

By WooCommerce

WPS

7.29

Very Good

2.7/5

263+reviews

800k+

active installation

Tested with

6.9.4

LeadConnector Review - In-Depth Analysis

Performance Overview

What It Does

Comparing to Alternatives

User Sentiment Analysis

Who Should Use This?

Pricing & Value

Final Verdict

Other Notable Features

Screenshots

FAQ

Contributors and developers

Ratings

Reviews (12)

Sort by:

Contributors & Developers

Interested in development?

Changelog

Security Status

Secure

No Unpatched Vulnerabilities

Known Vulnerabilities (4)

WPS

6.81

Other plugins you might like

WooCommerce

Akismet Anti-spam: Spam Protection

MC4WP: Mailchimp for WordPress

Smash Balloon Social Photo Feed – Easy Social Feeds Plugin

WooPayments: Integrated WooCommerce Payments

Google for WooCommerce