OAuth connect / disconnect flow (admin clicks "Connect to LeadConnector" or "Disconnect"). OAuth token refresh (background WP-Cron task leadconnector_oauth_token_refresh_cron, fired only when a connected access token is approaching expiry). Settings save on the LeadConnector admin screen. Funnel browse, import, and refresh actions (admin clicks "Import" / "Refresh" inside the LeadConnector funnels UI). Custom-value listing and sync action. SMTP enable / disable / test send actions. Reviews widget admin browsing. Admin REST proxy requests that target an allowlisted full URL on this host. CDN cache purge (see below for triggers). CDN cache-purge triggers (only when CDN_WP_ID or CDN_SITE_ID is defined in wp-config.php and an active OAuth session exists). The plugin sends an authenticated empty-body POST to services.leadconnectorhq.com/wordpress/lc-plugin/site/{locationId}/{wpId}/clear-cache on: A connected WordPress administrator clicking "Purge everything on all domains" in the admin bar. The LeadConnector settings page being saved. A public post (any post type registered with public => true, including standard post, page, WooCommerce products, and third-party CPTs) being published or updated via WordPress's save_post hook. Auto-saves, revisions, and non-public post types are skipped. Custom-value placeholder fallback (a single front-end-render code path): when a {{custom_values.…}} placeholder is referenced on a public page and the local transient cache is cold for that key, the public renderer falls back to an authenticated read from services.leadconnectorhq.com using the admin-issued OAuth bearer that the site has stored. The fallback is a read-only lookup; no visitor data is forwarded. Visitor browser trigger: when the chat widget is enabled, the browser loads widgets.leadconnectorhq.com/loader.js with data-server-u-r-l and data-marketplace-u-r-l values pointing at services.leadconnectorhq.com; the widget may contact those service endpoints directly. Browser requests include the selected widget configuration plus normal browser metadata (IP address, User-Agent, Referer, language headers, and any cookies the host previously set). What is not sent by PHP server-to-server calls: WordPress administrator credentials, password hashes, WordPress secret keys/salts, WordPress authentication cookies, other plugins' data, visitor IP, visitor User-Agent, or visitor referrer. Chat-widget browser requests are initiated by the visitor's browser and carry normal browser metadata as described above. Service: provided by LeadConnector LLC. Service terms: https://www.leadconnectorhq.com/terms2 Privacy policy: https://www.leadconnectorhq.com/privacy-policy rest.leadconnectorhq.com (admin / server-to-server) What it is: LeadConnector's REST API. Used by legacy admin flows that have not yet migrated to services.leadconnectorhq.com and as one allowlisted host for optional funnel tracking-code downloads supplied by LeadConnector during import. What is sent: the LeadConnector API key (when API-key auth is configured instead of OAuth), location ID, page/funnel IDs, custom-value keys, and request parameters required by the admin action. For optional tracking-code downloads, WordPress sends a server-side GET to the LeadConnector-supplied download URL. When sent: admin-triggered actions only - account validation against the REST API, certain custom-value reads, certain legacy data pulls, admin REST proxy requests that target an allowlisted full URL on this host, and funnel import / publish when the supplied tracking download URL points to this host. The plugin never calls this host from the public render path.