by
RoyDG
0 (0 reviews)
Wynko for Laposta
Wynko – Campaigns & Sign-Up Forms for Laposta
Wynko for Laposta ranks #57,036 among WordPress.org plugins with 0+ active installations, is #2,390 of 2,586 in the Contact Forms category, and was last updated Sep 15, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1
v1.2.2
Current Version v1.2.2
Updated 1 day ago
Last Update on 15 Sep, 2026
Refreshed 12 hours ago
Last Refreshed on
#2,390 of 2,586 in Contact Forms
Actively maintained
Rank
#57,036
—
No change
Active Installs
0+
—
No change
KW Avg Position
7
—
No change
Downloads
50
+1 today
Support Resolved
0%
—
No change
Rating
0%
Review 0 out of 5
0
(0 reviews)
Next Milestone 10
0+
10+
11,483
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 5 more installs to reach 10+
Rank Changes
Current
#57,036
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
0.0
0 reviews
Overall
0%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 1.2.2
- Last Updated
- Sep 15, 2026
- Requires WP
- 6.4+
- Tested Up To
- 7.1
- PHP Version
- 8.0 or higher
- Author
- RoyDG
Support & Rating
- Rating
- ☆ ☆ ☆ ☆ ☆ 0
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,751
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,006
Contact Form 7
10M+ installs
#3
WPForms - AI Form Builder for WordPress - Contact Forms, Payment Forms, Survey Form, Quiz & More
5M+ installs
#9
Jetpack - WP Security, Backup, Speed, & Growth
3M+ installs
#18
MC4WP: Mailchimp for WordPress
1M+ installs
#34
Hostinger Reach - AI-Powered Email Marketing for WordPress
1M+ installs
#44
Flamingo
800K+ installs
#80
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
700K+ installs
#83
Joinchat - Enhanced "click to chat"
700K+ installs
#88
Frequently Asked Questions
Common questions about Wynko for Laposta
Laposta explains it here: https://docs.laposta.org/article/947-how-do-i-get-an-api-key Paste the key into Wynko → Settings. Wynko makes a live check with Laposta before saving, so an invalid key is caught straight away.
Put it in your wp-config.php file rather than in the settings screen: define( 'WYNKO_API_KEY', 'your-laposta-api-key' ); Why this is better: your database gets backed up, exported, copied to staging sites, and is the first thing an attacker goes looking for. A key in wp-config.php isn't in any of that. It also means the key travels with your deployment rather than being re-entered by hand on every environment. Two things to know: A key defined this way always takes priority, and Wynko won't save a database value that would shadow it. Because it isn't in the database, uninstalling Wynko won't remove it. Delete the line from wp-config.php yourself when you're done. On multisite, add the blog ID to give one site its own key — for example WYNKO_API_KEY_3.
When your server allows it: if the sodium PHP extension is available (bundled with PHP since 7.2, so almost every host has it) and your site has real SECURE_AUTH_KEY/SECURE_AUTH_SALT values in wp-config.php — the ones WordPress itself generates, and the same ones you'd rotate as part of an incident response — Wynko seals the key with authenticated encryption (libsodium's secretbox) before writing it to the database. A raw database export, a SQL-injection leak, or an administrator browsing the options table doesn't hand over a usable key.
What it doesn't protect against: anyone who can also read wp-config.php. Your security salts live there, right alongside your database credentials, so someone with filesystem access already has everything needed to open the key. For that level of protection, keep the key out of the database entirely with the WYNKO_API_KEY constant or environment variable described above. If you rotate SECURE_AUTH_KEY — standard practice after a suspected leak — every previously sealed key becomes unreadable on purpose. Wynko treats that exactly like no key being configured (it will never send garbage to Laposta), and the settings screen tells you plainly what happened so you can re-enter it. If your server has no sodium extension, or your site is still running WordPress's placeholder salts, the key is stored as plain text and the settings screen says so.
Yes. Every setting below can come from an environment variable (your .env file, web server config, or container definition) or a wp-config.php constant. An environment variable always outranks a constant, and a constant always outranks whatever is saved on the settings screen. On multisite, suffix the blog ID to override one site only — for example WYNKO_API_KEY_3 or WYNKO_THROTTLE_WINDOW_3 — otherwise the value applies network-wide. WYNKO_API_KEY — the Laposta API key (see above). WYNKO_CACHE_MINUTES — how long campaign data is cached before Laposta is asked again. Default: 60. WYNKO_LOG_LEVEL — the lowest severity recorded in the activity log: error, warning, or info. Default: info. WYNKO_THROTTLE_WINDOW — the signup rate-limit window, in minutes. Default: 10. WYNKO_THROTTLE_IP_MAX — signups one visitor may submit per window, across all your forms. Default: 15. WYNKO_THROTTLE_FORM_MAX — signups one form may take per window, from every visitor combined. Default: 400. WYNKO_NOTIFY_ENABLED — whether critical-error email alerts are on. Default: off. WYNKO_NOTIFY_EMAILS — comma-separated addresses that receive those alerts.
A few layers, all before anything reaches Laposta: A hidden honeypot field — a bot that fills it in is shown the normal success message, but nothing is actually sent to Laposta. Rate limiting per visitor and per form, over a rolling window (see the next question for the defaults and how to tune them). Full server-side validation against the list's real fields in Laposta, regardless of what a script sends — required fields, allowed choices, value ranges, text length and patterns. A security token scoped to each individual form, checked before anything else in the submission is read. Identical responses to a forged token, an unknown form, and a rate-limited request, so a script probing the endpoint can't learn which check it failed. "Already subscribed" answered the same as a new signup by default, so the form can't be used to check whether a given address is on your list.
By default, one visitor can submit up to 15 signups, and one form can accept up to 400 signups in total, within any rolling 10-minute window. All three numbers live on the Security tab and can be changed — the per-visitor and per-form caps go up to 1000 and 100,000 respectively, and the window up to 24 hours. Raise the per-visitor cap if a shared office, school, or NAT gateway sends real visitors from a single address — that's the most common reason a legitimate visitor gets turned away. Treat the per-form cap as a backstop rather than a first line of defense: keep it well above your form's real traffic, because a form that reaches it turns away every visitor, real or not, until the window passes. If a limit ever locks out real visitors before you've had a chance to raise it, use "Reset signup limits" on the same tab to clear the counters immediately.
Yes. Every site keeps its own settings, connects to its own Laposta account, keeps its own log, and sends its own alerts on its own hourly limit.
Nothing beyond what it passes to Laposta. Signups aren't saved on your site. The activity log notes that a form was submitted and whether it worked, and names the form — but never the email address or anything else the visitor typed.
As many as you need. Each is bound to its own Laposta list and has its own fields, messages and settings.
