Connect

Overview

Connect is the bridge between your WordPress site and the WPStack mobile app — and the module that sends your data anywhere else you want it.

It does two jobs. First, it puts your site in your pocket: pair a phone once and every enquiry, booking and message lands in a single inbox you can act on — reply to a chat, confirm an appointment, call someone back, scan a ticket at the door. Second, it posts those same events outward to Make, Zapier, n8n or your own CRM, so the rest of your stack hears about them without anyone copying anything.

• One inbox — chats, form entries, callbacks, bookings and event registrations in a single list.
• Push notifications when something new arrives.
• Act, don't just read — reply, confirm, reschedule, call back, check in.
• A door scanner for event tickets, with undo.
• 17 webhook events across four modules, signed and one-way.
• Multi-site — pair several sites to one phone and switch between them.

Requirements & compatibility

Pairing a device

One scan, or one copy-paste. No account to create on the phone.

How many devices?

The inbox

Everything that needs you, in one place, with the counts that matter.

Choosing which sections appear

Under WPStack → Connect → Settings.

Connect lists every section this site can show, derived from the modules actually running, with a switch for each. Turn one off and it disappears from the app for every paired device.

The ticket scanner

Check people in at the door with the phone you already have.

Open an event and tap Scan tickets, or use the scan button on the Events tab to accept any ticket for any event. Point the camera at a ticket QR code and it checks in, with a distinct vibration for accepted, already-scanned and invalid.

• Two modes — check in instantly, or show the ticket first and confirm. Pick whichever suits your door; the choice is remembered per device.
• Wrong-event warning — a valid ticket for a different event is flagged rather than silently accepted.
• Undo — a mistaken scan is reversible on the spot.
• A running count of how many you have scanned this session.

Push notifications

Every paired device is notified when a booking is made, a form is submitted, a callback is requested, a visitor sends a chat message, or someone registers for an event. Tapping the notification opens the right section.

Webhooks & integrations

Send what happens on your site straight to Make, Zapier, n8n or your own CRM.

Under WPStack → Connect → Integrations, paste the URL your automation tool generated, pick the module, tick the events it should receive, and press Send test so the receiver can learn the field structure. Add as many endpoints as you like — each one gets its own event list and its own signing secret.

The 17 events

What a delivery looks like

{
  "event": "booking.created",
  "site": "https://example.com",
  "occurred_at": "2026-09-03T09:15:00+00:00",
  "data": {
    "id": 412,
    "client_name": "Sam Devlin",
    "client_email": "[email protected]",
    "service": "Consultation",
    "date": "2026-09-14",
    "time": "10:00",
    "status": "confirmed"
  }
}

When something fails

Delivery happens outside the visitor's request, so a slow endpoint never delays a booking. A failure is retried once after a minute, then recorded. The Integrations screen keeps the last 50 deliveries with their status codes, and each endpoint shows its own health — delivered, failing, paused, or listening for nothing.

For developers

Every webhook is a WordPress action first, so you can handle it in code without Connect at all.

These fire from the modules themselves, on every path — the website, wp-admin and the mobile app. The full table with argument signatures is rendered at the bottom of the Integrations screen, kept in sync with the code that fires them.

add_action( 'wpstack_booking_status_changed', function ( $booking_id, $new, $old ) {
    if ( 'cancelled' !== $new ) {
        return;
    }
    // …free a resource, notify a colleague, write to your own table…
}, 10, 3 );

Security

What the module can and cannot do, stated plainly.

• One public route. Pairing is the only endpoint open without a token, and it is rate-limited against guessing.
• Session tokens are stored hashed. The plaintext exists on the phone and nowhere else.
• Webhooks are outbound only. No REST route, no AJAX handler, no way in.
• Signing secrets are encrypted at rest and never written into scheduled-task arguments, where any plugin could read them.
• Replies cannot be redirected. When you answer a form entry from the app, the recipient is resolved on the server from the stored entry — the phone never supplies an address, so a stolen token cannot turn your site into a spam relay.
• Revocation is immediate. Removing a device from the Devices screen invalidates its token on the next request.

Frequently asked questions