About this plugin
Two jobs, both done properly. Brevo SMTP, without a second plugin. Point wp_mail() at Brevo and your site’s email — order receipts, password resets, form notifications — leaves through an account that is actually allowed to send it, instead of your host’s unauthenticated mail() . Choose the Brevo API over HTTPS (works on hosts that block outbound SMTP ports) or the classic Brevo SMTP relay. Off until you switch it on, so installing this plugin never silently reroutes your mail. Every form submission becomes a Brevo contact. Brevo’s own plugin only syncs contacts from Brevo’s own sign-up forms — anything a visitor types into WPForms, Formidable, Contact Form 7 or Forminator never reaches your lists. Map a form to a Brevo list once, and from then on every submission is added automatically, with the right values in the right contact attributes, a record of the consent the visitor gave, and a log entry you can open when something looks wrong. Disclaimer: Rewind Form Bridge for Brevo is an independent, third-party plugin. It is not affiliated with, endorsed by, or an official partner of Brevo (Sendinblue SAS). “Brevo” and “Sendinblue” are trademarks of their respective owner. This plugin simply connects to the publicly documented Brevo API using an API key you create in your own Brevo account. What it does Brevo SMTP or Brevo API for site email. One toggle, a sender address, and wp_mail() goes out through Brevo. Delivery failures are recorded and shown on the dashboard instead of vanishing. Optional and off by default. Maps any field to any attribute. Pick a form field, pick a Brevo contact attribute, done. No paywall on the mapping UI. Type coercion that stops silent data loss. Brevo accepts a request whose value does not match the attribute’s declared type — and then quietly drops the value. No error, no warning, an empty field. This plugin validates and converts every value against the attribute’s real type before sending, so a date lands as a date and a number lands as a number. Phone numbers normalised to E.164. Brevo rejects or mis-stores a bare local number. Set a default country and local numbers are converted to the international form Brevo expects. Consent capture, on by default. A feed will not send anything unless a consent checkbox is mapped and ticked. You can switch that off per feed, and the screen tells you plainly what you are switching off. A real delivery log. Every submission gets a row: status, HTTP code, Brevo’s error code translated into a sentence a human can act on, and the exact request and response bodies. Retry a failed delivery from the log. Failure alerts. After a run of consecutive failures, an email goes out so a revoked API key does not silently swallow a month of sign-ups. Never calls the API behind your back. No request is made on activation, on admin page loads, or before you save a key. Lists and attributes are cached and refreshed only when you ask. Supported form plugins WPForms (Lite and Pro) Formidable Forms (Lite and Pro) Contact Form 7 Forminator Each integration is written against that plugin’s own submission hook, so composite fields are handled properly: a WPForms, Formidable or Forminator Name field exposes its first, middle and last parts as separate mappable values, and Address fields expose street, city, state, postal code and country. The adapter layer is public — additional form plugins can be added by filtering rbfb_adapters . Your API key Brevo API keys are account-wide — Brevo does not offer scoped keys. The key is stored in the options table, shown in the dashboard as its last four characters only, and never included in a REST response, a log entry or an export. If you would rather keep it out of the database entirely, define it in wp-config.php and the field becomes read-only: define( 'RBFB_API_KEY', 'your-key-here' ); External Services This plugin connects to Brevo, a third-party email marketing and transactional email service, because sending your form submissions to Brevo is the entire purpose of the plugin. No request is ever made until you enter your own Brevo API key. Brevo API — https://api.brevo.com/v3 (service homepage: https://www.brevo.com/) What is sent, and when: When you click “Test connection”: nothing but your API key, to GET /account, to confirm the key works and to read your account name. When you open the field-mapping screen and ask to refresh: your API key, to GET /contacts/lists, GET /contacts/folders and GET /contacts/attributes , to read back the lists and contact attributes in your account. Results are cached locally for 15 minutes. When you create a contact attribute from the mapping screen: the attribute name and type, to POST /contacts/attributes/{category}/{name} . When a visitor submits a form you have mapped: the submitted email address, the form values you mapped to Brevo attributes, and the IDs of the lists you chose, to POST /contacts . Only if you switch on “Site email”: your API key, to GET /senders , to read back the verified sender addresses on your Brevo account so you can pick one. Only if you switch on “Site email” with the API transport: the recipients, subject and body of the emails your site sends via wp_mail() , to POST /smtp/email. Brevo SMTP relay — smtp-relay.brevo.com Only if you switch on “Site email” and choose the SMTP transport. Your SMTP login, SMTP key, and the recipients, subject and body of each outgoing email are sent to Brevo’s relay over an authenticated TLS connection. By using this plugin you are sending data to Brevo, and Brevo’s own terms govern that data: Terms of Service: https://www.brevo.com/legal/termsofuse/ Privacy Policy: https://www.brevo.com/legal/privacypolicy/ The plugin makes no other outbound request. It contacts no analytics service, no licensing server, and no CDN — fonts and scripts are all served from your own site. Privacy The plugin stores three tables in your own database: mapped feeds, a delivery log (submitted values, request and response bodies, capped at 64KB each), and a consent record (email address, the exact consent wording the visitor saw, the page URL and the visitor’s IP address). Consent records exist so you can prove a subscription was asked for, which is why nothing is deleted when you uninstall unless you first tick “Delete all plugin data when the plugin is uninstalled” on the Settings screen. Log entries can be cleared at any time from the Logs screen. Source Code The admin dashboard is a React application compiled with @wordpress/scripts . Everything in assets/ is build output — assets/admin.js , its stylesheets, and the hashed font files in assets/fonts/ . The complete, unminified source those are built from ships inside this plugin, in src/ , including the original font files in src/admin/fonts/ . Nothing has to be downloaded to inspect or rebuild it. To rebuild from the plugin folder: npm install npm run build That reads src/admin/index.js and rewrites assets/ . No minified or obfuscated third-party code is bundled. React, ReactDOM, the JSX runtime and every @wordpress/* package are loaded from the copies WordPress core already ships, declared as script dependencies in assets/admin.asset.php. Credits Poppins by Indian Type Foundry and Jonny Pinhorn, licensed under the SIL Open Font License 1.1 (https://scripts.sil.org/OFL) and self-hosted. Portions of the React component kit are derived from Ninja Drive by Plugininja, licensed GPL-2.0-or-later. See LICENSE.txt in the plugin folder for the full list of bundled assets and their licences.