Rewind Form Bridge for Brevo

Two jobs, both done properly.

Brevo SMTP, without a second plugin. Point wp_mail() at Brevo and your

site’s email — order receipts, password resets, form notifications — leaves

through an account that is actually allowed to send it, instead of your host’s

unauthenticated mail(). Choose the Brevo API over HTTPS (works on hosts that

block outbound SMTP ports) or the classic Brevo SMTP relay. Off until you

switch it on, so installing this plugin never silently reroutes your mail.

Every form submission becomes a Brevo contact. Brevo’s own plugin only

syncs contacts from Brevo’s own sign-up forms — anything a visitor types into

WPForms, Formidable, Contact Form 7 or Forminator never reaches your lists.

Map a form to a Brevo list once, and from then on every submission is added

automatically, with the right values in the right contact attributes, a record

of the consent the visitor gave, and a log entry you can open when something

looks wrong.

Disclaimer: Rewind Form Bridge for Brevo is an independent, third-party plugin.

It is not affiliated with, endorsed by, or an official partner of Brevo

(Sendinblue SAS). “Brevo” and “Sendinblue” are trademarks of their respective

owner. This plugin simply connects to the publicly documented Brevo API using

an API key you create in your own Brevo account.

What it does

• Brevo SMTP or Brevo API for site email. One toggle, a sender address,

and wp_mail() goes out through Brevo. Delivery failures are recorded and

shown on the dashboard instead of vanishing. Optional and off by default.

• Maps any field to any attribute. Pick a form field, pick a Brevo contact

attribute, done. No paywall on the mapping UI.

• Type coercion that stops silent data loss. Brevo accepts a request whose

value does not match the attribute’s declared type — and then quietly drops

the value. No error, no warning, an empty field. This plugin validates and

converts every value against the attribute’s real type before sending, so a

date lands as a date and a number lands as a number.

• Phone numbers normalised to E.164. Brevo rejects or mis-stores a bare

local number. Set a default country and local numbers are converted to the

international form Brevo expects.

• Consent capture, on by default. A feed will not send anything unless a

consent checkbox is mapped and ticked. You can switch that off per feed, and

the screen tells you plainly what you are switching off.

• A real delivery log. Every submission gets a row: status, HTTP code,

Brevo’s error code translated into a sentence a human can act on, and the

exact request and response bodies. Retry a failed delivery from the log.

• Failure alerts. After a run of consecutive failures, an email goes out so

a revoked API key does not silently swallow a month of sign-ups.

• Never calls the API behind your back. No request is made on activation,

on admin page loads, or before you save a key. Lists and attributes are

cached and refreshed only when you ask.

Supported form plugins

• WPForms (Lite and Pro)

• Formidable Forms (Lite and Pro)

• Contact Form 7

• Forminator

Each integration is written against that plugin’s own submission hook, so

composite fields are handled properly: a WPForms, Formidable or Forminator

Name field exposes its first, middle and last parts as separate mappable

values, and Address fields expose street, city, state, postal code and

country. The adapter layer is public — additional form plugins can be added by

filtering rbfb_adapters.

Your API key

Brevo API keys are account-wide — Brevo does not offer scoped keys. The key is

stored in the options table, shown in the dashboard as its last four characters

only, and never included in a REST response, a log entry or an export. If you

php

and the field becomes read-only:

define( 'RBFB_API_KEY', 'your-key-here' );

External Services

This plugin connects to Brevo, a third-party email marketing and transactional

email service, because sending your form submissions to Brevo is the entire

purpose of the plugin. No request is ever made until you enter your own Brevo

API key.

com/)

What is sent, and when:

• When you click “Test connection”: nothing but your API key, to

GET /account, to confirm the key works and to read your account name.

• When you open the field-mapping screen and ask to refresh: your API key, to

GET /contacts/lists, GET /contacts/folders and GET /contacts/attributes,

to read back the lists and contact attributes in your account. Results are

cached locally for 15 minutes.

• When you create a contact attribute from the mapping screen: the attribute

name and type, to POST /contacts/attributes/{category}/{name}.

• When a visitor submits a form you have mapped: the submitted email address,

the form values you mapped to Brevo attributes, and the IDs of the lists you

chose, to POST /contacts.

• Only if you switch on “Site email”: your API key, to GET /senders, to read

back the verified sender addresses on your Brevo account so you can pick one.

• Only if you switch on “Site email” with the API transport: the recipients,

subject and body of the emails your site sends via wp_mail(), to

POST /smtp/email.

com

Only if you switch on “Site email” and choose the SMTP transport. Your SMTP

login, SMTP key, and the recipients, subject and body of each outgoing email

are sent to Brevo’s relay over an authenticated TLS connection.

By using this plugin you are sending data to Brevo, and Brevo’s own terms

govern that data:

• Terms of Service: https://www.brevo.com/legal/termsofuse/

• Privacy Policy: https://www.brevo.com/legal/privacypolicy/

The plugin makes no other outbound request. It contacts no analytics service,

no licensing server, and no CDN — fonts and scripts are all served from your

own site.

Privacy

The plugin stores three tables in your own database: mapped feeds, a delivery

log (submitted values, request and response bodies, capped at 64KB each), and a

consent record (email address, the exact consent wording the visitor saw, the

page URL and the visitor’s IP address).

Consent records exist so you can prove a subscription was asked for, which is

why nothing is deleted when you uninstall unless you first tick “Delete all

plugin data when the plugin is uninstalled” on the Settings screen. Log entries

can be cleared at any time from the Logs screen.

Source Code

The admin dashboard is a React application compiled with @wordpress/scripts.

js, its stylesheets,

and the hashed font files in assets/fonts/. The complete, unminified source

those are built from ships inside this plugin, in src/, including the

original font files in src/admin/fonts/. Nothing has to be downloaded to

inspect or rebuild it.

To rebuild from the plugin folder:

• npm install

• npm run build

js and rewrites assets/.

No minified or obfuscated third-party code is bundled. React, ReactDOM, the JSX

runtime and every @wordpress/* package are loaded from the copies WordPress

core already ships, declared as script dependencies in

php.

Credits

• Poppins by Indian Type Foundry and Jonny Pinhorn, licensed under the SIL Open

org/OFL) and self-hosted.

• Portions of the React component kit are derived from Ninja Drive by

0-or-later.

txt in the plugin folder for the full list of bundled assets and

their licences.