Hypamoon Connect Wordpress Plugin - Rating, Reviews, Demo & Download
Plugin Description
Hypamoon Connect links your WordPress site to your Hypamoon project. It does two things.
Hypamoon on your site. Visitors get answers at night and in the weekend, and every message of your contact form lands in one place, with an email to you.
- The chat window of your Hypamoon project on every page. The assistant of your project answers, with your own business name.
- Contact forms that send their entries to your Hypamoon project, with an email for each entry, a bot check and a hidden spam trap. Add one to a page with the “Hypamoon form” block or a shortcode like
[hypamoon_form id="contact"]. - No code to paste. Ask your AI assistant connected to Hypamoon, for example “put the chat and a contact form on my WordPress site”, then open Tools > Hypamoon, Site tools. Or turn the chat on there yourself.
- The chat and forms keep working when the connection of the plugin expires. Turn them off under Tools > Hypamoon.
Moving your data. Moving a site often stops at the login screen. Public pages are easy to copy, but drafts, private posts, form entries, orders and customers sit behind your WordPress login. Hypamoon Connect moves that data to your own Hypamoon project, without screenshots and without sharing a password in a chat.
You need a Hypamoon account to use this plugin. You can start with a free test project at https://app.hypamoon.com.
Two ways to work. Simple (the default for a new installation): the plugin only connects and shows what was sent; your chat with your AI assistant suggests what to move, asks you to confirm, and starts it. Full: every choice on this screen, with the suggestion of your chat shown on top so you can apply it. You can switch at any time; your selection stays.
How moving works:
- Create a one-time code in your Hypamoon project under Sites, or ask your AI assistant connected to Hypamoon for one.
- Enter the code under Tools > Hypamoon, Connection, and press Connect.
- The plugin sends an overview of your site: counts, dates and field names only, never content.
- Choose what moves: tell your chat what you want (for example “move my hours portal”) and it suggests a selection with a reason per kind of data; or choose in your Hypamoon project, or in WordPress under Move data. For every kind of data you see the number of items, example fields with their type, an estimated size, whether it holds personal data and why, the collection it goes to and the links that become references. Personal data stays off until you turn it on, also with Select all.
- Press Send. The data goes in small batches with a progress bar, so it works on shared hosting. If the connection drops, press Resume: nothing is sent twice.
What can move:
- Posts, pages and public custom post types, including drafts, pending, private and scheduled items
- Post types that are not public, like hours, applications or bookings of a member portal (off until you choose them, kept private)
- Custom fields from Advanced Custom Fields, ACF Pro or Secure Custom Fields, in full: repeaters, flexible content, groups, images, relationships, plus field group definitions and options pages
- Categories, tags and other terms
- Media, as URLs only (files are not copied)
- Menus
- Form entries from Contact Form 7 (through Flamingo), WPForms and Gravity Forms
- WooCommerce products and variations, orders with refunds and notes, customers, coupons, shipping zones, tax rates, product reviews and an overview of WooCommerce Subscriptions
- Users: name, email and role, never passwords. With “All fields” also the other user fields, like a client id
- Links between your data: a field that points to a user or a post (for example a client id on a timesheet) becomes a reference to that record in your project
- Tables that a plugin or theme made in your database, with their columns (off until you choose them, kept private; WordPress core tables are never offered)
- Settings from the options table that you tick one by one. Settings that look like a password, key or token are never listed and never sent
You can send again later. Records that were sent before are updated, never duplicated.
A WP-CLI command is included for large sites: wp hypamoon connect <code>, wp hypamoon status, wp hypamoon inventory, wp hypamoon selection, wp hypamoon export (with --dry-run, --include, --users and --restart) and wp hypamoon disconnect.
For developers: the filter hypamoon_connect_record lets you change or leave out a record before it is sent, hypamoon_connect_post_types changes the list of post types that are offered, hypamoon_connect_private_post_types and hypamoon_connect_tables narrow the post types that are not public and the database tables that are offered, and hypamoon_connect_show_chat decides per page view whether the chat window is shown (for example to wait for consent).
Privacy
Moving data. What is sent: only the data you select, plus an overview of your site (counts, oldest and newest dates, statuses, form field names and custom field definitions, never content). Personal data (form entries, orders, customers, subscriptions, reviews, users, post types that are not public and database tables of plugins) is off by default. Settings from the options table move only by name, when you tick them.
To whom: Hypamoon, the Netherlands, into your own Hypamoon project.
When: when an administrator presses Connect, Refresh inventory, Load latest selection, Save selection, Send, Apply suggestion and Save, Dismiss or Disconnect, or runs a WP-CLI command of this plugin. While the site is connected, a light check every five minutes (WP-Cron) asks Hypamoon whether you asked your chat to send your selection; only then is the selection sent, the one you confirmed in your chat or here. Hypamoon can start that check right away with a signed wake request without data. Personal data only goes when you said yes to it. Log, security and analytics tables, and tables with email or IP address columns, are never selected for you.
Where it goes: into collections in your own project, such as wp_posts, wp_pages, wp_media, wp_menus, wp_terms, wp_acf, wp_form_, wp_products, wp_orders, wp_customers, wp_shop_settings, wp_reviews, wp_subscriptions, wp_users, wp_table_ and wp_options. Collections with personal data are always private. Everything is private by default; the project owner decides what is published.
Never sent: passwords, password hashes, sessions, keys and tokens, application passwords, post passwords and payment details. IP addresses and user agents only go along in a database table that you tick yourself.
Chat window and forms. When they are on your site, the browser of a visitor sends chat messages and form entries straight to your Hypamoon project, together with the address of the page and, as with any request, the IP address and browser of the visitor. Hypamoon uses them to answer, to store the entry, to email it to you, and to stop abuse with limits and a bot check (Cloudflare Turnstile). They go to Hypamoon, the Netherlands, as a processor for you. Your WordPress server sends nothing about visitors.
The plugin stores its connection details in the WordPress options table, without autoload, and the chat and form settings in one small option, also without autoload. Uninstalling the plugin deletes them.
Privacy policy: https://hypamoon.com/privacy
Terms: https://hypamoon.com/terms
External services
This plugin connects to the Hypamoon API (https://api.hypamoon.com), a service of Hypamoon, to move your data into your Hypamoon project.
- When you press Connect, the one-time code, the site address, the site name, the WordPress version and the plugin version are sent, and an access token is received.
- Right after connecting and when you press Refresh inventory, an overview of your site is sent: counts, dates, statuses, form field names, custom field definitions, the names of user fields and of meta fields of custom post types, the names and columns of database tables of plugins, and the names of settings (never their values), no content.
- When you load or save the selection, the selection (which kinds of data, periods, statuses, fields to leave out, whether all fields go, and which settings) is read or written.
- When you press Send or run
wp hypamoon export, the data you selected is sent in batches. - When you press Disconnect, the access token is revoked.
- When you open Move data, or the simple screen, the suggestion of your chat is read (which kinds of data, with a reason each) and whether your chat asked to send. When you apply and save it, or dismiss it, Hypamoon is told.
- While the site is connected, WP-Cron checks every five minutes whether your chat asked to send your selection. If so, the selected data is sent in batches, for at most two minutes per check and always within the time limit of PHP. The check is removed when you disconnect or deactivate the plugin.
- Wake route (since 1.4.2). Right after you confirm in your chat that your selection may be sent, Hypamoon (from api.hypamoon.com) sends a POST to https://your-site/?rest_route=/hypamoon-connect/v1/wake, so the check above runs at once instead of within five minutes. Why: without it, a site with few visitors can wait a long time for WP-Cron. The request holds no data and no token: only a timestamp, a random nonce and an HMAC-SHA256 signature over both, made with a key derived from the access token of your site. The plugin accepts it only with a valid signature, a clock at most five minutes apart and a nonce that was not used before, and at most 12 times per five minutes. It then plans the check (WP-Cron) and answers 202; the check itself sends only what you confirmed. If the route cannot be reached, nothing breaks: the five minute check picks the round up.
- When you open Tools > Hypamoon (at most once every five minutes), press Refresh, Turn chat on, Turn chat off or Set up forms, the chat and form settings for your site are read or changed: whether the chat is on, its colour, position, title and welcome text, the forms with their fields, and the public token of your project.
Every request from your WordPress server carries the access token and the address of your site. Apart from the five minute check above (or its wake), no request is made from your server without an action of an administrator, and none while other admin pages load.
The chat window and forms load scripts from the Hypamoon API in the browser of your visitors:
- The chat window loads https://api.hypamoon.com/widget.js on every page while the chat is on. It reads the chat settings from Hypamoon, and sends the messages a visitor types to your Hypamoon project, where the assistant of your project answers.
- A form loads https://api.hypamoon.com/form.js on the pages with a Hypamoon form. When a visitor sends the form, the fields are sent to your Hypamoon project.
- Both show a bot check from Hypamoon in a small frame, which uses Cloudflare Turnstile. Cloudflare terms: https://www.cloudflare.com/website-terms/ and privacy policy: https://www.cloudflare.com/privacypolicy/
These requests carry the public token of your project. It is public by design: it can only chat and add form entries, only from your site, with limits.
Terms of service: https://hypamoon.com/terms
Privacy policy: https://hypamoon.com/privacy
Screenshots
No screenshots provided
