About this plugin
Vinh XD Form Notifications for Zalo OA sends a message through the official Zalo Official Account (OA) API every time a visitor submits a Fluent Forms or Contact Form 7 form, so you can respond to leads in seconds.
This plugin is not affiliated with or endorsed by Zalo or VNG Corporation. It uses only the official, documented Zalo OA API.
Features
- Works with Fluent Forms and Contact Form 7.
- Per-form configuration: enable, recipient, message template, optional webhook. A table lists all configured forms with Edit, Enable/Disable and Delete actions.
- Message templates with placeholders: {all_data}, {ip}, {embed_post.permalink}, {form_title}, {submitted_at} and any field name, including Fluent Forms style {inputs.names.last_name}.
- Sends immediately after the submission (no dependency on WP-Cron); WP-Cron is only used for retries.
- Automatic access token refresh using your OA refresh token.
- Delivery logs with status filters and automatic cleanup.
- Anti-spam: rate limit (default 3 messages / 10 minutes and 20 messages / day, editable), one summary message for held submissions, duplicate detection, link / foreign-script / IP-flood filters, and a hidden honeypot field.
- No tracking, no external assets. Credentials are stored encrypted using your WordPress salts.
Requirements
- A Zalo Official Account and an app on Zalo for Developers linked to it.
- The recipient must be the OA user_id of a person who follows or has interacted with your OA (Zalo OA cannot message arbitrary phone numbers).
External services
This plugin connects to the Zalo Official Account API, operated by VNG Corporation, to deliver notifications. It is required for the plugin’s core function.
- openapi.zalo.me ( https://openapi.zalo.me/v3.0/oa/message/cs ): called each time a configured form is submitted (and when you click “Send test”, or when a failed message is retried). Data sent: the recipient OA user_id, the notification text built from your template (which may include the submitted form fields, the visitor’s IP address and the page URL), and your OA access token.
- oauth.zaloapp.com ( https://oauth.zaloapp.com/v4/oa/access_token ): called when the access token is about to expire, once a day, or when you click “Refresh access token now”. Data sent: your App ID, Secret Key and refresh token.
Nothing is sent before you enter your OA credentials and enable a form.
vn/dieukhoan/
me/zalo/policy/
me/docs/official-account/bat-dau/dieu-khoan-dich-vu
If you set an optional webhook URL, a JSON copy of each notification (form id, title, message, time; raw fields are not included) is also posted to that URL, which you control.