{"id":369289,"date":"2026-10-08T10:41:49","date_gmt":"2026-10-08T10:41:49","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/zaplane\/"},"modified":"2026-10-15T14:06:15","modified_gmt":"2026-10-15T14:06:15","slug":"zaplane","status":"publish","type":"plugin","link":"https:\/\/kea.wordpress.org\/plugins\/zaplane\/","author":20964119,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.5.0","stable_tag":"1.5.0","tested":"7.0.7","requires":"6.8","requires_php":"7.4","requires_plugins":null,"header_name":"Zaplane - AI Agent Automation & Workflow Builder","header_author":"kodezen","header_description":"WordPress Automation Plugin","assets_banners_color":"8ebbf8","last_updated":"2026-10-15 14:06:15","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/zaplane.app\/","header_author_uri":"https:\/\/kodezen.com","rating":0,"author_block_rating":0,"active_installs":0,"downloads":183,"num_ratings":0,"support_threads":1,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.4.0":{"tag":"1.4.0","author":"kodezen","date":"2026-10-08 10:41:22","revision":3734302},"1.5.0":{"tag":"1.5.0","author":"kodezen","date":"2026-10-15 14:06:15","revision":3748653}},"upgrade_notice":{"1.4.0":"<p>Zaplane now exposes its automations as abilities through the WordPress Abilities API; the previous Zaplane-operated MCP server has been removed. The Custom PHP Code step is no longer bundled. Minimum WordPress is 6.8.<\/p>","1.3.3":"<p>Workflows started by a webhook or an outside service can no longer run actions that administer the site.<\/p>","1.3.2":"<p>MCP clients can no longer use actions that administer the site, and PHP 7.4 compatibility is fixed.<\/p>","1.3.1":"<p>Security hardening throughout, and two actions removed: Switch Theme and Authenticate User.<\/p>","1.3.0":"<p>Adds multiple triggers per workflow, group recipes, WordPress AI Client support and OAuth sign-in for AI clients, and fixes security issues. Requires WordPress 6.8 or later. MCP tokens issued to users without administrator rights stop working.<\/p>","1.2.0":"<p>Adds aBlocks and FluentCart integrations, an optional MCP server and a rebuilt dark theme. Optional modules are off on new sites. The Dokan &quot;Withdraw Request Pending&quot; and FluentCart &quot;Order Paid Done&quot; triggers were removed; re-select the trigger in any workflow using them.<\/p>","1.1.0":"<p>Major feature release: StoreEngine, AI Agent (with MCP), AI Chat Model, Memory, Business Knowledge, Custom Apps, a bidirectional Webhook app, and many new tools and flow-control nodes.<\/p>","1.0.2":"<p>Recommended update with stability improvements and bug fixes.<\/p>"},"ratings":[],"assets_icons":{"icon-256x256.png":{"filename":"icon-256x256.png","revision":3748638,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3748638,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3748638,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.4.0","1.5.0"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"The visual workflow builder canvas.","2":"Choosing a trigger for a new automation.","3":"Configuring an action step.","4":"Browsing ready-made recipe templates.","5":"Workflow run history and logs."}},"plugin_section":[],"plugin_tags":[232494,569,597,15439,8197],"plugin_category":[],"plugin_contributors":[223170,177102],"plugin_business_model":[],"class_list":["post-369289","plugin","type-plugin","status-publish","hentry","plugin_tags-ai-agent","plugin_tags-automation","plugin_tags-integration","plugin_tags-webhook","plugin_tags-workflow","plugin_contributors-kodezen","plugin_contributors-tusharimran","plugin_committers-kodezen"],"banners":{"banner":"https:\/\/ps.w.org\/zaplane\/assets\/banner-772x250.png?rev=3748638","banner_2x":"https:\/\/ps.w.org\/zaplane\/assets\/banner-1544x500.png?rev=3748638","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/zaplane\/assets\/icon-256x256.png?rev=3748638","icon_2x":"https:\/\/ps.w.org\/zaplane\/assets\/icon-256x256.png?rev=3748638","generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p><strong>Zaplane<\/strong> is a no-code <strong>WordPress automation<\/strong> plugin and workflow builder that runs entirely inside your WordPress site. Connect a <strong>trigger<\/strong> (a WooCommerce order placed, a form submitted, a user registered, a subscription renewed, a webhook received) to one or more <strong>actions<\/strong> (send an email, add a contact to your CRM, post a Slack message, create a Trello card, call an API) with delays, conditions, filters, loops and AI steps in between.<\/p>\n\n<p>Build <strong>automation workflows<\/strong> visually on a drag-and-drop canvas \u2014 no code required \u2014 and let them run reliably in the background on Action Scheduler, the same queue WooCommerce uses.<\/p>\n\n<h4>Why Zaplane?<\/h4>\n\n<ul>\n<li><strong>No-code visual workflow builder<\/strong> \u2014 design automations by connecting trigger and action nodes on a flow canvas.<\/li>\n<li><strong>Self-hosted \u2014 no per-task fees<\/strong> \u2014 workflows, run history and credentials stay in your own WordPress database. No external automation service to pay per task or per workflow. Data reaches a third-party only when a workflow or connection you set up uses it (see External services).<\/li>\n<li><strong>100+ integrations<\/strong> \u2014 WooCommerce, Easy Digital Downloads, FluentCRM, Mailchimp, Slack, Discord, Telegram, WhatsApp, Gmail, Google Sheets, Zoom, LearnDash, Tutor LMS, Elementor, Fluent Forms, Gravity Forms, WPForms, Contact Form 7 and many more (full list below).<\/li>\n<li><strong>Flow control steps<\/strong> \u2014 Delay, Condition, Filter, Router (multi-branch), Iterator (loop), Set Variable, HTTP Request, Send\/Catch Webhook, Human Approval, Schedule, Manual trigger, Sticky Note.<\/li>\n<li><strong>Reliable background processing<\/strong> \u2014 long-running and scheduled steps run on Action Scheduler.<\/li>\n<li><strong>Ready-made recipes<\/strong> \u2014 templates for abandoned carts, birthday messages, win-backs, upsells, review requests, order confirmations, lead nurturing and more.<\/li>\n<li><strong>Optional AI automation<\/strong> \u2014 write replies, run a tool-calling AI Agent, generate images, or search your own knowledge base, through the WordPress AI Client (when available in core) or your own OpenAI, Anthropic or Gemini key.<\/li>\n<li><strong>AI access through the WordPress Abilities API<\/strong> \u2014 Zaplane registers its workflow capabilities as abilities. Install an MCP adapter and an AI client you approve can discover, build and run workflows. Zaplane runs no server of its own, and every ability requires an administrator.<\/li>\n<li><strong>Build your own integrations<\/strong> \u2014 Custom Apps let you add any REST API or WordPress hook as a trigger or action without writing a plugin.<\/li>\n<li><strong>GPL-3.0, 100% free, no premium upsell<\/strong> \u2014 every integration, trigger, action and recipe is in this plugin.<\/li>\n<\/ul>\n\n<h4>What you can automate<\/h4>\n\n<ul>\n<li><strong>WooCommerce automation<\/strong> \u2014 welcome new customers, recover abandoned carts, follow up on orders, tag high-value buyers in your CRM, notify Slack when a product goes out of stock, send a review request after delivery, trigger subscription renewal reminders.<\/li>\n<li><strong>CRM &amp; marketing automation<\/strong> \u2014 add form submissions to FluentCRM \/ Mailchimp \/ Brevo \/ ActiveCampaign \/ Groundhogg \/ GemCRM, apply or remove tags, enrol contacts in sequences, sync between CRMs, send birthday emails.<\/li>\n<li><strong>Form automation<\/strong> \u2014 route Fluent Forms, Gravity Forms, WPForms, Contact Form 7, Formidable, Ninja Forms, Fillout, Typeform or Jotform submissions to any destination; create tickets, cards, deals, posts, users or orders from a form.<\/li>\n<li><strong>LMS automation<\/strong> \u2014 enrol learners on LearnDash, Tutor LMS, LifterLMS, MasterStudy or Academy courses, grant membership on purchase, email instructors on course completion, award points, print certificates.<\/li>\n<li><strong>Membership automation<\/strong> \u2014 provision access on MemberPress, Paid Memberships Pro, SureMembers, BuddyBoss or Ultimate Member when a payment succeeds; downgrade on cancellation; sync membership status to a CRM.<\/li>\n<li><strong>Messaging automation<\/strong> \u2014 post to Slack, Discord, Telegram or Microsoft Teams-style channels, send Gmail \/ SureMail replies, auto-reply on WhatsApp or Facebook Messenger, create Zoom or Google Meet meetings.<\/li>\n<li><strong>Content &amp; publishing automation<\/strong> \u2014 publish posts across sites, update ACF \/ Meta Box \/ JetEngine fields, add Events Calendar events, generate PDFs, send Google Docs \/ Google Sheets.<\/li>\n<li><strong>AI automation<\/strong> \u2014 route a form submission through an AI Agent, summarise support emails, auto-reply to webhooks with your knowledge base, translate content, extract structured data.<\/li>\n<li><strong>Scheduled &amp; recurring automation<\/strong> \u2014 hourly, daily, weekly or cron-based jobs; birthdays and anniversaries; polling triggers for Google Sheets \/ Google Docs; delayed follow-ups.<\/li>\n<\/ul>\n\n<h4>Flow-control &amp; utility steps<\/h4>\n\n<p>Delay (minutes, hours, days or until a date) \u00b7 Condition (if\/else) \u00b7 Filter (stop if criteria don't match) \u00b7 Router (branch into many paths) \u00b7 Iterator \/ Repeater (loop over a list) \u00b7 Set Variable \u00b7 Schedule \u00b7 Manual trigger \u00b7 Human Approval (pause for a Slack approval) \u00b7 HTTP Request \u00b7 Catch Webhook \u00b7 Send Webhook \u00b7 Formatter \u00b7 Date \/ Time \u00b7 CSV \u00b7 XML \u00b7 JSON Parser \u00b7 Image Helper \u00b7 Conversation Memory \u00b7 Business Knowledge \u00b7 MCP Client \u00b7 Sticky Note.<\/p>\n\n<h4>Full integrations list<\/h4>\n\n<p>aBlocks, ActiveCampaign, Advanced Custom Fields (ACF), AI Agent (tool-calling), AI Chat Model, Anthropic (Claude), AR Form, Avada Form, Beaver Builder, Bit Form, Booking Calendar Contact Form, Brevo, BuddyBoss, Business Knowledge, Catch Webhook, Contact Form 7, CoBlocks, Custom Apps, Discord, Divi Builder, Dokan, Easy Digital Downloads, Elementor, Essential Blocks, Facebook Messenger, Fillout, FluentCart, FluentCRM, FluentSMTP, Fluent Forms, Formidable Forms, FunnelKit, GameEngine, GamiPress, GemBoards, GemBooking, GemCRM, Gmail, Google Docs, Google Gemini, Google Meet, Google Sheets, Gravity Forms, Groundhogg, HTTP Request, JetEngine, Jotform, Kadence Blocks, LearnDash, LifterLMS, Mailchimp, MasterStudy LMS, MemberPress, Meta Box, Metform, MCP Client, Ninja Forms, OpenAI, OpenAI-compatible endpoints (Azure OpenAI, Ollama, OpenRouter, self-hosted), Paid Memberships Pro, Paymattic, Profile Builder, QuizPress, Send Webhook, Slack, Spectra, StoreEngine, SureCart, SureForms, SureMail, SureMembers, Telegram, The Events Calendar, Trello, TruePlayer, Tutor LMS, Typeform, Ultimate Member, weForms, WhatsApp, WooCommerce, WooCommerce Bookings, WordPress core (post type, taxonomy, user, option, role, custom hook), WordPress AI Client, WP Map Block, WPFunnels, WPForms, WP User Frontend, ZenAppBuilder, ZenCommunity, Zoom.<\/p>\n\n<p>Each service needs your own account with that provider. See <strong>External services<\/strong> below for exactly what Zaplane sends to each one, and when.<\/p>\n\n<h3>External services<\/h3>\n\n<p>Zaplane contacts no external service when you install, activate or browse it, and sends nothing to its authors. It talks to a third-party only after you add a connection for it, and then only when you test that connection, when the editor loads options from it, or when a step that uses it runs. Each service needs your own account; review its terms and privacy before connecting. Requests carry your site's address in the User-Agent header.<\/p>\n\n<p>The AI entries (Anthropic, Google Gemini, OpenAI, OpenAI-compatible, WordPress AI Client) apply only when a connection uses that provider.<\/p>\n\n<h4>ActiveCampaign<\/h4>\n\n<ul>\n<li>Sends: contact emails, names and phone numbers, and list \/ tag \/ automation IDs \u2014 to your account's API URL (e.g. <code>*.api-us1.com<\/code>) with your key, when you test the connection or an ActiveCampaign step runs.<\/li>\n<li>Terms: https:\/\/www.activecampaign.com\/legal\/terms-of-service \u00b7 Privacy: https:\/\/www.activecampaign.com\/legal\/privacy-policy<\/li>\n<\/ul>\n\n<h4>Anthropic<\/h4>\n\n<ul>\n<li>Sends: instructions, messages, conversation history, knowledge context, tool definitions and results, and image URLs \u2014 to <code>api.anthropic.com<\/code> with your key, when you test the connection or an AI \/ AI Agent step runs.<\/li>\n<li>Terms: https:\/\/www.anthropic.com\/legal\/commercial-terms \u00b7 Privacy: https:\/\/www.anthropic.com\/legal\/privacy<\/li>\n<\/ul>\n\n<h4>Brevo<\/h4>\n\n<ul>\n<li>Sends: contact emails, names, attributes and list IDs \u2014 to <code>api.brevo.com<\/code> with your key, when you test the connection or a Brevo step runs.<\/li>\n<li>Terms: https:\/\/www.brevo.com\/legal\/termsofuse\/ \u00b7 Privacy: https:\/\/www.brevo.com\/legal\/privacypolicy\/<\/li>\n<\/ul>\n\n<h4>Discord<\/h4>\n\n<ul>\n<li>Sends: server, channel and user IDs and the message content you configure \u2014 to Discord's API with your bot token, when you test the connection, when the editor loads channels, or when a Discord step runs.<\/li>\n<li>Terms: https:\/\/discord.com\/terms \u00b7 Privacy: https:\/\/discord.com\/privacy<\/li>\n<\/ul>\n\n<h4>Fillout<\/h4>\n\n<ul>\n<li>Sends: form IDs \u2014 to <code>api.fillout.com<\/code> with your key, when you test the connection or the editor loads forms.<\/li>\n<li>Terms: https:\/\/www.fillout.com\/terms \u00b7 Privacy: https:\/\/www.fillout.com\/privacy<\/li>\n<\/ul>\n\n<h4>Google Gemini<\/h4>\n\n<ul>\n<li>Sends: prompts, conversation history, knowledge context and images; for semantic search, knowledge titles \/ content and queries \u2014 to <code>generativelanguage.googleapis.com<\/code> with your key, when an AI step runs or (with semantic search on) knowledge is embedded or searched.<\/li>\n<li>Terms: https:\/\/ai.google.dev\/gemini-api\/terms \u00b7 Privacy: https:\/\/policies.google.com\/privacy<\/li>\n<\/ul>\n\n<h4>Google (Gmail, Calendar, Meet)<\/h4>\n\n<ul>\n<li>Sends: recipients, subjects and bodies; event titles, times, descriptions and attendee emails; OAuth codes and tokens \u2014 to Google's APIs (<code>gmail.googleapis.com<\/code>, <code>www.googleapis.com<\/code>, <code>meet.googleapis.com<\/code>, with sign-in at <code>accounts.google.com<\/code> \/ <code>oauth2.googleapis.com<\/code>) using the OAuth client you configure, when you connect, when the editor loads labels or calendars, or when a Gmail \/ Google Meet step runs.<\/li>\n<li>Terms: https:\/\/policies.google.com\/terms (and https:\/\/developers.google.com\/terms) \u00b7 Privacy: https:\/\/policies.google.com\/privacy<\/li>\n<\/ul>\n\n<h4>Jotform<\/h4>\n\n<ul>\n<li>Sends: form IDs and the form definitions you create \u2014 to <code>api.jotform.com<\/code> with your key, when you test the connection, when the editor loads forms, or when a Jotform step runs.<\/li>\n<li>Terms: https:\/\/www.jotform.com\/terms\/ \u00b7 Privacy: https:\/\/www.jotform.com\/privacy\/<\/li>\n<\/ul>\n\n<h4>Mailchimp<\/h4>\n\n<ul>\n<li>Sends: subscriber emails, merge fields, tags and audience IDs \u2014 to the <code>api.mailchimp.com<\/code> data centre named in your key, when you test the connection or a Mailchimp step runs.<\/li>\n<li>Terms: https:\/\/mailchimp.com\/legal\/terms\/ \u00b7 Privacy: https:\/\/www.intuit.com\/privacy\/statement\/<\/li>\n<\/ul>\n\n<h4>Meta (Messenger, WhatsApp)<\/h4>\n\n<ul>\n<li>Sends: recipient ID or phone number, message text, templates, media URLs and locations \u2014 to the Meta Graph API (<code>graph.facebook.com<\/code>) with your page or WhatsApp Business token, when you test the connection or a Messenger \/ WhatsApp step runs.<\/li>\n<li>Terms: https:\/\/developers.facebook.com\/terms\/ and https:\/\/www.whatsapp.com\/legal\/business-terms \u00b7 Privacy: https:\/\/www.facebook.com\/privacy\/policy\/<\/li>\n<\/ul>\n\n<h4>OpenAI<\/h4>\n\n<ul>\n<li>Sends: instructions, messages, conversation history, knowledge context, tool definitions and results, image URLs and prompts, audio files you point to; for semantic search, knowledge text and queries \u2014 to <code>api.openai.com<\/code> with your key, when you test the connection, when an AI step runs, or (with semantic search on) when knowledge is embedded or searched.<\/li>\n<li>Terms: https:\/\/openai.com\/policies\/services-agreement\/ \u00b7 Privacy: https:\/\/openai.com\/policies\/privacy-policy\/<\/li>\n<\/ul>\n\n<h4>OpenAI-compatible providers<\/h4>\n\n<ul>\n<li>Sends: the same data as the OpenAI entry \u2014 to the base URL you enter (e.g. OpenRouter at <code>openrouter.ai<\/code>, Azure OpenAI, or a self-hosted endpoint such as Ollama), when you test the connection, when the editor loads models, or when an AI \/ AI Agent step runs.<\/li>\n<li>Terms and privacy: those of the provider you choose. OpenRouter: https:\/\/openrouter.ai\/terms \u00b7 https:\/\/openrouter.ai\/privacy. Azure OpenAI: https:\/\/www.microsoft.com\/licensing\/terms\/ \u00b7 https:\/\/www.microsoft.com\/privacy\/privacystatement<\/li>\n<\/ul>\n\n<h4>Slack<\/h4>\n\n<ul>\n<li>Sends: the channels, users, message text and names you configure; your OAuth code or bot token; for Human Approval, the message and its approve \/ reject links to the incoming webhook URL you enter \u2014 to Slack's API, when you connect or test a connection, when the editor loads channels, or when a Slack \/ Human Approval step runs.<\/li>\n<li>Terms: https:\/\/slack.com\/terms-of-service\/api \u00b7 Privacy: https:\/\/slack.com\/trust\/privacy\/privacy-policy<\/li>\n<\/ul>\n\n<h4>Telegram<\/h4>\n\n<ul>\n<li>Sends: chat ID, message text and media URLs \u2014 to <code>api.telegram.org<\/code> with your bot token, when you test the connection or a Telegram step runs.<\/li>\n<li>Terms: https:\/\/telegram.org\/tos\/bot-developers \u00b7 Privacy: https:\/\/telegram.org\/privacy<\/li>\n<\/ul>\n\n<h4>Trello<\/h4>\n\n<ul>\n<li>Sends: the card, list, board, member and label details you configure, with your key and token \u2014 to <code>api.trello.com<\/code>, when you test the connection, when the editor loads boards and lists, or when a Trello step runs.<\/li>\n<li>Terms: https:\/\/www.atlassian.com\/legal\/atlassian-customer-agreement \u00b7 Privacy: https:\/\/www.atlassian.com\/legal\/privacy-policy<\/li>\n<\/ul>\n\n<h4>Typeform<\/h4>\n\n<ul>\n<li>Sends: form titles, fields and workspace, and your site's webhook URL (the Create Form step registers it so responses reach your workflows) \u2014 to <code>api.typeform.com<\/code> with your access token, when you test the connection, when the editor loads forms, or when a Typeform step runs.<\/li>\n<li>Terms: https:\/\/www.typeform.com\/legal\/service-terms-and-conditions \u00b7 Privacy: https:\/\/www.typeform.com\/legal\/privacy-policy<\/li>\n<\/ul>\n\n<h4>WordPress AI Client<\/h4>\n\n<ul>\n<li>Sends: prompt, conversation history, knowledge context, tool definitions and results, and any image you reference \u2014 to WordPress core's AI Client, which forwards them to the provider the site owner configured. Zaplane stores no key for it and contacts no AI service itself.<\/li>\n<li>Terms and privacy: those of the provider configured in WordPress (see the Anthropic \/ Google Gemini \/ OpenAI entries above).<\/li>\n<\/ul>\n\n<h4>YouTube thumbnails (email editor)<\/h4>\n\n<ul>\n<li>Sends: the video ID, as part of the image address \u2014 to <code>img.youtube.com<\/code>, when you add a YouTube link to a Video block on the Email Templates screen.<\/li>\n<li>Terms: https:\/\/www.youtube.com\/t\/terms \u00b7 Privacy: https:\/\/policies.google.com\/privacy<\/li>\n<\/ul>\n\n<h4>Zoom<\/h4>\n\n<ul>\n<li>Sends: meeting topics, times and settings; registrant names and emails; OAuth codes and tokens \u2014 to <code>api.zoom.us<\/code> (sign-in at <code>zoom.us<\/code>) through your Zoom app, when you connect or a Zoom step runs.<\/li>\n<li>Terms: https:\/\/www.zoom.com\/en\/trust\/terms\/ \u00b7 Privacy: https:\/\/www.zoom.com\/en\/trust\/privacy\/privacy-statement\/<\/li>\n<\/ul>\n\n<h4>Addresses you configure<\/h4>\n\n<p>HTTP Request, Send Webhook, Custom Apps, the MCP Client, the AI Agent's HTTP tool, and the steps that read a file from a URL (CSV, Image Helper, Upload Media From URL, AI image and audio) send data to, or fetch data from, the address you enter or that your workflow supplies. What is sent is what you configure in that step; the MCP Client also sends your site's address so a server can recognise calls from it. Requests go only where you point them, and addresses on private networks are refused unless a developer allows them.<\/p>\n\n<h3>Source Code and Build Process<\/h3>\n\n<p>Only one part of Zaplane is compiled: the admin interface, which is a React app. Everything else, including all of the plugin's PHP in <code>includes\/<\/code> and <code>integrations\/<\/code>, runs exactly as it ships. The complete, uncompiled source of the admin interface is included in this plugin, together with everything needed to build it.<\/p>\n\n<h4>Where the development files are<\/h4>\n\n<ul>\n<li><code>dev_zaplane\/<\/code> \u2014 the React source: <code>app.js<\/code> is the entry point, <code>app.scss<\/code> its base stylesheet, with <code>components\/<\/code> (shared UI), <code>containers\/BackendDashboard\/<\/code> (the admin screens and workflow canvas), <code>redux\/<\/code> (store and slices), <code>hooks\/<\/code>, <code>utils\/<\/code> and <code>webpack\/<\/code> (a loader that points the email editor's placeholder images at <code>assets\/images\/<\/code>).<\/li>\n<li><code>assets\/scss\/<\/code> \u2014 the Sass for the admin interface; <code>backend.scss<\/code> is its entry.<\/li>\n<li><code>package.json<\/code>, <code>webpack.config.js<\/code>, <code>tailwind.config.js<\/code>, <code>postcss.config.js<\/code> and <code>jsconfig.json<\/code> \u2014 the dependencies, build scripts and configuration. The build runs on <code>@wordpress\/scripts<\/code>, with Tailwind CSS and Autoprefixer through PostCSS.<\/li>\n<\/ul>\n\n<h4>Generated files<\/h4>\n\n<ul>\n<li><code>assets\/build\/app.js<\/code> \u2014 built from <code>dev_zaplane\/app.js<\/code> and every module it imports.<\/li>\n<li><code>assets\/build\/app.css<\/code> and <code>assets\/build\/app-rtl.css<\/code> \u2014 built from the Sass above; the right-to-left file comes from the same source.<\/li>\n<li><code>assets\/build\/app.asset.php<\/code> \u2014 written by the build: the script's WordPress dependencies and its version.<\/li>\n<\/ul>\n\n<p>Every generated <code>.js<\/code> and <code>.css<\/code> file starts with a comment naming its source and the commands that rebuild it.<\/p>\n\n<h4>Building the admin interface<\/h4>\n\n<p>You need Node.js 18.12 or newer and npm 8.19 or newer. In the plugin's folder, <code>wp-content\/plugins\/zaplane<\/code>:<\/p>\n\n<ol>\n<li>Install the dependencies: <code>npm install --legacy-peer-deps<\/code><\/li>\n<li>Build the production files: <code>npm run build<\/code><\/li>\n<\/ol>\n\n<p>The build writes minified files to <code>assets\/build\/<\/code>. While working on the source, <code>npm run start<\/code> rebuilds on every save, unminified and with source maps; run <code>npm run build<\/code> again before using the plugin on a live site. <code>--legacy-peer-deps<\/code> is needed because one dependency, react-json-view, declares support only for older React versions, although it works with the version Zaplane uses.<\/p>\n\n<p>The PHP library in <code>vendor\/<\/code> (Action Scheduler) is managed with Composer; <code>composer install --no-dev<\/code> reinstalls it.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>zaplane<\/code> folder to the <code>\/wp-content\/plugins\/<\/code> directory, or install the plugin through the <strong>Plugins &gt; Add New<\/strong> screen in WordPress.<\/li>\n<li>Activate the plugin through the <strong>Plugins<\/strong> screen.<\/li>\n<li>Open the <strong>Zaplane<\/strong> menu in your WordPress admin.<\/li>\n<li>Create a new automation, pick a trigger, add your actions, and turn it on.<\/li>\n<\/ol>\n\n<h4>Requirements<\/h4>\n\n<ul>\n<li>WordPress 6.8 or higher<\/li>\n<li>PHP 7.4 or higher<\/li>\n<\/ul>\n\n<!--section=faq-->\n<dl>\n<dt id=\"do%20i%20need%20a%20zaplane%20account%20or%20any%20external%20service%20to%20use%20this%3F\"><h3>Do I need a Zaplane account or any external service to use this?<\/h3><\/dt>\n<dd><p>No. Zaplane needs no account with us and does not send your site's data to us. You only need an account with a third-party service (for example Slack or Mailchimp) if you build a workflow that uses that service.<\/p><\/dd>\n<dt id=\"does%20zaplane%20require%20woocommerce%3F\"><h3>Does Zaplane require WooCommerce?<\/h3><\/dt>\n<dd><p>No. WooCommerce is optional. Zaplane works with WordPress core events and with whichever supported plugins you have installed; the available triggers and actions depend on the plugins active on your site.<\/p><\/dd>\n<dt id=\"how%20are%20scheduled%20and%20background%20steps%20processed%3F\"><h3>How are scheduled and background steps processed?<\/h3><\/dt>\n<dd><p>Zaplane uses Action Scheduler (the same background-processing library used by WooCommerce) to run delays, scheduled steps and long-running workflows reliably.<\/p><\/dd>\n<dt id=\"where%20does%20my%20data%20go%3F\"><h3>Where does my data go?<\/h3><\/dt>\n<dd><p>Workflows, run logs and connection credentials are stored in your WordPress database. Data leaves your site only when something you set up needs it to: a workflow step that calls a service, testing a connection, a builder field that loads options from a connected account (such as your Slack channels), or an AI step. Every service, with what is sent and when, is listed under External services.<\/p><\/dd>\n<dt id=\"can%20workflows%20reach%20private%20or%20internal%20addresses%3F\"><h3>Can workflows reach private or internal addresses?<\/h3><\/dt>\n<dd><p>Not by default. HTTP Request, Send Webhook, Custom Apps and every other step that fetches a URL refuse loopback, private, link-local and reserved addresses, including after a redirect. A developer can allow a specific internal host with the <code>zaplane_http_allowed_private_hosts<\/code> filter.<\/p><\/dd>\n<dt id=\"what%20can%20an%20ai%20client%20connected%20through%20the%20abilities%20api%20do%3F\"><h3>What can an AI client connected through the Abilities API do?<\/h3><\/dt>\n<dd><p>Zaplane registers its capabilities as abilities, and an MCP adapter you install exposes them to an AI client. Zaplane runs no server of its own, so authentication and transport are WordPress core's. Every ability requires an administrator, and the client can read your workflows, runs and recipes, draft and test workflows, and run them. It cannot administer your site: actions that activate or deactivate plugins, create, change or delete users, change roles or capabilities, or change site options are kept out of its reach, and it cannot create, read, edit, activate, test or run a workflow that uses one, including one you built yourself. You can still use those actions in workflows you build in the Zaplane dashboard.<\/p><\/dd>\n<dt id=\"can%20a%20custom%20app%20call%20php%20functions%3F\"><h3>Can a Custom App call PHP functions?<\/h3><\/dt>\n<dd><p>Only functions that code on your site has allowed with the <code>zaplane_custom_app_callables<\/code> filter. A Custom App can also fire a WordPress action or filter hook of your choosing.<\/p><\/dd>\n<dt id=\"can%20i%20build%20multi-step%20workflows%20with%20conditions%20and%20delays%3F\"><h3>Can I build multi-step workflows with conditions and delays?<\/h3><\/dt>\n<dd><p>Yes. You can chain multiple actions and insert delay, condition, filter, iterator and variable steps to control exactly how and when each step runs.<\/p><\/dd>\n<dt id=\"where%20is%20the%20source%20code%20for%20the%20admin%20interface%3F\"><h3>Where is the source code for the admin interface?<\/h3><\/dt>\n<dd><p>In the plugin itself. <code>dev_zaplane\/<\/code> holds the React source of the admin interface and <code>assets\/scss\/<\/code> its Sass; the files in <code>assets\/build\/<\/code> are compiled from them. See Source Code and Build Process for where each file is and how to build it.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.5.0<\/h4>\n\n<p><strong>Added<\/strong>\n* Inbox module: website live chat, Facebook Messenger and WhatsApp channels, selling in chat with product cards, saved replies and quick-answers, automatic answers from Business Knowledge, agent presence and business hours, email-capture gating, typing indicator and realtime delivery. New triggers and actions so workflows can read, reply to and route conversations.\n* Third-party integration API: other plugins can register their own triggers and actions with <code>zaplane_register_integration()<\/code> on the <code>zaplane_register_integrations<\/code> action. See <code>docs\/integrations\/third-party\/README.md<\/code>.\n* <code>wp zaplane make:addon &lt;slug&gt;<\/code> scaffolds a ready-to-edit plugin with a sample third-party integration (or adds one to an existing plugin with <code>--plugin=&lt;folder&gt;<\/code>).\n* New built-in integrations: Shopify, Google Sheets, Google Docs, JetFormBuilder, Forminator, Everest Forms, HappyForms, Gutena Forms, Tally Form, QuizPress, Easy Content Manager, TruePlayer, WP Map Block, GemBoard, ZenAppBuilder.\n* AI Agent: Chat Model, Memory and Tool slots with a slot-aware picker and a <code>zaplane_agent_slots<\/code> filter; a Chat Model's own connection decides the provider; Memory can read Inbox conversations.\n* Workflows list: filter by status and folder, search, \"Clear filters\" affordance; Connections list: status tabs, app filter and search.\n* Editor: tidier step connection picker opening the shared \"Add connection\" modal; missing-connection notice as a card over the canvas; workflows the editor flags when a step has no connection.\n* Settings: a gear button per module opens its settings; multi-WordPress support for the WordPress integration.<\/p>\n\n<p><strong>Changed<\/strong>\n* Minimum WordPress is 7.0.\n* Many editor polish passes: top-bar logo and spacing, Create Workflow modal rhythm, Add Trigger drawer, email-template editor layout.<\/p>\n\n<p><strong>Fixed<\/strong>\n* <code>determine_current_user<\/code> settings recursion.\n* Workflow re-triggering itself from its own actions.\n* Custom Code Execution: process timeouts actually terminate on Windows.\n* ORM <code>where()<\/code> on a column named like a function no longer filters out everything.\n* Silent no-op actions, formatter and repeater limits, MCP stream parsing.\n* Inbox: rate-limit the chat widget per visitor on a real one-minute window; don't run reply workflows for conversations others answer; match chat spellings and pages whose text covers the question.\n* Plain-permalinks sites, align plugin header with new readme title, scroll-to-top on sidebar navigation.<\/p>\n\n<p><strong>Security<\/strong>\n* Remaining user-URL HTTP routed through <code>HttpGuard<\/code>; PCRE formatter hardened.\n* Security and WPCS audit of PRs merged for this release.<\/p>\n\n<h4>1.4.0<\/h4>\n\n<p><strong>Changed<\/strong>\n* AI access now uses the WordPress Abilities API instead of Zaplane's own MCP server. Zaplane registers its workflow capabilities as abilities; install an MCP adapter and an AI client you approve can discover, build and run workflows through WordPress core. Every ability requires an administrator, and site-administration actions stay out of an AI client's reach.\n* Removed the built-in MCP server, its OAuth sign-in, access tokens, and the \"AI access\" settings and log screens.\n* Raised the minimum WordPress version to 6.8. Abilities and the core AI Client are consumed through the Abilities API when the hosting WordPress version provides them.\n* The MCP Client workflow step (calling other services' MCP servers) is unchanged.<\/p>\n\n<h4>1.3.3<\/h4>\n\n<p><strong>Security<\/strong>\n* A workflow that another service starts \u2014 a Catch Webhook URL, a provider webhook, or a trigger from a connected outside account \u2014 can no longer run actions that administer the site: activating or deactivating plugins, creating, changing or deleting users, changing roles and capabilities, and changing site options. Such a workflow cannot be activated, the editor explains why, and the step is refused if one runs anyway. The same actions still work in workflows started by something that happens on the site.\n* An AI Agent is never given those actions as tools.\n* The Academy and ZenCommunity steps no longer switch the signed-in user while they run; they act for the user they name.\n* MCP access tokens now sign in through WordPress's own authentication filter, the one application passwords use, instead of switching the user inside the endpoint.<\/p>\n\n<h4>1.3.2<\/h4>\n\n<p><strong>Security<\/strong>\n* An AI client connected through the MCP server can no longer reach actions that administer the site: activating or deactivating plugins, creating, changing or deleting users, changing roles and capabilities, and changing site options. It cannot add them to a workflow, or read, edit, activate, test or run a workflow that uses them.<\/p>\n\n<p><strong>Fixed<\/strong>\n* Conditions, filters and a few triggers no longer call string functions that need PHP 8, so Zaplane runs on PHP 7.4 as declared.\n* Workflow steps now run when Action Scheduler is processed from WP-CLI, as many hosts do from a system cron. Before, every queued step failed there.<\/p>\n\n<h4>1.3.1<\/h4>\n\n<p><strong>Security and privacy<\/strong>\n* Removed the Switch Theme and Authenticate User actions. Which theme a site runs, and signing in, are the site owner's own decisions.\n* Create, Update and Delete User now accept only the fields their form offers and a role the site defines, and refuse to delete the last administrator or the account the run is using.\n* Incoming webhook and Catch Webhook URLs check the provider's signature, or the trigger's shared secret, before the request reaches the workflow.\n* The workflow query builder now refuses any table, column, operator or sort direction that is not a plain name, and every value it sends is a placeholder filled in by WordPress.\n* The admin palette, the integrations catalogue and the MCP consent screen are escaped on the way out.\n* Documented the Telegram API address and the links to claude.ai and ChatGPT under External services.<\/p>\n\n<p><strong>Fixed<\/strong>\n* Lists of courses, quizzes, ranks and achievements are read through WordPress instead of the posts table directly.\n* Fixed selecting a specific set of columns \u2014 a \"get this field for every row\" query returned nothing.<\/p>\n\n<h4>1.3.0<\/h4>\n\n<p><strong>Workflows<\/strong>\n* A workflow can start from more than one trigger. Whichever fires starts the run, and <code>{{trigger.*}}<\/code> reads its data.\n* Connecting steps is easier: drop a line anywhere on a step's card, and letting go on empty canvas opens the step picker.<\/p>\n\n<p><strong>Recipes<\/strong>\n* Group recipes set up several workflows at once in a new folder, starting with WooCommerce Customer Lifecycle and StoreEngine Store Emails.\n* Every recipe opens a setup for its optional steps, settings and connections. Plugins can register recipes as simple arrays.<\/p>\n\n<p><strong>AI<\/strong>\n* The AI, AI Agent and Generate Image steps use the WordPress AI Client when it is available in core, including the agent's tool calling. Your own provider key is still an option.<\/p>\n\n<p><strong>AI access (MCP server)<\/strong>\n* claude.ai and ChatGPT can connect through OAuth, with administrator approval. WordPress application passwords also work.\n* Tool calls are logged, tokens can expire, and run tokens can be limited to chosen workflows.<\/p>\n\n<p><strong>Security and compatibility<\/strong>\n* Merge tags are no longer evaluated as PHP, and outbound requests are checked on every redirect.\n* MCP tokens now act as their own user and require administrator rights.\n* Updates come only from WordPress.org. WordPress 6.8 or later is required.<\/p>\n\n<p><strong>Fixes<\/strong>\n* GemCRM Send Email now reaches only the chosen contact or list.\n* Fixed shipped recipes' Send Email steps, duplicate recipes after a rename, fields with hyphens, forms watched by two triggers, and Logs Re-Try.<\/p>\n\n<h4>1.2.0<\/h4>\n\n<p><strong>New integrations<\/strong>\n* aBlocks \u2014 a Form Submitted trigger for aBlocks form-builder forms.\n* FluentCart \u2014 21 new triggers and 52 new actions across carts, coupons, licences, customers, orders, products and subscriptions.<\/p>\n\n<p><strong>AI access (MCP server)<\/strong>\n* Let Claude, Cursor or any Model Context Protocol client read your automations and build new ones from a plain-language description. Off by default, behind scoped and revocable tokens.<\/p>\n\n<p><strong>Modules<\/strong>\n* Optional features are now opt-in and switched off on a fresh install. Existing sites keep whatever they had.\n* A card on the Workflows, Dashboard and Connections screens lists what you have not turned on, with a one-click switch. Picking a step whose module is off now says so in the builder and offers to enable it there.<\/p>\n\n<p><strong>Workflow canvas<\/strong>\n* Nodes are colour-typed as trigger, action, tool or AI, on the card and on the connector leaving it, so a glance shows what feeds what.\n* Node cards now sit on a canvas of their own colour instead of sharing it, connectors draw a single stroke instead of three, and the delete control is a real, keyboard-reachable button.<\/p>\n\n<p><strong>Appearance<\/strong>\n* The dark theme was rebuilt for legibility \u2014 secondary text and button labels previously fell below the accessible contrast minimum.\n* The dashboard chart now follows your palette instead of fixed light-mode colours.<\/p>\n\n<p><strong>Performance<\/strong>\n* The admin bundle drops from 23.8 MB to 1.6 MB.<\/p>\n\n<p><strong>Removed<\/strong>\n* The Dokan \"Withdraw Request Pending\" and FluentCart \"Order Paid Done\" triggers. A workflow still using either will need its trigger re-selected.<\/p>\n\n<h4>1.1.0<\/h4>\n\n<p><strong>New integrations<\/strong>\n* StoreEngine \u2014 order, subscription and product triggers plus actions.\n* AI (Chat Model) \u2014 generate replies with Anthropic, OpenAI, or WordPress Core AI.\n* AI Agent \u2014 autonomous tool-calling agent with Chat Model, Memory and Tools sub-nodes, plus MCP server support.\n* Conversation Memory \u2014 durable, keyed chat history for AI conversations.\n* Business Knowledge \u2014 a searchable knowledge base the AI Agent can query; sync from StoreEngine products.\n* Custom Apps \u2014 build your own integrations (REST or same-site WordPress hooks) without code changes.\n* Webhook \u2014 a dedicated app for both directions: Catch Webhook (incoming) and Send Webhook (outgoing) with optional HMAC-SHA256 signing.\n* Messenger and WhatsApp \u2014 AI auto-reply flows.\n* Academy \u2014 course enrolment triggers, actions and access-group membership.<\/p>\n\n<p><strong>New tools &amp; flow control<\/strong>\n* Manual Trigger, Schedule trigger, and Human-in-the-Loop approval.\n* Router (multi-branch), Repeater\/Iterator, Condition and Filter.\n* Utility tools: CSV, XML, JSON Parser, Formatter, Date\/Time, Image Helper, Set Variable, and Sticky Note.<\/p>\n\n<p><strong>New recipe<\/strong>\n* \"AI Reply to Incoming Webhook\" \u2014 receive a question by webhook, answer it with the AI Agent using your Business Knowledge, then post the reply back out.<\/p>\n\n<p><strong>Improvements<\/strong>\n* Dynamic-data \"@\" token picker across expression fields, with sample outputs so tokens are available before a test run.\n* Redesigned Business Knowledge, field, checkbox and connection-icon UI, with icon fallbacks.\n* Clearer node port \/ branch handles and AI Agent sub-node handles on the canvas.<\/p>\n\n<p><strong>Fixes<\/strong>\n* AI and AI Agent no longer appear as trigger options where only actions apply.\n* Custom Apps: trigger firing, label handling, and the stale generic \"Custom App\" entry in the app picker.\n* Webhook: structured Body fields so multi-line\/quoted values (e.g. an AI reply) can't produce malformed JSON.\n* Node port, multiple-output, route-indicator, CSV parser, and dynamic-data resolution fixes.<\/p>\n\n<h4>1.0.2<\/h4>\n\n<ul>\n<li>Improvements and bug fixes.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release.<\/li>\n<\/ul>","raw_excerpt":"No-code WordPress automation &amp; AI agent workflow builder. 100+ integrations: WooCommerce, FluentCRM, Slack, Gmail, Google Sheets and more.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/kea.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/369289","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kea.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/kea.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/kea.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=369289"}],"author":[{"embeddable":true,"href":"https:\/\/kea.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/kodezen"}],"wp:attachment":[{"href":"https:\/\/kea.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=369289"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/kea.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=369289"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/kea.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=369289"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/kea.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=369289"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/kea.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=369289"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/kea.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=369289"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}