Leads for Craft CMS
Configuration
Configure Leads via the control panel or a config/leads.php file. Values in the config file override control panel settings.
Settings are stored in project config, so the Settings screen saves only for an admin on an environment where allowAdminChanges is on. Elsewhere — and for users who only hold “Manage settings” — it’s read-only.
Config File
<?php
return [
'autoInjectScript' => true,
'defaultButtonColor' => '#F9C723',
'defaultBackgroundColor' => '#ffffff',
'dataRetentionDays' => 365,
'enableHoneypot' => true,
'rateLimitPerMinute' => 5,
'trackingPerMinute' => 60,
'allowPrivateWebhookHosts' => false,
];Settings
| Setting | Default | Description |
|---|---|---|
autoInjectScript | true | Automatically inject active popups on all frontend pages |
defaultButtonColor | '#F9C723' | Default button color applied to new popups |
defaultBackgroundColor | '#ffffff' | Default background color applied to new popups |
enableHoneypot | true | Enable honeypot spam protection on forms |
rateLimitPerMinute | 5 | Maximum form submissions per minute, per visitor address, under a site-wide ceiling of 20× the value |
trackingPerMinute | 60 | Maximum impression/conversion/close events per minute, per visitor address (same site-wide ceiling). Events for popups that aren’t active are ignored |
allowPrivateWebhookHosts | false | Config file only. Let webhook integrations post to private, loopback or link-local addresses, such as an internal CRM |
dataRetentionDays | 365 | How long to keep submission data before pruning |
Behind a proxy or CDN
The rate limits key on the address connecting to your server. X-Forwarded-For is only believed once Craft’s trustedHosts general-config setting names your proxies — anything else would let a visitor pick a fresh address per request. If your site sits behind a load balancer or CDN and you haven’t set it, every visitor shares the proxy’s budget.
Integration settings
Every integration field (Mailchimp API key and list ID, ConvertKit secret and form ID, webhook URL) accepts an environment variable such as $MAILCHIMP_API_KEY, so keys stay out of the database. A popup won’t save while a variable it references is unset.
A webhook URL must be http or https, carry no username or password, and resolve only to public addresses. The request goes to the address that was checked and doesn’t follow redirects.
