We built DEV3 AI Popup & Lead Capture Builder as a WordPress plugin in PHP, with a React admin and a dependency-free front-end runtime. It covers five formats (popup, full-screen welcome mat, slide-in, floating bar and inline form), 12 templates, six triggers, page and visitor targeting, frequency caps, A/B tests with up to four variants, a leads table, and Mailchimp, Brevo and signed-webhook delivery.
Key design decisions
- Split targeting at the cache boundary. Page rules (post types, terms, URLs, 404, search) depend only on the URL, so the server evaluates them and prints a small JSON config holding only the campaigns that can match. Device, referrer, UTM, login, new or returning visitor, pages viewed and WooCommerce cart value are evaluated in the browser, so a cached page stays correct for every visitor.
- No markup until a trigger fires. Overlay DOM and images are created only when exit intent, scroll, time, click, inactivity or load fires. Nothing is enqueued on pages with no matching campaign, and overlays are fixed-position, so the plugin adds no layout shift.
- Mobile-safe mode on by default. On phones, popups and full-screen campaigns become non-blocking bottom sheets, and a load trigger waits for 10 seconds or 40% scroll, in line with Google's intrusive-interstitial guidance.
- The server decides what counts. Public endpoints take no nonce, which page caches would serve stale. Instead they require a same-origin request and a per-IP rate limit, accept only active campaigns and existing variant ids, and count a click as a conversion only for button-only campaigns. Form conversions are counted only when a new lead is stored.
- Sticky variants without cookies. The assigned variant lives in
localStorage. Inline A/B forms print every variant hidden, plus a tiny inline script that un-hides the assigned one before first paint.
- AI drafts, people publish. DEV3 AI, using the Google Gemini API, writes copy, proposes three offer variants for the A/B test, suggests triggers and targeting, explains results and drafts a whole campaign from one sentence. Every result is a draft. It can't name a winner before each variant has 100 views.
Architecture
Campaigns are stored as sanitised JSON in a custom table. Daily counters live in a stats table keyed by campaign, variant and day and are written with one atomic upsert. Leads go to a third table with consent text, UTM tags, page and device, and are deduplicated by email per campaign. The results view computes conversion rate, uplift against the control and confidence from a two-proportion z-test. Declaring a winner stops the test and keeps the history. Integration keys are encrypted, webhooks are sent with wp_safe_remote_post and an optional HMAC-SHA256 signature, and failed syncs can be retried. With WooCommerce active, campaigns can target cart value through a cache-safe cookie and reveal a unique one-time coupon. The API client, settings store and admin UI kit come from a shared core used across DEV3's plugins.