Title: Freexya – Cookie Consent, SMTP, Redirects & Security Toolkit Author: nexyadev Published: 2026(e)ko urriaren 12(a) Last modified: 2026(e)ko urriaren 26(a) --- Bilatu pluginak ![](https://ps.w.org/freexya/assets/banner-772x250.png?rev=3741488) ![](https://ps.w.org/freexya/assets/icon-256x256.png?rev=3741376) # Freexya – Cookie Consent, SMTP, Redirects & Security Toolkit [nexyadev](https://profiles.wordpress.org/nexyadev/)-(r)en eskutik [Deskargatu](https://downloads.wordpress.org/plugin/freexya.1.6.0.zip) * [Xehetasunak](https://eu.wordpress.org/plugins/freexya/#description) * [Berrikuspenak](https://eu.wordpress.org/plugins/freexya/#reviews) * [Instalazioa](https://eu.wordpress.org/plugins/freexya/#installation) * [Garapena](https://eu.wordpress.org/plugins/freexya/#developers) [Laguntza](https://wordpress.org/support/plugin/freexya/) ## Deskripzioa One plugin for the jobs every WordPress site needs, instead of five or six: * **E-mails that do not arrive** — send through SMTP or an API, keep a log of every message, and read the server’s own reason when one fails. * **A cookie banner that really blocks** — third-party scripts and embeds wait for consent, with Google Consent Mode v2. * **404s after a redesign** — a log of the broken addresses visitors hit, with their count, redirected in one click. * **Security** — a light firewall, HTTP headers, a limit on failed logins, and your plugins checked against known vulnerabilities. Each job is a module you switch on from the hub, and a module that is off registers nothing: none of its hooks run on the site. The modules: * **Dashboard** — a readable admin home and a tidied toolbar. * **Shortcuts** — duplicate content, reorder it by hand, add entries in one click. * **Roles & capabilities** — capabilities sorted under the post type that creates them, and the site seen through a role’s eyes without leaving your own account. * **Activity log** — who changed what, with the before and the after. * **Cookies** — a consent banner, third-party scripts held back until consent, and a scan that finds them. * **SEO** — titles and descriptions with a suggestion drawn from the page’s text, sitemap, schema, llms.txt. * **Mail** — SMTP, an API provider, or a Gmail or Microsoft 365 account connected with OAuth, a delivery log, a test message, an invisible captcha for the site’s forms. * **Redirects** — exact redirects and a 404 log with the hit count. * **Media** — regenerate thumbnails in the background, in batches. * **Security** — a light firewall that refuses requests carrying an attack before WordPress runs, security headers, a content policy, a limit on failed logins, and a check of the installed plugins against known vulnerabilities. * **Maintenance** — a holding page, database clean-up, a database export, and the previous version of each extension kept before its update. * **Custom fields** — field groups with repeaters, flexible content and relations, kept in their own tables, and content types and taxonomies of your own. * **Element** — sixteen Elementor widgets for custom fields, NCF’s or ACF’s: repeaters as cards, tabs or tables, galleries and sliders, key figures, teams, timelines, taxonomies, maps. * **Translate** — your site in several languages: each page linked to its translations, a translation editor beside the original (blocks, Elementor, ACF and NCF fields), addresses in /en/, a menu per language, a language switcher, hreflang, and every text of the site translated from the admin. A site coming from WPML or Polylang moves over in one click. * **Social** — your Google reviews, your Instagram feed and your Facebook page on your pages, in a grid or a single post with a lightbox, set for computer, tablet and phone, and refreshed on their own; as a shortcode, a block or an Elementor widget. #### Free and Pro Everything above is free, on as many sites as you like. nexya Pro, sold on nexya. dev, adds three modules — nexya forms, Mailya for newsletters and a page cache — and the parts that do the repetitive work for you: suggested redirects and pattern rules, CSV import, a daily vulnerability pass and a file fingerprint with rollback, a two-step login, updates undone by themselves when they break the site, undo from the activity log, a second sending server and failure alerts for mail, a branded login screen and admin skin, banner appearance and consent service by service, scheduled database clean-up, orphan image sizes, folders in the media library, and longer log retention. The free version contains none of that code; nexya Pro is delivered by Freemius after purchase, and takes over from this plugin with the same settings. #### Privacy The plugin sends nothing to a third party by default. The features that reach the network, and what they send, are listed under External services below. #### Multisite Multisite networks are not supported. On a network the plugin stays switched off and says so. ### External services Nothing below runs unless you switch the matching module or option on. No data leaves the site by default, and the plugin sends no usage data anywhere. **WPVulnerability (Security module, vulnerability watch).** When you start a check from the Security screen, the plugin asks the public WPVulnerability API whether the installed plugins have known vulnerabilities. For each installed plugin, its slug is sent to www.wpvulnerability.net; nothing else about the site is sent. Nothing is sent until you start a check. Terms and privacy (legal notice of its publisher): https://www.robotstxt.es/legal/ **WordPress.org checksums (Security module).** While the Security module is on, once a day and when you press “Check now”, the plugin asks api.wordpress.org — the same service WordPress uses for its own updates — for the checksums of the installed WordPress version, sending only that version number and the site language, then compares them with the core files on your server. Terms: https://wordpress.org/about/ privacy/ **IndexNow (SEO module, optional, off by default).** Only if you switch it on, each time a page is published, updated or taken down its address is sent to api.indexnow. org, which shares it with the search engines that take part (Bing, Yandex, Seznam, Naver and others), along with the site’s host name and the verification key the plugin serves at the root of your site. Nothing is sent while the site asks search engines not to index it, or runs on a local address. Terms: https://www.indexnow. org/terms — Privacy (Microsoft, which runs the IndexNow service): https://www.microsoft. com/en-us/privacy/privacystatement **Stripe (nexya forms, Payment module, optional, nexya Pro).** Only once you switch the module on and enter your own Stripe secret key, a form with a payment field sends, when the visitor submits it, the amount, the currency, the name of the form, the visitor’s e-mail address if the form asks for one, and the entry’s number to api.stripe.com to open a Stripe Checkout page; the visitor then pays on Stripe’s site. Stripe calls back the site’s own webhook address to confirm the payment. Terms: https://stripe.com/legal/ssa — Privacy: https://stripe.com/privacy **PayPal (nexya forms, Payment module, optional, nexya Pro).** Only once you enter your own PayPal REST app credentials, a form with a payment field sends, when the visitor chooses PayPal, the amount, the currency, the name of the form and the entry’s number to api-m.paypal.com (or api-m.sandbox.paypal.com in sandbox mode) to open a PayPal approval page; the visitor approves the payment on PayPal’s site, and the site captures it when they come back. Terms: https://www.paypal.com/legalhub/home— Privacy: https://www.paypal.com/myaccount/privacy/privacyhub **Patchstack (Security module, optional).** Only if you enter your own Patchstack API key, the same check also asks api.patchstack.com, sending each installed plugin’s slug and your key. Terms: https://patchstack.com/terms-and-conditions/ — Privacy: https://patchstack.com/privacy-policy/ **E-mail delivery (E-mails module).** When you pick an API provider instead of SMTP, the messages your site sends are handed to that provider’s API: sender, recipients, subject, body and attachments, at the moment the message is sent. You choose the provider and enter its API key. The providers offered are Brevo (https://www.brevo. com/legal/termsofuse/ — https://www.brevo.com/legal/privacypolicy/), SendGrid (https:// www.twilio.com/en-us/legal/tos — https://www.twilio.com/en-us/legal/privacy), Postmark( https://postmarkapp.com/terms-of-service — https://postmarkapp.com/privacy-policy), Resend (https://resend.com/legal/terms-of-service — https://resend.com/legal/privacy- policy), SMTP2GO (https://www.smtp2go.com/terms/ — https://www.smtp2go.com/privacy/), MailerSend (https://www.mailersend.com/legal/terms-of-service — https://www.mailersend. com/legal/privacy-policy), SendLayer (https://sendlayer.com/terms-of-service/ — https://sendlayer.com/privacy-policy/), Mandrill (https://mailchimp.com/legal/terms/— https://mailchimp.com/legal/privacy/), Mailgun (https://www.mailgun.com/legal/terms/— https://www.mailgun.com/legal/privacy-policy/), Elastic Email (https://elasticemail. com/resources/usage-policies/terms-of-use — https://elasticemail.com/resources/usage- policies/privacy-policy) and SparkPost (https://www.sparkpost.com/policies/tou/ — https://www.sparkpost.com/policies/privacy/). **Gmail and Microsoft 365 sending (E-mails module, optional).** Only if you choose Google (Gmail, Workspace) or Microsoft 365 (Outlook) as the sending method and connect an account. When you press “Connect”, your browser goes to accounts.google.com or login.microsoftonline.com, where you sign in and allow the site to send e-mail; the plugin then sends the authorisation code it gets back, with the client ID and secret you entered, to oauth2.googleapis.com or login.microsoftonline.com to obtain an access token, and renews that token there when it expires while the site is sending. No password is stored on the site. Each message the site sends then goes through smtp.gmail.com, or smtp.office365.com / smtp-mail.outlook.com, with its sender, recipients, subject, body and attachments, at the moment it is sent. Google — Terms: https://policies.google.com/terms — Privacy: https://policies.google.com/privacy. Microsoft — Terms: https://www.microsoft.com/en-us/servicesagreement — Privacy: https://www.microsoft.com/en-us/privacy/privacystatement **Cloudflare (Cache module, optional).** Only if you switch the Cloudflare option on and enter your zone ID and API token: each time the nexya cache is emptied, the plugin asks api.cloudflare.com to empty the cache of that zone, sending the zone ID, the token and, when only some pages changed, their addresses. Terms: https:// www.cloudflare.com/terms/ — Privacy: https://www.cloudflare.com/privacypolicy/ **Form webhook (nexya forms, optional).** Only if you enter an address in a form’s settings, each entry of that form is sent, when it is submitted, to that address as JSON: the form’s name and number, the entry’s number and date, the page it was sent from, the site’s address, and the answers with the label and type of each field. You choose the address (Zapier, Make, n8n, a CRM…); the plugin contacts no address you did not enter, and the terms and privacy policy that apply are those of the service you chose. **AI suggestions (optional).** The plugin calls no AI provider itself. When you press a button that asks for a suggestion (a title, a description, an image text…), the text needed for it is handed to the AI client built into WordPress, which sends it to the provider of the connector you set up in WordPress, under that provider’s terms. Without such a connector, these buttons do not appear and nothing is sent. **Audience measurement tags (SEO module).** If, and only if, you enter an ID or an address for one of them, the module prints that service’s tag on the front end; the visitor’s browser then loads the script from the service and sends it what that tag collects. * Google Tag Manager and Google Analytics 4, from www.googletagmanager. com. Terms: https://marketingplatform.google.com/about/analytics/terms/us/ — Privacy: https://policies.google.com/privacy * Plausible, from plausible.io or the address you enter. Terms: https://plausible.io/terms — Privacy: https://plausible.io/privacy* Umami, from the address of your own Umami instance or Umami Cloud. Terms: https:// umami.is/terms — Privacy: https://umami.is/privacy * Matomo, from the address of your own Matomo instance or Matomo Cloud. Terms: https://matomo.org/matomo-cloud- terms-of-service/ — Privacy: https://matomo.org/privacy-policy/ **nexya connection relay, Google, Instagram and Facebook (Social module, optional, off by default).** Only once you switch the Social module on and press “Connect” for Google, Instagram or Facebook: your browser goes to studio.nexya.dev, run by the makers of nexya, with your site’s admin address and a one-time check value, and from there to accounts.google.com, www.instagram.com or www.facebook.com, where you sign in and allow access. The relay exchanges the code it gets back for access tokens (the app secrets stay on the relay, never on your site), holds them for at most ten minutes, and your site then claims them from studio.nexya.dev with a value that never left your server. For Google, your site asks studio.nexya.dev for a new access token, sending its renewal token, at most once a day when it refreshes the reviews. Afterwards the site reads, with those tokens: the reviews, average rating and name of your Google Business profile from mybusiness.googleapis.com, mybusinessaccountmanagement. googleapis.com and mybusinessbusinessinformation.googleapis.com (once a day); the last posts and the profile of your Instagram professional account from graph.instagram. com (every hour); the last posts, name and picture of your Facebook page from graph. facebook.com (every hour). The pictures and videos of those posts and the reviewers’ photos are downloaded to your own uploads folder, so visitors load them from your site, not from Google or Meta. In the simple mode for Google, the site sends your own Google Places API key and the place’s ID to places.googleapis.com instead, once a day. nexya relay — Privacy: https://nexya.dev/en/privacy-policy/ — Google — Terms: https://policies.google.com/terms — Privacy: https://policies.google.com/privacy. Meta (Instagram, Facebook) — Terms: https://www.facebook.com/terms.php — Privacy: https://www.facebook.com/privacy/policy/ **Freemius (trial and purchase of nexya Pro).** The Freemius SDK ships with the plugin in anonymous mode: on its own it sends nothing and shows no opt-in. Only when an administrator starts the Pro trial or buys nexya Pro from the plugin’s screens are the site address, the WordPress, PHP and plugin versions and the administrator’s name and e-mail address sent to Freemius, which handles the checkout and the licence. Terms: https://freemius.com/terms/ — Privacy: https://freemius.com/privacy/ **Lists of known hosts (Cookies and Security modules).** These are not remote files and nothing is loaded from them. The cookie module carries a list of third-party hostnames (Google Fonts, Font Awesome, public CDNs, YouTube, Google Maps and so on) as plain data: a script or frame already on your page whose address matches one of them is held back until the visitor consents. The Security module carries a similar list of well-known origins, offered as ready-made lines when you write your site’s content security policy, the header that tells browsers which origins your pages may load from. Both lists are plain data files, modules/Cookie/data/hosts. json and modules/Security/data/origins.json. The plugin itself never contacts any of these hosts. **Requests to your own site.** The cookie scan, the sharing-image finder of the SEO module and a few background jobs fetch pages of your own site from your own server. Nothing leaves it. ### Third-party libraries * Chart.js 4.5.1 (MIT) draws the statistics charts — assets/js/chart.min.js. Source: https://github.com/chartjs/Chart.js * Freemius SDK (GPL) handles the licence and the update checks. Source: https:// github.com/Freemius/wordpress-sdk * Font Awesome Free 6.7.2 brand icons (CC BY 4.0) for the social networks of e- mails and pop-ups — assets/social/. Source: https://fontawesome.com The plugin’s own JavaScript and CSS ship as written, next to a minified copy of each file (.min.js / .min.css, made with esbuild when the plugin is packaged). The minified copies are loaded on the site; with SCRIPT_DEBUG on, the readable files are loaded instead. ## Pantaila-argazkiak [⌊The hub: each module switches on or off, and a module that is off registers nothing.⌉⌊ The hub: each module switches on or off, and a module that is off registers nothing .⌉[ The hub: each module switches on or off, and a module that is off registers nothing. [⌊The cookie banner on the site: nothing optional runs before the visitor agrees.⌉⌊ The cookie banner on the site: nothing optional runs before the visitor agrees.⌉[ The cookie banner on the site: nothing optional runs before the visitor agrees. [⌊Security: the HTTP headers, each explained, sent without breaking the site.⌉⌊Security: the HTTP headers, each explained, sent without breaking the site.⌉[ Security: the HTTP headers, each explained, sent without breaking the site. [⌊SEO: who publishes the site, the content, the social networks, the sitemap.⌉⌊SEO: who publishes the site, the content, the social networks, the sitemap.⌉[ SEO: who publishes the site, the content, the social networks, the sitemap. [⌊404s & Redirects: the broken addresses visitors hit, with their count, redirected in one click.⌉⌊404s & Redirects: the broken addresses visitors hit, with their count, redirected in one click.⌉[ 404s & Redirects: the broken addresses visitors hit, with their count, redirected in one click. [⌊E-mails: one sender address for every message, sent through PHP, SMTP or an API.⌉⌊ E-mails: one sender address for every message, sent through PHP, SMTP or an API.⌉[ E-mails: one sender address for every message, sent through PHP, SMTP or an API. ## Blokeak Plugin honek 1 blokea hornitzen du. * nexya popup ## Instalazioa 1. In **Plugins > Add New**, search for “freexya”, then install and activate it. You can also upload the folder to `wp-content/plugins/`. 2. Open **nexya** in the admin menu. On a new install, a first card asks what kind of site this is — a showcase site, a shop or a blog — and switches on the modules that suit it in one click. You can also pick them yourself. 3. The hub lists every module with its switch: a module that is off registers nothing on the site. Each module that is on gets its own page in the nexya menu, with its settings. 4. The hub’s other tabs hold what is shared: **Settings** (the panel language, and whether your settings are kept if the plugin is deleted), **Colours** (your brand colours for the cookie banner, forms, messages and holding pages), **AI** (the connector the AI features use) and **Export & import** (every setting in one file, to copy a set-up to another site). ## MEG ### Does a module I turned off still cost anything? Almost nothing. The registry declares them all, but only boots the modules that are on: the others register no hooks, load no assets and run no queries. ### Where are SMTP passwords stored? Encrypted with AES-256-GCM in a single option, under a key derived from your WordPress salts. If you rotate those salts the stored secrets can no longer be read, and the panel tells you to enter them again. ### And the licence? The licence is handled by Freemius: the key, its activation and the checkout live in the Freemius screens under the nexya menu. The plugin stores nothing about it. ### What happens when I uninstall? You choose, when you deactivate the plugin (or in Settings › If the plugin is deleted): * Keep my settings — its scheduled tasks are cleared and the server rules it wrote are taken out; everything else stays, for a reinstall or a move to nexya Pro. * Erase everything — roles go back to the capabilities they had before the plugin touched them, the plugin’s tables and options are dropped, its scheduled tasks are cleared and the private folder is removed. A copy of the settings only (no logs, no page data) stays for 30 days as a WordPress transient, which WordPress deletes on its own once it expires; if the plugin comes back within that time, it offers to import it. ### Can I move from WPML or Polylang? Yes, in Translate › Import, after a backup and ideally on a copy of the site first. Languages, versions of contents, terms, menus, strings and forms come over; the former plugin is only switched off, so switching it back on restores the site. The addresses keep their shape, and those that change are redirected (301) through the Redirects module. Not taken over: prices per currency from WooCommerce Multilingual, a domain or subdomain per language (redirect it at the host), translated media files, and add-ons that need WPML or Polylang themselves. Image alternative texts are translated in Texts› Images. ### How do I move to nexya Pro without losing my settings? Install and activate nexya Pro while this plugin is still in place: both read the same settings, and Pro switches this version off. Then delete this version. ## Berrikuspenak Ez dago berrikuspenik plugin honentzat. ## Laguntzaileak eta Garatzaileak “Freexya – Cookie Consent, SMTP, Redirects & Security Toolkit” software librea da. Ondoko pertsonek egin dizkiote ekarpenak plugin honi. Laguntzaileak * [ nexya ](https://profiles.wordpress.org/nexyadev/) [Itzul zaitez Freexya – Cookie Consent, SMTP, Redirects & Security Toolkit zure hizkuntzara.](https://translate.wordpress.org/projects/wp-plugins/freexya) ### Garapena interesatzen zaizu? [Araka kodea](https://plugins.trac.wordpress.org/browser/freexya/), begiratu [SVN biltegia](https://plugins.svn.wordpress.org/freexya/) edo harpidetu [garapen erregistrora](https://plugins.trac.wordpress.org/log/freexya/) [RSS](https://plugins.trac.wordpress.org/log/freexya/?limit=100&mode=stop_on_copy&format=rss) bidez. ## Aldaketen loga #### 1.6.0 * Social: a new free module that shows your Google reviews, your Instagram feed and your Facebook page on your pages, refreshed on their own (posts every hour, reviews every day). Accounts connect in one click; pictures and videos are copied to your site. * Social: three widgets, each as a shortcode, a block and an Elementor widget: Google reviews (average rating, cards, minimum rating, reviews with a comment only, hidden reviews), Instagram and Facebook (a grid of posts, or one post, the latest or a chosen one; Facebook posts with a photo, without, or both). * Social: a lightbox for every post, with the album’s photos, the video played in place and the caption with « See more ». * Social: an Appearance tab with a live preview of your own reviews and posts; layout, columns, number of items and what shows are set for computer, tablet and phone. A shortcode without attributes takes these settings, and each attribute changes one. * Social (nexya Pro): the carousel for Instagram and Facebook, and free styling of every widget — arrows, cards, buttons, colours on hover, borders, hashtags and the lightbox background. * Social: for Google, a simple mode with your own Places API key while the full connection is not set up. #### 1.5.16 * Forms: three new settings in Look for the buttons: background, border and border on hover. * Mailya: the button takes its own colours on hover, background, text and border, set beside the normal ones. #### 1.5.15 * Translate: the SEO of Yoast, Rank Math, SEOPress, All in One SEO and The SEO Framework is now translated with each content, like nexya’s own SEO; the canonical address is never copied. SEO written by hand stays as it is, unless “Translate the SEO again too” is ticked when translating everything again. * Translate: two new tabs in Translation, SEO for the site-wide SEO texts (title templates, home, organisation) and Contents SEO for the title and description of every translated content. * Custom fields: new Anchor field — a card, a row or a field becomes a link to another element of the same page, with a smooth scroll that stops below a sticky header. * Custom fields: the link field switches between a page of the site and an address typed by hand. * Custom fields: on pages edited with the block editor, a rich text field could no longer be typed into once the page had loaded; it now stays editable. * Admin: cleaner editor toolbars, a dark border on the field being typed in, lighter boxes and a Booking box in the same style as the nexya panel. #### 1.5.14 * Translate: a repeater, group or flexible content set to Copy keeps the same rows in every language while each sub-field follows its own setting, translated or copied. * Translate: “Translate everything again” now also rewrites the terms, menus, options pages, strings and shop texts written by hand or imported from WPML or Polylang. #### 1.5.13 * Translate: a one-word text of an options page or a term, such as a title or a button label, is now translated by the AI like the rest; only a word that looks technical, like an icon name or a code, is left as it is. #### 1.5.12 * Translate: a product translated in one go is now published with the status chosen in the settings, like any other new translation, instead of staying a draft and leaving the translated shop’s categories empty. #### 1.5.11 * Security: the PHP alert now tells when the server’s PHP is missing the security fixes released on 21 October 2026 (PHP2Shell), with the release to ask the host for (8.2.35, 8.3.36, 8.4.27 or 8.5.12). * Security: the watch tab lists spam pages found in the database over the last 90 days: pharmacy or gambling spam, injected Japanese text and contents whose author no longer exists. #### Older versions * The complete history is in changelog.txt, in the plugin folder. ## Meta * Version **1.6.0** * Azken eguneraketa **duela 3 ordu** * Instalazio aktiboak **10 baino gutxiago** * WordPress bertsioa ** 6.9 edo handiagoa ** * **7.1.3** (e)raino probatuta. * PHP bertsioa ** 8.2 edo handiagoa ** * Language * [English (US)](https://wordpress.org/plugins/freexya/) * Etiketak * [captcha](https://eu.wordpress.org/plugins/tags/captcha/)[consent mode](https://eu.wordpress.org/plugins/tags/consent-mode/) [GDPR](https://eu.wordpress.org/plugins/tags/gdpr/)[redirects](https://eu.wordpress.org/plugins/tags/redirects/) [smtp](https://eu.wordpress.org/plugins/tags/smtp/) * [Ikuspegi aurreratua](https://eu.wordpress.org/plugins/freexya/advanced/) ## Balorazioak No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/freexya/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/freexya/reviews/) ## Laguntzaileak * [ nexya ](https://profiles.wordpress.org/nexyadev/) ## Laguntza Zerbait duzu esateko? Laguntza behar? [Ikusi laguntza foroa](https://wordpress.org/support/plugin/freexya/)