ambera Theme Builder replaces the theme. Install it, and one editor covers everything a visitor sees: the header, the footer, every page and every template. You do not need a separate theme, a page builder and a handful of add-ons — the pieces live in one plugin and share one design.
What is in the box
Your client never sees WordPress
The client area at /themebuilder/admin/ is the whole back end for the people who run the site: pages, blog, messages, media, forms, statistics, users — in plain words, with the site’s own logo. No wp-admin, no plugin list, no update nags. You keep the WordPress admin for yourself.
The free version is complete on its own. Pro adds what a business site needs on top:
Pro is a separate plugin. Nothing in this free plugin is locked or waits for a key: what is listed above is simply not in it.
The plugin talks to the services below. Each one is called only in the situation described, never in the background.
Demo catalogue (amberathemebuilder.com)
When you open the demo screen, the plugin fetches the list of demos from https://amberathemebuilder.com/katalog/demos.json. When you install a demo, it downloads that demo’s zip file from the same host. The request carries no personal data and no site information beyond what any HTTP request carries (the server’s IP address). The service is run by the plugin author, ambera GmbH; terms, privacy policy.
Google Fonts (fonts.googleapis.com, fonts.gstatic.com)
When you type a font name under Settings Fonts and press “Fetch and store it”, your server downloads the font files once from Google and stores them in your uploads folder. From then on the font is served from your own site; visitors’ browsers never contact Google. The request is made by your server, not by visitors, and sends the font name only. Terms, privacy policy.
Pixabay (pixabay.com)
The media manager can search free stock photos on Pixabay. This works only after you enter your own Pixabay API key under Settings; without a key nothing is sent. When you search, the search words and your key are sent to https://pixabay.com/api/; when you pick a photo, the image file is downloaded from Pixabay to your media library. Terms, privacy policy.
Country lookup (api.country.is)
The statistics module can look up a visitor’s country. By default it reads the country from a header your CDN sets (Cloudflare and others) and asks nothing outside. If you switch on the country lookup under Settings Statistics, the visitor’s IP address is sent to https://api.country.is/ and only the two-letter country code is stored. This is off by default. Privacy policy.
Video embeds (YouTube, Vimeo)
The video block shows a poster image and loads the player from youtube-nocookie.com or player.vimeo.com only after the visitor clicks. YouTube terms, Vimeo privacy.
Support portal (portal.amberathemebuilder.com)
“Support ticket” and “Feature request” on the Help screen are links that open the plugin author’s support portal in a new tab. The link carries your site’s host name and a short technical summary (plugin, WordPress and PHP version, site language) so the form there is prefilled; nothing is sent unless you click the link, and nothing is submitted until you send the form on the portal. The plugin itself never calls the portal. Run by ambera GmbH; terms, privacy policy.
Help videos (YouTube)
The Help screen can show short tutorial films. A tile shows only the title; the player from youtube-nocookie.com is loaded when you press play, and only then. YouTube terms, Google privacy policy.
PayPal button (paypal.com)
The PayPal block renders a plain form that leads to https://www.paypal.com/cgi-bin/webscr when a visitor clicks the button. Only then, and only what you entered in the block, is sent: your PayPal e-mail address, the item name, amount and currency, and the return address. The plugin itself never calls PayPal. User agreement, privacy statement.
Share links (Facebook, X, LinkedIn, WhatsApp, Telegram, Pinterest)
The share block is a row of ordinary links to the share pages of these networks. A link opens the network with the address and title of the page when a visitor clicks it; no script from any network is loaded and nothing is sent before the click. Meta privacy, X privacy, LinkedIn privacy, WhatsApp privacy, Telegram privacy, Pinterest privacy.
Interpol (interpol.int)
When the firewall is set to “harsh” and an address on the block list keeps coming back, the blocked request is answered with a redirect to Interpol’s public cybercrime page instead of an error page. This is a plain redirect of the blocked visitor; nothing is sent to Interpol by the plugin.
Images in imported HTML
When you paste HTML into the editor’s import, images that point to another server are copied into your media library so the page does not load from there on every visit. Your server fetches only the image addresses in the HTML you pasted.