=== ALPEG Forms ===
Contributors: alpegsystems
Tags: form, contact form, gdpr, file upload, multi-step form
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.3
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

A tidy form builder for the block editor. Fast, privacy-friendly (GDPR) and free of annoying ads in your dashboard.

== Description ==

ALPEG Forms makes forms as simple as they should be:

* **Ready in under a minute:** insert the block, pick a template, publish.
* **Zero nags:** no banners, no pop-ups, no ads in your dashboard.
* **Fast:** CSS and JavaScript only load on pages that actually contain a form. No jQuery.
* **Multi-step forms:** split long forms into steps with a progress bar – without JavaScript, all steps are simply shown one below the other.
* **File uploads:** documents and images with size and type limits, real content checks, protected storage, download for administrators and optional email attachments.
* **Conditional fields:** show a field only if another field has a certain value.
* **Privacy controls:** consent field, automatic retention periods (including uploaded files), shortened IP addresses, export and erasure via the WordPress privacy tools, suggested privacy policy text. No external services.
* **Spam protection without captcha puzzles:** honeypot, timing check and rate limit.
* **Clear error messages** directly at the field – no browser bubbles.
* **All submissions in the dashboard:** overview with search and filter, detail view, CSV export (opens directly in Excel).
* **Emails you can rely on:** notification and optional confirmation with placeholders such as {name}, delivery status per submission, test mail and SMTP detection.
* **Reusable templates:** save any form as a template and use it on other pages.
* **Switch in one click:** import your forms from Contact Form 7, WPForms, Ninja Forms, Gravity Forms, Formidable Forms and Fluent Forms – and take over old submissions stored by Flamingo (Contact Form 7) or WPForms.
* **Accessibility check in the editor:** missing labels, duplicate labels, placeholder-only hints, empty choices or a too-light accent colour are pointed out while you build the form.
* **Share templates:** export your saved templates as a file and import them on another website.
* **Upload protection check:** a Site Health test verifies that uploaded files cannot be opened directly from the web and tells you how to fix it if they can (e.g. on nginx).

Templates: contact, callback request, appointment request, feedback, quote request, job application (3 steps with CV upload).

Field types: text line, email, phone, text area, dropdown, single and multiple choice, date, number, website, file upload, consent, step break.

Translation-ready: English source strings. Available community translations are delivered through WordPress language packs; regional German translation sources are maintained separately.

= Privacy and external services =

ALPEG Forms does not connect to any external service. There is no tracking, no telemetry and no "phone home". The only request the plugin makes is to your own website: the upload protection check requests a harmless test file from your own upload directory (Tools → Site Health and the settings page). Submissions, uploaded files and settings stay in your own WordPress database and uploads folder. Emails are sent through WordPress (wp_mail) – or through your SMTP plugin, if you use one.

Data is only removed automatically if you set a retention period, and only deleted on uninstall if you explicitly enable "Also remove all submissions, uploaded files and settings when deleting the plugin" in the settings.

= Accessibility =

Forms are tested against WCAG 2.2 AA: every field has a label, choice groups are announced correctly, error messages are linked to their field and announced to screen readers, focus moves to the first error and to the next step, and everything works with the keyboard.

== Installation ==

1. Upload and activate the plugin.
2. Click "Create contact page with form" under "ALPEG Forms" – or insert the "ALPEG Form" block into any page.
3. Publish. Done.

== Frequently Asked Questions ==

= Emails do not arrive? =
By default WordPress sends mail directly from the web server, which many providers do not deliver reliably. Install an SMTP plugin – ALPEG Forms uses its settings automatically. Under "ALPEG Forms → Settings" you can send a test mail and see the last error. All submissions are always stored in the dashboard as well.

= Where are uploaded files stored? =
In wp-content/uploads/alpeg-forms/ with random file names. The directory is protected against direct access on Apache and IIS. On nginx, add this rule to your server block:

`location ^~ /wp-content/uploads/alpeg-forms/ { deny all; }`

Administrators download files through the dashboard, so the rule does not affect them.

= Does it work on multisite? =
Yes. Each site keeps its own submissions, files and settings. You can activate the plugin network-wide; new sites are set up automatically.

= Does it work with page caching? =
Yes. Forms do not depend on nonces that expire, so cached pages keep working.

= Which databases are supported? =
MySQL and MariaDB – everything WordPress officially runs on.

= I'm using another form plugin. Can I switch? =
Yes. Under "ALPEG Forms → Import & export" your forms from Contact Form 7, WPForms, Ninja Forms, Gravity Forms, Formidable Forms and Fluent Forms are taken over as templates in one click. The source plugin does not even have to be active. Your pages and the old plugin stay untouched until you replace the form on a page. Submissions stored by Flamingo (Contact Form 7) or WPForms can be copied as well – never twice, and not if they are older than your retention period.

= Can I reuse a form on another website? =
Yes. Save the form as a template in the editor, then download it under "ALPEG Forms → Import & export" and import the file on the other website. Recipient addresses are not part of the file.

= How do I report a security issue? =
Please do not post it in the support forum. Send it to security@alpeg-systems.com – see SECURITY.md for details.

== Screenshots ==

1. Start with a template – or with one of your own saved templates.
2. Edit fields directly in the sidebar, including file uploads and conditions.
3. Multi-step form with progress bar and clear error messages at the field.
4. All submissions in the dashboard – with search, filter, file and mail status icons.
5. Submission details with file downloads and delivery status of the notification.
6. Mail diagnostics: SMTP detection, test mail and the last error at a glance.
7. Switching made easy: import forms from Contact Form 7, WPForms and other form plugins.

== Upgrade Notice ==

= 1.0.3 =
Secures the read-status action and keeps upload diagnostics within the plugin upload directory.

= 1.0.2 =
Corrects imported consent, import error reporting, upload protection checks and duplicate field IDs.


= 1.0.1 =
More importers, accessibility check in the editor, template files and an upload protection check.

= 1.0.0 =
First public release.

== Changelog ==

= 1.0.3 =
* Security: require an entry-specific nonce before marking a submission as read.
* Security: enforce administrator permissions in the bulk-action handler.
* Fixed: upload diagnostics no longer write a control file into the uploads root.
* Changed: use WordPress language packs; bundled regional translations are maintained separately.
* Changed: remove the unnecessary load_plugin_textdomain call.

= 1.0.2 =
* Preserve the actual consent state when importing WPForms submissions.
* Report failed database writes during submission import and allow retries.
* Verify upload protection with a public control file; report server errors as inconclusive.
* Prevent duplicate field IDs when importing or normalizing forms.


= 1.0.1 =
* New: import forms from Ninja Forms, Gravity Forms, Formidable Forms and Fluent Forms.
* New: take over old submissions from Flamingo (Contact Form 7) and WPForms – without duplicates and respecting your retention period.
* New: accessibility check in the block editor.
* New: export and import templates as a file.
* New: Site Health test and settings check for the protection of the upload directory, with the matching nginx rule.
* New: "Feedback & help" section in the settings (plain links, nothing is sent automatically).
* Changed: "Import" is now "Import & export" and always available.

= 1.0.0 =
* Prepared for WordPress.org submission.
* Improved: redirect parameters after submitting without JavaScript use unique names (no conflicts with other form plugins).
* Improved: readme with privacy, accessibility, multisite and nginx notes.

= 0.3.1 =
* Security: on multisite, a form can only be submitted on the site that displays it.
* Improved: multisite support – new sites are set up right away, deleting a site removes its submissions, network deactivation stops all scheduled clean-ups.
* Improved: accessibility – radio groups are announced as required/invalid correctly, checkbox groups announce "required" to screen readers, error messages are linked to the whole group.

= 0.3.0 =
* New: import forms from Contact Form 7 and WPForms as templates.
* New: security policy (SECURITY.md) with a reporting address.
* Changed: the license page only appears once a Pro add-on is installed.

= 0.2.1 =
* Fixed: phone numbers and postcodes keep their leading "+" or "0" in Excel (no more 4.9E+12).
* Improved: CSV export merges fields with the same label from different forms into one column.

= 0.2.0 =
* New: multi-step forms with progress bar.
* New: file uploads with type/size limits, content check, protected storage, admin download and optional email attachments.
* New: conditional fields.
* New: own validation messages instead of browser bubbles.
* New: mail diagnostics (test mail, SMTP detection, last error, delivery status per submission).
* New: save forms as templates, reorder fields via drag & drop.
* New: job application template.
* New: English as base language, German translations (du/Sie), Austrian and Swiss German.
* Improved: detail view shows the page title instead of the URL.

= 0.1.0 =
* First version (MVP).
