=== お問い合わせフォーム by cuerda ===
Contributors: cuerda
Tags: contact form, inquiry, japanese, turnstile
Requires at least: 7.0
Tested up to: 7.0
Requires PHP: 8.2
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

A simple, security-focused contact form for Japanese websites.

== Description ==

Cuerda Email Form is a contact form developed for Japanese websites with a focus on security and simple installation.

It is designed to let web designers, production staff, blog editors, and administrators of small websites add a general-purpose contact form without complicated setup.

The form provides four fields: Name, Subject, Email Address, and Message. Visitors can review their entries on a confirmation screen before sending. The plugin provides administrator notifications, automatic replies, protection against automated spam and duplicate submissions, and one optional PDF attachment. The PDF size limit is up to 5 MB and may be lower depending on the WordPress server environment.

Cloudflare Turnstile can optionally be used for spam protection. Cloudflare Turnstile is an alternative to CAPTCHA that can verify visitors with less user interaction.

Advanced users can apply additional CSS to the form from the WordPress administration screen. Inquiry contents are not stored in the WordPress database.

== Installation ==

1. Activate the plugin.
2. Open Settings > Cuerda Email Form.
3. Set the recipient email address and, if needed, configure Cloudflare Turnstile.
4. Add the contact form block to a page, or insert the shortcode [cuerda_email_form].

== Frequently Asked Questions ==

= Are inquiry contents stored in WordPress? =

No. The plugin does not store inquiry contents in the WordPress database. To prevent duplicate submissions, it temporarily stores only non-personal submission state and temporary processing state.

= Can I cache the page containing the contact form? =

The contact form page handles temporary state during confirmation and submission, so it should be excluded from page caching. The plugin also sends no-cache headers for pages containing the form, but settings in caching products may take precedence.

= How are PDF attachments handled? =

One PDF file can be attached, up to 5 MB or the lower upload limit provided by the WordPress server environment. The PDF is attached to the administrator notification but is not attached to the automatic reply.

PDF files are not registered in the WordPress Media Library, and neither the inquiry body nor the PDF itself is stored in the WordPress database. Before sending, the PDF is held only in a private temporary area and is deleted after a successful submission. Abandoned temporary files are cleaned up after 24 hours.

If a safe temporary area cannot be used, or if file uploads are unavailable in the server environment, PDF attachments are disabled. The contact form can still be used without a PDF attachment.

== External services ==

Cloudflare Turnstile is an optional feature that can reduce automated spam submissions. It is used only when a site administrator enables it in the plugin settings. A Cloudflare Turnstile Site Key and Secret Key are required to use this feature.

When Turnstile is enabled, the visitor's browser loads Cloudflare's official Turnstile runtime on the confirmation and submission screen:
https://challenges.cloudflare.com/turnstile/v0/api.js

When the form is submitted, the plugin's server-side code sends a verification request to Cloudflare's siteverify API:
https://challenges.cloudflare.com/turnstile/v0/siteverify

The siteverify request contains the Cloudflare Secret Key, the Turnstile response token received from the visitor, and a submission identifier used as the idempotency key to prevent duplicate verification. No inquiry form fields are sent to siteverify.

When Turnstile is disabled, the browser does not load the Turnstile runtime and the plugin does not send siteverify requests to Cloudflare.

Cloudflare Turnstile:
https://www.cloudflare.com/products/turnstile/

Cloudflare Terms:
https://www.cloudflare.com/website-terms/

Cloudflare Privacy Policy:
https://www.cloudflare.com/privacypolicy/

== Changelog ==

= 1.0.0 =

- Initial release.
- Four contact form fields with a confirmation screen.
- Administrator notification and automatic reply.
- Protection against automated spam and duplicate submissions.
- Optional Cloudflare Turnstile support.
- One optional PDF attachment, up to 5 MB or the lower WordPress server upload limit.
- Gutenberg block and shortcode support.
- Additional CSS support for advanced users.
