=== Custom Contact Forms ===
Contributors: outlawgt, tlovett1
Donate link: https://customformspro.com/
Tags: contact form, form builder, custom form, spam protection, turnstile
Requires at least: 5.0
Tested up to: 7.1
Stable tag: 7.17.0
Requires PHP: 7.4
License: GPLv2 or later
License URI: http://www.gnu.org/licenses/gpl-2.0.html

Build powerful custom forms with an intuitive drag-and-drop builder. Saved entries, dashboard, signatures, templates, and modern spam protection.

== Description ==

**Build powerful custom forms with an intuitive drag-and-drop builder.** Create everything from simple contact forms to advanced forms with templates, Gutenberg, modern spam protection, and more.

Custom Contact Forms gives you features many form plugins keep for their paid versions: every entry saved to your database, file uploads, conditional logic, signatures, and a dashboard that shows how each form performs. Build with drag and drop, start from a template, or describe the form you need.

**Try it before you install:** click Preview above to open a demo site with sample forms and a month of entries.

= Every Entry, Saved and Measured =

Each submission is stored in your WordPress database, so nothing is lost if a notification email goes astray. The Forms dashboard shows entries, form views, conversion rate and blocked spam for any date range, with a chart and a per-form breakdown. Export entries to CSV at any time.

= Signatures, Free =

Add a signature field to any form. Visitors sign with a mouse, finger or stylus, and the signature is saved with the entry and included in the notification email.

= Smart Forms Without Code =

Show or hide fields based on answers, accept file uploads, lay fields out in columns, send multiple email notifications per form, and create a WordPress post from a submission.

= Switch From Contact Form 7 in One Step =

Contact Form 7 does not save submissions. Import your Contact Form 7 and WPForms forms with their labels, fields and notification email under Forms → Import. Your original forms are only read, never changed.

= AI That Stays On Your Site =

Describe the form you need, such as "a booking form for a dog grooming appointment with the owner's details and their preferred date", and it is built for you, ready to edit. It uses the AI provider already connected to your site under Settings > Connectors, so there is no API key to enter and nothing is sent to us. Requires WordPress 7.0 or later; the option stays hidden otherwise.

= Spam Protection Built In =

Cloudflare Turnstile, reCAPTCHA, honeypot, time trap, rate limiting, disposable email blocking and a keyword blacklist, with every blocked attempt counted on the dashboard.

= Build Your Way =

The drag-and-drop builder lives inside the media manager, so there are no separate admin pages and no new interface to learn. Live previews update as you build. Start from a prebuilt template (contact, quote request, newsletter, event registration, or feedback), style forms with included themes, per-field widths or your own CSS, and insert them with the Gutenberg block, shortcode, widget, or PHP function.

**Powering thousands of active websites, with over 1.3 million all-time downloads.** Originally created by Taylor Lovett, Custom Contact Forms is now actively maintained by [Dmitry Alexander](https://oiopublisher.com/), rebuilt for modern WordPress with a hardened, PHP 8+ codebase, a refreshed builder, and new features added regularly.

= What You Can Build =

* Contact forms, quote requests, support forms, event registrations, newsletter signups, service agreements
* Text, paragraph, email (with optional confirmation), name, phone, website, address (US + international), date/time, dropdowns, checkboxes, radio buttons, file uploads, signatures, hidden fields, and HTML blocks
* Conditional fields and sections: show/hide fields based on other field values
* Multiple email notifications per form: customize recipients, subject, from name, reply-to, and body with field mapping
* Post creation on submission: map form fields to post fields, meta, and taxonomies

= Powerful Features, Included Free =

* Forms dashboard with entries, views, conversion rate and blocked spam for any date range
* Signature field that works on phones, tablets and desktops
* Drag-and-drop form builder with live preview in the media manager
* Prebuilt form templates for the most common form types
* Build a form by describing it, using your site's own AI connection
* Gutenberg block, shortcode, widget, and PHP template support
* Multiple form themes plus per-field width controls and custom CSS
* AJAX form submission: no page reloads
* Import your forms from Contact Form 7 and WPForms: fields, labels, required flags, placeholders, and choices, with a report of anything that needs your attention
* Export submissions to CSV, and import submissions from CSV with automatic column mapping
* Import and export forms via WordPress XML
* Cloudflare Turnstile, reCAPTCHA, and simple captcha options
* Built-in spam protection: honeypot, time-based trap, IP rate limiting, disposable email blocking, keyword blacklist
* Email diagnostics: send test emails and view delivery failure logs
* Submissions widget on your WordPress dashboard
* Restrict forms to logged-in users, or pause forms with a custom message
* Customizable completion text or redirect URL
* Conditional asset loading: only load scripts where forms appear
* Extensible with hooks, filters, and custom field types

= Quick Start =

1. Go to Forms → Templates and pick a starting template, or go to Forms → Forms and Submissions to start from scratch
2. Drag fields from the sidebar into the form area, and click a field to edit its label, width, and options
3. Save the form
4. Insert it with the Gutenberg block (search "CCF" in the block inserter) or the `[ccf_form id="X"]` shortcode
5. Click Forms in the admin menu to see entries, views and conversion rates on the Forms dashboard

= Customize More with Pro =

Custom Contact Forms Pro turns the builder you already know into forms that sell, book, and sign, with no e-commerce stack required.

* **Stripe payments on the form**: cards, Apple Pay, Google Pay, and Link, with a live "Pay $25.00" button and server-verified totals
* **PayPal payments**: pay in place without leaving your form, with the same server-verified totals
* **Product & pricing fields**: fixed price, multiple options, or customer-chooses-amount, with quantities, images, and enforced minimums
* **Coupons & live totals**: percentage or fixed discounts, order total updates as visitors choose
* **Signatures in PDF receipts**: the signature appears in the PDF receipt, alongside consent records and waiver and agreement templates
* **Consent / terms field**: scrollable terms with versioned agreement records, snapshotted permanently
* **PDF receipts**: attached to notification emails for paid orders, plus one-click PDF download of any submission
* **Multi-step forms**: page breaks, progress bar, per-step validation
* **Conditional logic**: show or hide any field based on answers, priced fields included
* **Survey & star rating fields**: Likert grids and quick ratings
* **Address autocomplete**: visitors pick their address as they type and the street, city, state and ZIP fill themselves in (uses your own Google API key)
* **SMS confirmations**: text customers the moment they book or pay, through your own Twilio account
* **13 ready-made templates**: donations, orders, registrations, waivers, agreements, and more
* **No added transaction fees**: you pay only Stripe's or PayPal's standard processing fees

[Learn more about Custom Contact Forms Pro](https://customformspro.com/)

== Installation ==

1. Upload the `custom-contact-forms` folder to `/wp-content/plugins/`
2. Activate the plugin through the Plugins menu
3. Go to Forms → Templates to start from a prebuilt form, or Forms → Forms and Submissions to build your own
4. Insert forms using the Gutenberg block or the `[ccf_form id="X"]` shortcode

= Shortcode =

`[ccf_form id="123"]`

= PHP Template Tag =

`<?php if ( function_exists( 'ccf_output_form' ) ) { ccf_output_form( 123 ); } ?>`

== Frequently Asked Questions ==

= How do I use a form template? =

Go to Forms → Templates and choose one of the prebuilt forms (Contact, Quote Request, Newsletter, Event Registration, or Feedback). A new form is created with the right fields already in place, ready for you to customize and insert.

= How do I collect a signature? =

Edit a form and drag the Signature field from the field list into your form. Visitors sign in the box with a mouse, finger or stylus, and can clear it and sign again. The signature is saved as an image with the submission, shown when you view the entry, and included in the notification email. Deleting the submission deletes the signature image too.

= How do I make fields sit side by side? =

Click a field in the builder, open the Advanced panel, and set its Field Width (half, third, two-thirds, or quarter). Place two or more partial-width fields together and they line up in columns. Widths apply on the published form, in the block editor preview and on the front end, but not inside the builder.

= How do I add custom styling? =

For per-form looks, choose a Form Theme (including the new Minimal theme) on the form or in the block settings. For site-wide custom styles, go to Forms → Settings and add your CSS in the Custom CSS box.

= How do I add Cloudflare Turnstile? =

Go to Forms → Settings and scroll to "Cloudflare Turnstile." Enter your site key and secret key (free from [Cloudflare Dashboard](https://dash.cloudflare.com/?to=/:account/turnstile)), enable it, and save. All forms will automatically show the Turnstile challenge.

= How do I insert a form? =

Use the Gutenberg block (search "CCF" or "Contact Form"), the shortcode `[ccf_form id="X"]`, the CCF widget, or the PHP template tag `ccf_output_form( X )`.

= Can I export and import form submissions? =

Yes. Edit any form and click the download icon to export submissions as a CSV file. To import, go to Forms → Import CSV, select a form, upload your CSV, and map the columns to form fields. The importer auto-detects matching columns by name.

= Does this plugin create custom database tables? =

No. All data is stored using WordPress custom post types and post meta. Nothing custom is added to your database schema.

= Is this plugin compatible with PHP 8? =

Yes. The plugin is fully compatible with PHP 8.0, 8.1, 8.2, 8.3, and 8.4.

= What does the dashboard count, and is it private? =

The dashboard counts entries from your saved submissions. It also counts form views and blocked spam from version 7.17 onward. A view is counted once per page load when a visitor's browser shows a form. Only daily totals are stored, in your own database. Nothing about the visitor is recorded, nothing is sent to any outside service, and views by people who can edit forms or by obvious bots are not counted. Developers can turn view counting off with the `ccf_count_form_views` filter.

= What does the deactivation survey collect? =

If you deactivate the plugin, an optional survey asks why. Nothing is sent unless you choose a reason or add a comment and click "Submit & Deactivate". The "Skip & Deactivate" option sends nothing. When you do submit, the plugin uses your site's own email to send the maintainer the reason you selected, your optional comment, your site URL, the number of forms you have, and your plugin, WordPress, and PHP versions. No personal data and no visitor data is collected, and no external tracking service is used.

== Screenshots ==

1. Drag-and-drop form builder with live preview and field settings
2. Form submissions management with CSV export
3. Gutenberg block with live preview and selectable form themes
4. Settings page with Cloudflare Turnstile and spam protection options
5. Prebuilt form templates to start a new form in one click
6. Forms dashboard with entries, views, conversion rate and blocked spam for any date range
7. Signature field: visitors sign with a mouse, finger or stylus, and the signature is saved with the entry

== External Services ==

This plugin optionally connects to the following third-party services for spam protection. These services are only used when the site administrator explicitly enables and configures them.

= Google reCAPTCHA =

When enabled in the form builder, this plugin loads the Google reCAPTCHA widget on form pages and sends form submission verification requests to Google's servers. The user's reCAPTCHA response token is sent to Google for validation. No personal data is sent by the plugin itself, though Google may collect usage data through their widget script.

* Service provider: Google LLC
* [Terms of Service](https://policies.google.com/terms)
* [Privacy Policy](https://policies.google.com/privacy)

= Cloudflare Turnstile =

When enabled in Forms → Settings → Cloudflare Turnstile, this plugin loads the Cloudflare Turnstile widget script on form pages and sends form submission verification requests to Cloudflare's servers. The user's Turnstile response token and the visitor's IP address are sent to Cloudflare for validation.

* Service provider: Cloudflare, Inc.
* [Terms of Service](https://www.cloudflare.com/terms/)
* [Privacy Policy](https://www.cloudflare.com/privacypolicy/)

== Changelog ==

= 7.17.0 =
* New: Forms dashboard, now the first screen under Forms. It shows entries, form views, conversion rate and blocked spam for the last 7, 30 or 90 days or any custom range, with an entries chart, a per-form table and suggested next steps.
* New: Form views and blocked spam are now counted as daily totals, kept on your site. No visitor data is stored.
* New: Signature field. Visitors sign with a mouse, finger or stylus, and the signature is saved as an image attached to the submission. It shows on the entries screen and in notification emails, and is deleted along with the submission. Existing signature fields created with Custom Contact Forms Pro keep working.
* New: A one-time prompt offers to turn on WordPress automatic updates for this plugin. Nothing changes unless you choose to turn it on.
* Fix: Forms created from a template or with the AI form builder now come with an email notification to the site admin, so a first test submission sends an email.
* Fix: Forms imported from Contact Form 7 or WPForms sent notification emails with an empty body. They now include every submitted field, and file uploads are attached.
* Tweak: The Contact Form 7 importer now uses the label text shown on your form, such as "How did you hear about us?", instead of a label built from the field's internal name. Acceptance checkboxes keep their wording and stay required unless marked optional in Contact Form 7.
* Tweak: The AI form builder can now add signature fields.
* Tweak: Tested up to WordPress 7.1.

= 7.16.1 =
* Security: fixed a missing authorization issue in the form update REST route. Nested field and choice IDs supplied in a request are now verified to be the correct post type and to belong to the form being edited before any post meta is written or any post is deleted. Reported by Wordfence PRISM. CVE-2026-75018.

= 7.16 =
* Tweak: A one-time introduction to Pro now appears in the form builder. It is dismissible and never returns.
* Feature: Build a form by describing it. Uses the AI provider already connected under Settings > Connectors, so there is no API key to enter and nothing is sent anywhere else. Requires WordPress 7.0 or later; the option stays hidden otherwise.
* Tweak: PayPal added to the Pro field preview in the form builder.
* Tweak: Deactivation feedback now reports how many submissions the forms collected and how long the plugin was in use.
* Tweak: Links to the Pro site identify which screen they came from, so it is possible to tell which prompts are useful.
* Fix: The Pro banner showed an old version number. It now follows the installed version.

= 7.15.0 =
* New: Import forms from Contact Form 7 and WPForms. Custom Contact Forms now reads your existing forms and rebuilds them as CCF forms: fields, labels, required flags, placeholders, dropdown and radio options, and the notification recipient where it can be resolved. Find it under Forms > Import.
* New: The importer never changes your original forms, tells you exactly which tags it could not convert, and skips forms you have already imported instead of creating duplicates. After importing it shows the new shortcode so you know what to swap on your pages.
* Fix: The submission total in the dashboard widget stayed on the old figure when you changed the time period. It now updates with the table.
* Tweak: The plugin's admin form handler no longer runs on front-end page loads.
* Tweak: If you mention an error when deactivating, the feedback form now asks for the error text so problems can actually be diagnosed.
* Tweak: If the reason you give for deactivating names something the Pro add-on does, the plugin says so once before deactivating. It never blocks or delays deactivation.
* Tweak: A one-time review request now appears after your forms have collected ten submissions, on Custom Contact Forms screens only. Dismissing it is remembered.

= 7.14.0 =
* New: Dashboard widget: see total submissions and a per-form breakdown for the last 7 days, 30 days, or all time, right on your WordPress dashboard
* New: Click any form in the widget to jump straight to its submissions
* New: One-time notice introducing Custom Contact Forms Pro (permanently dismissible, admin-only, hidden when Pro is active)

= 7.13.0 =
* Refreshed plugin listing and documentation
* Introduced Custom Contact Forms Pro: payments, signatures, PDFs, and more at customformspro.com
* Fix: The Pro field preview dialog in the form builder now displays correctly
* New: Get Pro link on the Plugins screen (shown only when the Pro add-on is not active)

= 7.12.0 =
* New: Optional feedback prompt when deactivating the plugin
* New: Developer hooks for add-ons (submission response, field rendering, submission preparation, and notification timing)
* Fix: Prevent a fatal error when a field attribute lacked an escape callback
* Fix: The form builder now handles unrecognized field types gracefully, so deactivating an add-on no longer breaks editing saved forms
* Tweak: Tested up to the latest WordPress

= 7.11.0 =
* Tweak: Modernized form builder: Yes/No options now display as toggle switches and fields appear as cards in the canvas
* Tweak: Friendly submission columns: the entry table now shows real field labels instead of internal slugs
* Tweak: Redesigned submissions table with a cleaner, more modern style
* Tweak: Redesigned Form Templates screen with custom template icons
* Dev: New ccf_pre_submission_errors filter so add-ons can run final pre-save validation
* Compatibility: Tested up to WordPress 7.0

= 7.10.0 =
* New: Form templates: prebuilt Contact, Quote Request, Newsletter, Event Registration, and Feedback forms under Forms → Templates
* New: Field width controls: set fields to full, half, third, two-thirds, or quarter width for multi-column layouts
* New: Minimal form theme: modern underlined-input style, selectable per form and per block
* New: Custom CSS setting: add site-wide form styles from Forms → Settings
* Tweak: Refreshed form builder with field-type icons and a cleaner, more modern interface

= 7.9.1 =
* Privacy: Google reCAPTCHA API is no longer loaded by default. It now loads only on pages that actually render a reCAPTCHA field, preventing unsolicited third-party requests
* Fix: register_setting() calls updated to the modern array syntax with explicit sanitize_callback

= 7.9.0 =
* New maintainer: Dmitry Alexander (outlawgt)
* Security: Full top-down code audit and hardening
* Security: Fixed XSS vulnerability in form renderer (unescaped REQUEST_URI)
* Security: Fixed potential SQL injection in export filter_query()
* Security: Added capability checks to export and API delete endpoints
* Security: Removed abandoned external Mailchimp subscription (dead URL)
* Security: All API permission callbacks return WP_Error for proper REST responses
* Security: Sanitized IP address and nonce inputs throughout
* New: Gutenberg block with form selector and live server-side preview
* New: Cloudflare Turnstile integration (Settings → Cloudflare Turnstile)
* New: Enhanced anti-spam: improved honeypot, time-based trap, IP rate limiting
* New: Disposable email blocking and keyword blacklist
* New: Email diagnostics: test email button and wp_mail failure logging
* New: Copy shortcode button in form list, edit screen, and At a Glance panel
* New: CSV submission importer (Forms → Import CSV) with column auto-mapping
* New: Modern responsive form CSS with proper focus states and transitions
* New: Dark and light theme overrides with modern styling
* New: jQuery UI datepicker modern style override
* Fix: PHP 8+ compatibility: resolved all deprecation warnings and type errors
* Fix: session_start() checks session_status() and headers_sent()
* Fix: (double) cast replaced with proper int math
* Fix: Settings page array offset on false when options not yet set
* Fix: Null-safe array access in submission CPT formatters
* Fix: Import bug: choices saving to wrong meta key
* Fix: show_in_json replaced with show_in_rest
* Fix: Removed obsolete vendored WP-API loader
* Tweak: ABSPATH guards added to all PHP files
* Tweak: date() replaced with wp_date(), parse_url() with wp_parse_url()
* Tweak: wp_send_json() replaces echo json_encode() + exit pattern

= 7.8.5 =
* Prevent submissions from being accessible in API

= 7.8.4 =
* Fix WP 4.7 conflict

= 7.8.3 =
* Fix WooCommerce conflict

= 7.8.2 =
* Add $submission to ccf_email_subject filter, correct "Invalid Date" issue with datepicker
* Fix WooCommerce conflict
* Add support for Customize Posts plugin

= 7.8.1 =
* Cache busy form submission URL
* Improve field choice UI

= 7.8 =
* Hide form title setting
* Reply to notification fields
* Activate form notifications by default

= 7.7 =
* New CAPTCHA option
* Fix "0" choice input bug
* Fix empty conditional bug
* Reset field renderer bug fixed
* Guide user for whitelisting file extensions in file field
* Submit class form option
* Logged in users only form option

= 7.6 =
* Form duplication
* Fix multiple section header bug
* Button class field

= 7.5 =
* Conditional fields and sections
* [current_date_time] notification variable

== Upgrade Notice ==

= 7.17.0 =
Adds a Forms dashboard with entries, views, conversion rate and blocked spam, and a free signature field. Also fixes blank notification emails on imported forms and missing notifications on new template forms. All existing forms and submissions are preserved.

= 7.15.0 =
Import your Contact Form 7 and WPForms forms into Custom Contact Forms in one step, under Forms > Import. Your existing forms are only read, never changed. Also fixes the dashboard widget total when switching time periods.

= 7.11.0 =
A visual refresh of the form builder (toggle switches and card-style fields), a modernized submissions table with friendly column labels, and a redesigned templates screen. Tested up to WordPress 7.0. All existing forms and submissions are preserved, with no data migration needed.

= 7.10.0 =
Adds form templates, per-field width controls, a Minimal theme, custom CSS, and a refreshed builder. All existing forms and submissions are preserved, with no data migration needed.

= 7.9.0 =
Major security and compatibility update. Fixes PHP 8+ errors, adds Gutenberg block, Cloudflare Turnstile spam protection, and modern form styling. All existing forms and submissions are preserved, with no data migration needed. Recommended for all users.
