User Guide

Overview

Darwin Form Handler for Pardot bridges Contact Form 7 with Salesforce Pardot (Salesforce Marketing Cloud Account Engagement) Form Handlers. When a visitor submits a CF7 form:

• All posted field values are collected and mapped by field name.
• Any files uploaded via the [multifile] field are copied from the CF7 temporary directory to a permanent, web-accessible location under wp-content/uploads/cf7-pardot-uploads/.
• Permanent file URLs are substituted for the raw file references in both the notification email and the Pardot payload.
• The full data set is posted to the Pardot Form Handler endpoint URL you configure per form.

Requirements

The plugin checks for Contact Form 7 on activation and displays an admin notice if it is not installed or active.

Installation

1. Download the plugin .zip file from WordPress.org or your account.
2. In WordPress admin go to Plugins → Add New → Upload Plugin and upload the zip, or extract the folder to wp-content/plugins/ via FTP.
3. Click Activate Plugin. If Contact Form 7 is not active, activation will be blocked with a clear message.
4. Navigate to Contact → Pardot Integration to view the setup dashboard.

Setup

1. In Salesforce Pardot, navigate to Marketing → Forms → Form Handlers and create (or open) a Form Handler. Copy its Endpoint URL.
2. In WordPress admin open Contact → Contact Forms and edit the form you want to connect.
3. Click the Pardot Settings tab that the plugin adds to the CF7 form editor.
4. Paste the Pardot Form Handler endpoint URL into the Pardot Endpoint URL field and save the form.
5. Ensure the field names in your CF7 form (e.g. your-name, your-email) match the External Field Names in your Pardot Form Handler. Pardot matches submissions by field name.

Repeat for each form that should send data to Pardot — each form stores its own endpoint URL independently.

Multiple Field

The plugin registers a custom CF7 tag type: multifile (and multifile* for required). Insert it into your form using the Tag Generator or directly in the form body.

Basic syntax

[multifile file_uploads]

[multifile* file_uploads]

With options

[multifile file_uploads limit:5 file_size:10]

Options

Mail tab

To include file URLs in the CF7 notification email, add the mail-tag for your field name in the Mail tab body, e.g. [file_uploads]. Each URL is printed on a separate line.

Accepted File Types

The plugin validates uploads by both file extension and actual MIME type server-side. The following formats are accepted:

Files with a disallowed type are rejected at validation time with a user-facing error message. No disallowed file reaches the upload directory.

Pardot Field Mapping

The plugin posts all CF7 field values to the Pardot endpoint using the CF7 field name as the POST key. Fields that begin with an underscore (CF7 internal fields such as _wpcf7) are excluded automatically.

Regular fields

• Text, email, textarea, select, radio, and checkbox fields are sent using the exact CF7 field name as the Pardot External Field Name.
• Multi-value fields (checkboxes, multi-select) are joined into a comma-separated string.

File fields

• Each file in a [multifile] field is copied to a permanent directory and its public URL replaces the raw file reference.
• Multiple URLs are joined as a comma-separated list in the individual field key.
• A combined file_urls key is also added containing all file URLs from all file fields in the form.

Email Notifications

Darwin Form Handler for Pardot also replaces the raw CF7 file reference in the form's notification email with the permanent public URL(s), so the admin email contains clickable links rather than internal file identifiers.

• Add [file_uploads] (or whichever name you used) to the Mail tab body in the CF7 form editor.
• For HTML emails, URLs are separated by <br />. For plain-text emails, URLs are separated by newlines.
• This replacement happens during CF7's own mail-tag resolution phase, before the email is sent.

Security

• MIME validation: wp_check_filetype_and_ext() verifies both the file extension and the actual byte-level MIME type of every uploaded file.
• Upload directory protection: A .htaccess file is written to cf7-pardot-uploads/ on first use, blocking execution of PHP, PHTML, PHAR, HTML, and SVG files.
• Nonce verification: The Pardot endpoint URL is saved only after verifying CF7's form-editor nonce and confirming the current user has the wpcf7_edit_contact_forms capability.
• Output escaping: All admin output uses esc_html_e(), esc_attr(), and esc_url() throughout.
• Direct access guard: Every PHP file exits immediately if ABSPATH is not defined.
• CF7 dependency check: The plugin deactivates itself on activation if Contact Form 7 is not present, and shows an admin notice when CF7 is deactivated later.