=== FormsKit Lite – Drag & Drop Form Builder, Contact Form & Survey ===
Contributors: abdulwahabtaqi
Donate link: https://wpkits.io/
Tags: contact form, form builder, multi step form, survey, file upload
Requires at least: 6.2
Tested up to: 7.1
Stable tag: 2.2.0
Requires PHP: 8.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Free drag and drop form builder for contact forms, surveys and multi-step forms, with conditional logic, file uploads, entries and spam protection.

== Description ==

https://www.youtube.com/watch?v=li2EFT0FR6k

https://www.youtube.com/watch?v=0CLda34h_Lg

**FormsKit Lite** is a free drag-and-drop form builder for WordPress. It includes 18 field types, conditional logic, entry management, file uploads, multi-page forms, and spam protection — all at no cost.

= What you can build =

* **Contact forms** — a simple contact form with name, email and message.
* **Multi-step forms** — break long forms into steps with a progress bar.
* **Surveys and feedback forms** — collect answers and export them as CSV.
* **File upload forms** — let visitors send files with their submission.
* **Registration and booking requests** — collect details with conditional logic.

FormsKit (Forms Kit) is built for speed: no jQuery on the front end and a small CSS footprint.

= Features =

* ✅ **18 Field Types** — Text, email, phone, address, number, dropdown, checkbox, radio, date/time, and more
* ✅ **Conditional Logic** — Show or hide fields based on user input
* ✅ **Entry Management** — View, search, and export submissions in your dashboard
* ✅ **File Uploads** — Let users attach files to their submissions
* ✅ **Multi-Page Forms** — Break long forms into manageable steps with a progress bar
* ✅ **Email Notifications** — Send up to 2 notification emails per submission
* ✅ **Spam Protection** — Built-in honeypot, custom CAPTCHA, and math puzzles
* ✅ **Gutenberg Block + Shortcode** — Embed forms anywhere

= Lite Fields (All Free) =

* Text, Textarea, Email, Number, Name, Phone, Address, URL, Password
* Dropdown, Radio, Checkbox, Date/Time Picker
* Number Slider, Captcha, File Upload, Page Break, GDPR Consent

= Available in FormsKit Pro =

* Rating (Pro), Content (Pro), HTML (Pro), Section Divider (Pro), Layout (Pro), Hidden Field (Pro)
* Digital Signature (Pro), Rich Text Editor (Pro), Likert Scale (Pro)
* Net Promoter Score (Pro), Camera (Pro), Repeater (Pro), Entry Preview (Pro)

= Available in FormsKit Elite =

* Payment Items (Single, Multiple, Checkbox, Dropdown)
* Coupons, Order Total, Payment Gateway

= Performance =

FormsKit is lightweight and built with modern PHP 8.0+ code. No jQuery dependency required on the frontend, no unnecessary database queries, and minimal CSS footprint.

= Developer Friendly =

* Clean PSR-4 autoloading
* Extensive hooks and filters
* Custom Smart Tags API
* Well-documented codebase

= Author and links =

Author: Abdul Wahab Taqi

Plugin website: [FormsKit on WPKits](https://www.wpkits.io/formskit/)

LinkedIn: [Abdul Wahab Taqi](https://www.linkedin.com/in/abdulwahab-taqi/)

Website: [Rowerr](https://rowerr.com/)

== Installation ==

1. Upload the `formskit-lite` folder to the `/wp-content/plugins/` directory
2. Activate the plugin through the 'Plugins' menu in WordPress
3. Go to **FormsKit → Add New** to create your first form
4. Use the Gutenberg block or `[formskit_form id="123"]` shortcode to embed your form

== Frequently Asked Questions ==

= How do I create a contact form in WordPress? =

Go to FormsKit → Add New, pick the Contact Form template, then add the FormsKit block or the shortcode to any page.

= How do I make a multi-step form? =

Add a Page Break field between steps. FormsKit shows a progress bar automatically.

= Can I stop spam without Google reCAPTCHA? =

Yes. Use the built-in honeypot, a custom CAPTCHA or a math captcha. reCAPTCHA, Turnstile and hCaptcha are optional.

= Can visitors upload files? =

Yes. The File Upload field is free and lets you limit file types and size.

= Does FormsKit work with Elementor and the block editor? =

Yes. Use the FormsKit block in the block editor, or the shortcode in Elementor and other page builders that support shortcodes.


= Is FormsKit Lite really free? =

Yes! FormsKit Lite includes 18 field types, conditional logic, entry management, file uploads, multi-page forms, and spam protection — all free with no hidden costs or usage limits.

= What's the difference between Lite, Pro, and Elite? =

**Lite** includes all essential form-building features for free. **Pro** adds advanced fields like digital signatures, repeater fields, and surveys. **Elite** adds payment processing, coupons, and checkout features. See the full comparison at [wpkits.io/formskit-pricing](https://www.wpkits.io/formskit/#pricing).

= Can I accept payments with FormsKit Lite? =

Payment fields are available in the Elite version. FormsKit Lite focuses on form building and data collection.

= Does it work with my theme? =

FormsKit is designed to work with any properly-coded WordPress theme. It uses minimal, non-intrusive CSS that adapts to your theme's styling.

= Is it GDPR compliant? =

FormsKit includes a GDPR/Consent field and stores all submission data locally in your WordPress database. Geolocation enrichment is **disabled by default** and must be explicitly enabled in **FormsKit → Settings** before any IP data is sent to ip-api.com. See the **External Services** section below for full disclosure. Third-party CAPTCHA services are also opt-in only.

= Does FormsKit connect to external services? =

Yes — see the **External Services** section below for complete details on all third-party connections, including what data is transmitted and when.

= Can I migrate from another form plugin? =

FormsKit includes an import feature that supports JSON form configurations.

== External Services ==

This plugin connects to the following third-party services under specific conditions. No external connections are made unless the features described below are actively used or enabled by the site administrator.

= IP Geolocation (ip-api.com) =

FormsKit can optionally enrich form submission entries with geographic location data (city, region, country, coordinates). This feature is **disabled by default** and must be explicitly enabled by the site administrator in **FormsKit → Settings**.

* **What data is sent:** The submitting visitor's IP address.
* **When it is sent:** Only when the geolocation feature is enabled in settings, on each form submission.
* **What is stored:** City, region, country, latitude, and longitude are stored in your WordPress database as entry metadata.
* **Service provider:** ip-api.com
* **Terms of Service:** [https://ip-api.com/docs/legal](https://ip-api.com/docs/legal)
* **Privacy Policy:** [https://ip-api.com/docs/legal](https://ip-api.com/docs/legal)

= Phone Field Country Detection (ipapi.co) =

When a form includes a Phone field with the international telephone input enabled and no default country is specified, the plugin uses ipapi.co to automatically detect the visitor's country and set the correct country code and flag.

* **What data is sent:** The visitor's IP address (sent automatically by the browser as part of the HTTP request).
* **When it is sent:** On page load, only when a form with an international phone field is displayed and no default country has been configured by the site administrator.
* **What is stored:** Only the two-letter country code is used in the browser to set the phone field default. No data from this service is stored in your WordPress database.
* **Service provider:** ipapi.co (Kloudend, Inc.)
* **Terms of Service:** [https://ipapi.co/terms/](https://ipapi.co/terms/)
* **Privacy Policy:** [https://ipapi.co/privacy/](https://ipapi.co/privacy/)

= CAPTCHA Services (Opt-In Only) =

If you choose to enable a third-party CAPTCHA service in **FormsKit → Settings**, the following external scripts will be loaded on pages containing your forms. These connections are **opt-in only** and require you to enter API keys in settings. No CAPTCHA data is transmitted without your explicit configuration.

* **Google reCAPTCHA v2/v3** — Loads scripts from `google.com/recaptcha`. [Google Terms of Service](https://policies.google.com/terms) | [Google Privacy Policy](https://policies.google.com/privacy)
* **Cloudflare Turnstile** — Loads scripts from `challenges.cloudflare.com`. [Cloudflare Terms of Service](https://www.cloudflare.com/website-terms/) | [Cloudflare Privacy Policy](https://www.cloudflare.com/privacypolicy/)
* **hCaptcha** — Loads scripts from `js.hcaptcha.com`. [hCaptcha Terms of Service](https://www.hcaptcha.com/terms) | [hCaptcha Privacy Policy](https://www.hcaptcha.com/privacy)

== Screenshots ==

1. Drag & drop form builder with live preview and element properties panel
2. Field library with 18 field types organized by category
3. Conditional logic builder with AND/OR groups and test scenario tools
4. Entry management dashboard with tags, filters, bulk actions, and analytics
5. Email notification editor with Smart Tags and instant preview
6. Gutenberg and Elementor integration

== Changelog ==

= 2.2.0 =
* Security: Uploaded files get a random name, are kept only when the submission succeeds, honour Max Files, and go to the Media Library only when "Store in Media Library" is on. Restricted or password-protected files are stored privately under secret names (safe on nginx too) and served through a signed link, with a new Download Password option.
* Security: Password field values are stored as a one-way hash and shown as •••••••• in entries, CSV exports and emails.
* Security: Custom Captcha is checked on the server with a signed, one-time challenge; the answer is no longer in the page, and cached pages get a fresh question.
* Security: Multi-step forms now include the honeypot and the reCAPTCHA / Turnstile / hCaptcha widget on the last step; reCAPTCHA v3 tokens are made on submit and widgets reset after a failed attempt.
* Security: Rate limiting works per visitor and per form; a typo no longer locks people out (separate, higher limit for failed attempts), and the real visitor IP is read behind Cloudflare (other proxies via the formskit_trusted_proxies filter).
* Security: CSV export and Settings save check that the user is an administrator.
* New: Checkbox "Select All / Deselect All" buttons work and respect Max Selections.
* New: Dropdown "Modern" style is a real searchable list — type to filter, arrow keys, Enter, Escape, groups and multi-select.
* New: Image choices get real "Classic" (framed image with a tick box) and "Rounded" (circle image) styles.
* New: One "Accent" colour in Form Styles (and an Elementor "Accent Color" control) for selected cards, focus rings, ticks, progress and Next.
* Fix: Checkbox and Radio "Other" no longer wipes the answer; the typed text is saved as "Other: …".
* Fix: Confirm Email and Confirm Password no longer overwrite the real value, and a mismatch is blocked in the browser and on the server.
* Fix: A text field with a character limit plus prefix/suffix no longer breaks every form on the page.
* Fix: Multi-step "Next" runs the same checks as the final submit (email and URL format, required Name/Address parts, number limits, patterns, confirm fields, date and file limits); fields hidden by logic no longer block Next; errors open the step that holds them.
* Fix: Enter in a field on a middle step goes to the next step instead of submitting the form.
* Fix: The form error message stays until the next attempt and is announced to screen readers.
* Fix: Multi-step forms no longer scroll the page on load; changing steps scrolls to the top of the form, below any sticky header, only when needed.
* Fix: Each "Previous" button shows the label of the page break before its page.
* Fix: Conditional logic chains — a field that depends on a hidden field hides too, in the browser and on the server. Checkbox and multi-select rules test each ticked value, and field logic "Any" works.
* Fix: Email notification conditional logic now decides whether a notification is sent.
* Fix: Date / Time limits (past dates, weekdays, blocked dates, hours, min/max date) are applied in the picker, the browser and on the server.
* Fix: Website field — "instagram.com/x" next to the https:// prefix is saved as https://instagram.com/x, "Require protocol" is enforced, and only http(s) links are accepted.
* Fix: Character limits are checked on the server; character and word limits are checked before Next and submit.
* Fix: Consent text shows "Privacy Policy" and "Terms of Service" (linked to the site's privacy page when set) instead of raw {placeholders}.
* Fix: Smart tags and {all_fields} print choice labels, full names, "Accepted" and file names.
* Fix: Forms on cached pages no longer fail with "Security check failed" — a fresh security token is fetched before sending.
* Fix: Dashes, accents, quotes and backslashes survive when a form is saved, duplicated, imported or saved as a template.
* Fix: The Style tab's live preview shows real controls for every field type.
* Fix: Elementor's Progress "Active / Fill Color" is no longer overridden by the form's own colour.
* Fix: The password eye icon and the phone country picker keep their look under themes that style buttons.
* Fix: Runs on PHP 8.0 and 8.1 again, as "Requires PHP: 8.0" promises.
* Change: The Password strength meter is off by default; its Minimum Strength is enforced only when it is turned on.
* Performance: Font Awesome, intl-tel-input and Inputmask load only on forms that use them (about 570 KB less on most forms); the phone utilities load on first use.

= 2.1.9 =
* Update plugin listing name, descriptions, tags, use cases and FAQs.
* Clarify which fields are available in Pro.

= 2.1.7 =
* Tested up to WordPress 7.1.
* Improved WordPress compatibility checks for debug notices and database identifier queries.

= 1.0.0 =
* Initial release
* 18 field types with drag & drop builder
* Conditional logic
* Entry management with search and export
* Multi-page forms with progress bar
* File upload support
* Spam protection (honeypot + custom CAPTCHA)
* Smart Tags for dynamic content
* Gutenberg block + shortcode support
* 2 email notifications per form
* Import/export forms

== Upgrade Notice ==

= 2.2.0 =
Security and reliability update: private file uploads, hashed passwords, server-checked captcha, fixes for multi-step forms, conditional logic and cached pages, searchable dropdowns, and lighter pages. Update recommended.

= 2.1.7 =
Compatibility update for WordPress 7.1.

= 1.0.0 =
Initial release of FormsKit Lite.
