=== KillerConversions – Contact Form Builder ===
Contributors: pluginsshop
Tags: contact form, form builder, conditional logic, contact form database, lead generation
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.2.5
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Build contact forms and quote requests with conditional logic. Save submissions in WordPress, send email notifications and export CSV.

== Description ==

KillerConversions is a free WordPress contact form builder for customer enquiries, quote requests and project briefs. Build forms visually, show relevant questions with conditional logic, and save submissions in your WordPress dashboard. Choose email notifications or Inbox only.

Free needs no vendor account, licence key or marketing signup.

**[Try the Free demo](https://www.killerconversions.com/demo/?edition=free) | [Try the Pro demo](https://www.killerconversions.com/demo/?edition=pro) | [Compare Free and Pro](https://killerconversions.com/features/)**

Try a temporary WordPress workspace with fictional examples and no signup. Outgoing email and external connections are blocked. Use sample information; demo work is temporary.

= What is included in Free? =

* **Visual form builder:** templates, field editing, keyboard reordering, preview and design drafts before publishing.
* **Conditional fields:** show or hide follow-up questions based on previous answers.
* **Local form entries:** search, filter, star, mark read/unread, assign and export submissions to CSV.
* **Optional notifications:** configure staff emails and separately requested visitor confirmations, or use Inbox only. Review failures in Delivery; sending depends on your site's mail setup.
* **Spam protection:** honeypot, submission rate limiting and optional Cloudflare Turnstile with your own widget keys.
* **Repeatable fields:** let visitors add rows of supported details, within the documented limits.
* **Publishing and data controls:** WordPress block and shortcode, design recovery/history, retention, eligible privacy export/erasure and sanitised configuration import/export.
* **Newsletter connections:** optionally send separately consenting subscribers to a configured Brevo list or MailerLite group.

No artificial form/submission quota, trial expiry or forced attribution. Hosting resources, storage budgets, retention and documented safety limits apply.

= Forms you can build =

Create a business contact form, service enquiry, quote request, agency brief, callback request, consultation request or customer feedback form. Consultation requests do not provide appointment booking; quote requests collect requirements without calculating prices.

= What does Pro add? =

Pro is a separate paid add-on:

* **Calculated estimates and branded PDFs:** quantity × unit-price rows, fixed extras, advanced pricing and server-calculated itemisation.
* **Multi-step applications and private uploads:** supported PDF, PNG, JPEG or UTF-8 TXT attachments within hosting limits.
* **Visitor save and resume:** explicitly saved incomplete applications with private return links. Incomplete answers are not captured automatically.
* **Advanced workflows:** nested conditions, branching, routing, connections and team-review tools with deliberate setup.

Free includes basic conditions and administrator design drafts; visitor save-and-resume is Pro. Free's optional Pro previews use fictional examples and can be hidden. Opening them does not enable features or send browsing activity.

All Pro plans include the same features for 1, 3 or 10 websites. Pro needs separate installation and initial licence activation; see the FAQ below.

= Useful alongside your forms =

Optional plugins from the same publisher, Plugins.shop. None is required or implies a built-in integration:

* [ClickClue — session replay](https://wordpress.org/plugins/clickclue/) — Review eligible recorded visits to form pages using your chosen recording mode and privacy controls.
* [CampaignBars — announcement bars](https://wordpress.org/plugins/campaignbars-announcement-manager/) — Link an announcement button to your contact or quote-request page.
* [CatalogFAQ — FAQ accordions](https://wordpress.org/plugins/catalogfaq-product-answers/) — Publish reusable answers beside an enquiry form so visitors can check common questions first.

== Installation ==

1. In WordPress, open Plugins > Add New, search for KillerConversions, then install and activate. You can also upload the Free ZIP through Upload Plugin.
2. Open KillerConversions > Start here and choose Collect enquiries, Request a quote or Collect a project brief.
3. Edit the questions, use Try form, and choose Save draft or Publish form. Publishing makes the form available; it does not insert it into a page.
4. Add the KillerConversions block to a page, or use `[killerconversions id="123"]` with your actual form ID. Publish the page.
5. Review Published settings. Choose an email recipient if wanted, or use Inbox only. Check spam protection and retention, then submit a controlled example through the published page and inspect Inbox. Verify any intended email receipt separately.

First individual activation opens Start here; later individual reactivation opens your forms. Updates and bulk activation do not redirect you. Exit focus mode and Back to WordPress remain available, and your focus preference is saved for your user account on this site.

To install Pro, keep Free active and upload the Pro ZIP from your customer account, then activate your licence. Free 1.2.5 works with Pro 1.2.4. For an existing pair, back up first and update Free before any needed Pro update, without uninstalling. While Pro older than 1.2.4 remains active, forms using conditions pause until Pro is updated; ordinary forms without conditions remain available. Saved forms and entries, the Pro licence screen and its automatic updater remain available during this transition.

After your first successful form save, an optional invitation offers two independent, unchecked choices: share the displayed website hostname or request tutorials, product updates and occasional offers at an editable email address. Continue without sharing keeps every Free feature. Email signup needs inbox confirmation. Manage these choices under Privacy & emails. Opening or skipping the invitation makes no publisher request.

= Requirements =

WordPress 6.5+ and PHP 7.4+ are required; Pro requires PHP 8.0+. MySQL or MariaDB with InnoDB tables is required for atomic storage. SQLite, including WordPress Playground, is not supported; use a compatible WordPress site. Text validation works without PHP mbstring; itemised estimates require 64-bit PHP integers. Pro visitor drafts require PHP Sodium; integrations require PHP cURL, a working CA bundle and public IPv4 HTTPS. Background cleanup and mail retries require working WordPress cron. The plugin does not alter your hosting limits or configure SMTP.

Form management and the searchable form picker require the WordPress manage_options capability, normally held by administrators. Other users who can edit a post can embed a published form using a form ID supplied by a form administrator. They cannot browse form titles or IDs through the plugin's administrative REST catalogue. Unpublished forms do not render publicly.

== Frequently Asked Questions ==

= Is this a free contact form plugin without an account? =

Yes. Build and publish forms, save submissions in WordPress, export CSV and configure ordinary notifications without a KillerConversions account or licence. Optional website registration, marketing emails and third-party connections remain separate choices. Free has no trial expiry or artificial form/submission quota; hosting and documented safety limits apply.

= Where are contact form submissions stored? =

Completed entries are stored in your WordPress database and appear in KillerConversions > Inbox. Search, filter, star, mark read/unread, assign and export them. A committed entry remains saved if email transport later fails. If the queue cannot be stored before commit, the submission is rejected so the visitor can retry. Entries are not encrypted at rest by the plugin; protect database access and backups.

= Can I export form entries to CSV? =

Yes. Export filtered entries in wide or long CSV layouts for use in a spreadsheet. Entry-access permissions also apply to exports. Submitted-entry totals are counts, not conversion rates.

= Does Free include conditional logic? =

Yes. Show or hide follow-up fields based on previous answers, with server-side validation of relevant required questions. Nested conditions, step branching and advanced conditional actions require Pro. During a partial update from an older Pro, finish updating both editions before using condition-dependent forms.

= Can I make a quote request form or quote calculator? =

Free collects quote enquiries, service requirements and project briefs. Pro calculates estimates from configured pricing and can produce a branded PDF. A quote request in Free does not calculate a price. Payments, signatures, AI form generation, A/B testing, multisite and a full CRM are outside scope.

= Can visitors upload files, use multiple steps or save progress? =

Multi-step applications, supported private uploads and visitor save-and-resume require Pro. Visitors explicitly save an incomplete application and return through a private link with a 1-, 3- or 7-day expiry. Free includes administrator form-design drafts; these are separate from a visitor's incomplete answers.

= Can I use a WordPress block or shortcode? =

Yes. Add the KillerConversions block in the WordPress block editor, or place `[killerconversions id="123"]` in a shortcode block using the published form's actual ID. The form picker requires administrator access; other post editors can use an ID supplied by a form administrator.

= Can visitors add repeatable rows? =

Free supports up to three repeated groups, ten rows per group and six text, email, number, date or select questions per row. Groups require JavaScript. Nested groups, uploads, consent, pricing and conditional dependencies inside groups are excluded.

= Why am I not receiving contact form emails? =

The staff notification address starts empty. Entries still appear in Inbox. Open the form's Connect tab, enter a Staff notification email, then publish. Or leave it blank to use Inbox only. Visitor confirmations and Pro routing have separate settings. Check any paused-delivery notice, submit through the published page and review Delivery. Confirm receipt with the intended recipient: WordPress mail acceptance is not proof of inbox delivery. Configure SMTP or another mail transport separately if your host needs it.

= What spam protection is included? =

Free includes a honeypot and submission rate limiting. Optional Cloudflare Turnstile adds a browser challenge and server verification. It starts off: open Settings > Spam protection, add your widget's site key and secret, acknowledge the external service, enable it and publish. Test the published form; the editor preview does not load Turnstile. Protected forms require JavaScript. See the external-service disclosure below.

= Can I connect a newsletter signup form to Brevo or MailerLite? =

Yes, after explicitly configuring the provider, list or group and a separate optional visitor marketing-consent question. The connection creates or updates the consenting subscriber; it does not send a newsletter campaign or perform double opt-in. Your provider's configured automations may run. An enquiry or staff notification is not newsletter consent. See the service disclosures below.

= Can I recover or move a form design? =

Free offers optional browser recovery, conflicting-save protection and a ten-design history. Credentials and operational settings stay outside that history. Import/export moves sanitised form configurations, not a full backup: entries, credentials, private destinations and live operational state are excluded by default. Review local destinations after import.

= How does Pro licensing work? =

Install Free first and a compatible Pro add-on, then activate the licence for this website before using Pro editing tools. After successful activation, ordinary licence expiry or a licensing-service outage does not remove earned access. Plans differ by their allowance of 1, 3 or 10 websites; each distinct WordPress website needs a licence, with no additional staging allowance. Free does not download or install Pro.

= What happens if Pro is deactivated? =

Basic workflows continue with Free alone. Premium-dependent forms and jobs retain their data and pause with an explanation; they do not calculate a different price or silently choose a fallback recipient. Existing scoped staff restrictions remain enforced. Missing or incompatible Pro also preserves saved data and privacy operations. Finish both updates before editing during a mixed-version upgrade.

= Can I hide Pro previews? =

Yes. Hide or restore sidebar previews and contextual suggestions for your administrator account on this website. Explore Pro stays available. Editor preview links open separately to preserve unsaved work. The pricing example uses fixed sample rates and does not enable Pro calculations. Local preview preferences remain until the documented explicit full uninstall.

= Does it work without JavaScript? =

Published forms have a standard server submission fallback and relevant server validation still applies. Enhanced multi-step navigation, repeatable groups, visitor save/resume, live estimates and the visual editor require JavaScript. Without it, ordinary fields remain readable together. Turnstile-protected forms require JavaScript.

= Where can I get help? =

Visit the [documentation](https://killerconversions.com/docs/), [WordPress.org support forum](https://wordpress.org/support/plugin/killerconversions/) or [support page](https://killerconversions.com/help/). Public support has no guaranteed response time. No subscription or sister-plugin installation is required for local features.

= How do I recover an upgrade? =

Keep a pre-upgrade database/files backup and test restoration on a separate copy. Reinstalling an old ZIP does not reverse migrations. Do not overwrite newer submissions with an old database. Follow the matched update and recovery guidance.

== Privacy, storage and external services ==

Local core form use makes no publisher telemetry, licence or marketing requests. The optional website registration and marketing signup described below make requests only after explicit choices. Assets are bundled locally except the explicitly enabled Turnstile service below. Completed entries, files and provider credentials are private database data, not encrypted at rest by the plugin. Protect database access and backups.

= KillerConversions optional website registration and emails =

After explicit administrator selection, the plugin sends the displayed hostname for website registration, or the selected email address for an independently confirmed request for tutorials, product updates and occasional offers, to https://killerconversions.com/newsletter-api/v1/kc-welcome/. Each request includes its consent wording version, time and a random scoped connection reference. Email-only requests omit the site URL from the body and HTTP headers. Neither purpose sends form answers, customer lists, licence credentials or preview-click history. A voluntarily reported domain is not verified domain ownership or a count of active installations. These choices are independent of Pro licensing and of visitor subscriptions to Brevo or MailerLite.

Privacy & emails lets you stop domain sharing and manage the email request made there. Confirmed email preferences and unsubscribe are available through private email links. An unreachable service leaves a truthful retryable removal state; local sharing stops immediately. Copied or moved sites pause the connection and require fresh choices. Use the original site's controls or private email links to manage its existing relationship. Before explicitly removing all local plugin data, complete remote withdrawal; uninstall alone cannot guarantee it. Privacy: https://killerconversions.com/privacy/#plugin-registration . Terms: https://killerconversions.com/checkout/terms .

Domain reports expire after 90 days without another explicit request; no heartbeat is sent. Initial enrollment retries and pending email confirmations expire after 48 hours. Confirmed subscriptions expire after at most 730 days. The credential and consent attribution needed to stop emails requested here remain while that connected subscription is active. Stopped or unattached opaque controls expire after 90 days; consent and suppression records may remain for 180 days. Scheduled cleanup and backups have separate retention limits. The service receives the connection IP; hosting and email delivery service details are in https://killerconversions.com/newsletter/privacy .

Focus, preview visibility and explicit Remember this workflow choices stay local. A remembered workflow is retained for seven days and rechecks the saved form before continuation. Browsing a preview does not record a workflow choice or grant permission to send data. The optional consent record contains private connection material needed for authenticated withdrawal; privacy exports do not include that credential.

When Pro is active, saved visitor drafts are encrypted using Sodium and WordPress salt-derived keys; changing or losing those salts can make existing drafts unreadable. The plugin reports decryption failure without exposing answers or tokens. Resume tokens are hashed in storage and live in the private link fragment. Anyone holding a valid link can access that draft. Expiry runs from first save; consent/permission choices need a fresh visitor decision. Quota failure preserves an existing saved application. Site backups have their own retention.

Entry retention defaults to 90 days and can be set to 1–3650 days for new entries. Daily cleanup and additional batches for large backlogs depend on WordPress cron. Retention health shows queued or overdue continuation work and cleanup failures. Pro visitor draft storage is capped at 64 MiB per form and 256 MiB per site; hosting capacity can reduce limits. Completed-entry/file storage has a baseline site budget and a health display. Deleting an entry removes linked files and jobs. Privacy exports/erasure locate entries by submitted email fields; records without one need administrator review. Email/provider copies are outside local erasure.

Optional editor recovery stores a design in that administrator's browser for up to 24 hours, excluding credentials, recipients and nonces. Ten-design history is local. Explicitly remembered workflow links are local per-administrator references with seven-day expiry. These actions make no external request.

New entries retain original field definitions. Same-page browser retries use a random attempt ID held in memory; the database retains its hash and committed entry reference until erasure/expiry. This does not cover a fresh page load, legacy clients or the no-JavaScript fallback. Abuse protection uses short-lived salted rate hashes, not stored raw IPs. Submitted-entry counts require no visitor tracking.

= Transactional email =

When configured, the queue passes the selected staff notification or separately requested visitor confirmation to WordPress wp_mail() and your site's mail provider. A submitted email can become validated Reply-To; it does not replace From. Estimates include their saved breakdown. Confirmation consent, marketing subscription and saved-link purposes remain separate. The plugin provides no SMTP service, bounce tracking or receipt guarantee. Disable a destination to stop future jobs; delivered copies need separate removal.

= Brevo (optional) =

An administrator explicitly enables and acknowledges this connection. With a separately checked optional visitor marketing-consent question, the plugin sends the mapped email, optional FIRSTNAME/LASTNAME and selected list ID to https://api.brevo.com/v3/contacts to create/update a subscriber contact. It does not send unrelated answers or files, force unsubscribe flags, perform double opt-in or send a campaign. Your Brevo list automations may run. Disable the connection to stop future requests; remove its saved credential to forget it locally. Provider copies require separate removal. Terms: https://www.brevo.com/legal/termsofuse/ ; privacy: https://www.brevo.com/legal/privacypolicy/ .

= MailerLite (optional) =

After administrator enablement/acknowledgement and separate optional visitor subscription consent, the plugin sends mapped email, optional name and selected group ID to https://connect.mailerlite.com/api/subscribers to create/update a subscriber. It does not send files or unrelated answers, request forced resubscription, or send a campaign. Group automations may run under your provider settings. Disable and remove credentials to stop future local requests; provider data needs separate removal. Terms: https://www.mailerlite.com/legal/terms-of-service ; privacy: https://www.mailerlite.com/legal/privacy-policy .

Changing a destination, mapping or consent meaning cancels old pending work instead of reinterpreting it. Reviewed resend preserves recorded consent. Copied-site protection pauses outgoing work after a recorded address/environment change; identical-identity copies and pre-baseline copies need operator review.

= Cloudflare Turnstile (optional) =

Turnstile defaults off and needs widget keys plus service acknowledgement. Enabled forms load https://challenges.cloudflare.com/turnstile/v0/api.js; Cloudflare processes browser/network signals. The server sends only the configured secret and challenge token to https://challenges.cloudflare.com/turnstile/v0/siteverify. Form answers are not included. Protected forms require JavaScript; editor preview never loads it. Disable protection to stop requests and remove the saved secret to forget it. Privacy: https://www.cloudflare.com/turnstile-privacy-policy/ ; terms: https://www.cloudflare.com/website-terms/ .

== Data on uninstall ==

Deactivation and normal uninstall preserve forms and entries. Deliberate permanent removal requires `define( 'KCONV_DELETE_DATA_ON_UNINSTALL', true );` in wp-config.php before uninstalling Free. Back up needed data first. This removes plugin-owned data for the current site; it does not retract email/provider copies or release a remote licence seat. Multisite network removal is unsupported.

== Source code ==

All first-party PHP, JavaScript and CSS source is included in this plugin. The readable files in assets/ and blocks/form/editor.js are the exact editable files WordPress loads; there are no separate minified bundles or required build steps. See SOURCE.txt for the source map, optional formatting instructions and bundled font/PDF attribution. WordPress supplies the declared wp-* JavaScript dependencies through its own script loader; no copies of those libraries are bundled here.

== Screenshots ==

1. Start with an enquiry, quote request or project brief in the Free workspace. Optional Pro previews are switched off.
2. Build a Free enquiry form with the visual editor, field settings and live preview. Fictional example form.
3. Review fictional enquiries in the WordPress inbox, with search, filters and CSV export. Optional Pro previews are switched off.

== Upgrade Notice ==

= 1.2.5 =
Correct malformed-email validation messages and remove the false incomplete-email-settings warning on a new, unsaved form. Existing Pro 1.2.4 remains compatible.

= 1.2.4 =
Fixes conditional required-field validation and expired-entry cleanup. If Pro is installed, update Free first, then Pro to 1.2.4 without uninstalling.

== Changelog ==

= 1.2.5 =
* Keep specific validation messages when a nonempty invalid answer is cleaned to an empty value, including malformed email addresses.
* Preserve required-field messages for empty answers and retain server-side rejection of invalid submissions.
* Use default email settings for a new, unsaved form without displaying a false configuration warning; existing invalid saved settings still show their warning.
* Keep the existing Pro 1.2.4 add-on compatible; this Free update does not change Pro features or licensing.

= 1.2.4 =
* Fix conditional required-field validation to compare the same cleaned answer that is stored in the Inbox.
* Keep browser follow-up questions aligned with cleaned text answers, including stripped tags and percent-encoded octets.
* Pause condition-dependent forms during a partial Free/Pro update until Pro 1.2.4 is installed, while retaining its license screen and automatic updater.
* Continue large expired-entry cleanups in bounded scheduled batches, and show queued or overdue continuation work in Retention health.
* Preserve the daily cleanup fallback, transactional deletion and saved form settings.


= 1.2.3 =
* Clarify that optional Turnstile requires Cloudflare site and secret keys, without implying saved keys are missing.
* Label the optional update summary Review published settings; new-publication guidance opens and update guidance stays collapsed.
* Keep editor tabs and controls reachable at high browser zoom by letting the toolbar scroll on short windows, and remove its unused admin-bar gap in focus mode.


= 1.2.2 =
* Show the published form's staff notification, spam protection and new-entry retention settings after publishing, including configuration problems and paused delivery.
* Make the default-off staff email choice explicit with Set up email notifications and Use Inbox only, without selecting a recipient automatically.
* Explain Free's honeypot, submission rate limiting and optional Turnstile, and guide a real submission, Inbox and email-receipt check.


= 1.2.1 =
* Preserve form edits and show an accurate unconfirmed-save message when a server response or save finalization fails. Check the latest saved version before retrying.
* Keep confirmed commits separate from unconfirmed results; do not automatically retry an uncertain save.


= 1.2.0 =
* Focused workspace with a shared sidebar, accessible mobile navigation and clear routes back to WordPress.
* Optional Pro preview shortcuts with a saved per-administrator visibility preference; Explore Pro remains available.
* Task-specific Pro examples and accurate Free/Pro comparisons.
* Plugins.shop attribution and a local More Plugins collection with clear external links.


= 1.1.3 =
* Match the Free and Pro release versions and clarify the 1, 3 and 10 website licence plans. Each distinct WordPress website needs a licence, with no extra staging allowance.
* Open Start here after the first successful individual activation and the forms workspace after a returning activation. The redirect stays within that request; bulk activations, updates and background operations do not create a deferred redirect.

Earlier release notes are preserved in CHANGELOG-HISTORY.txt in the plugin package.

== Developer notes ==

All executable source ships in readable form. No compilation is needed. The optional remote services are disclosed above.

The fictional PDF example embeds DejaVu Sans; font notices are in assets/pro-estimate-sample-LICENSE.txt.
