=== LaserLead Forms ===
Contributors: prometheanlink
Tags: contact form, forms, form builder, entries, spam
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.2.2
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Contact forms that keep every entry on your own site, with spam protection that keeps working behind a page cache.

== Description ==

LaserLead Forms is a free form plugin for WordPress. Every message is saved on your own site **before** any email is sent, so a lead is never lost when an email goes astray. If the email fails, the entry says so, in red.

This is a preview (0.2.2).

* **Form builder:** text, email, phone, website, number, date, paragraph, dropdown, choose-one, checkboxes, consent, hidden fields and the send button. Drag to reorder, or use the arrow buttons.
* **File uploads, kept safe:** a file field with the types you allow (images, documents, archives) and a size limit. Files are stored under random names with no extension, in a folder you choose in Settings, and only signed-in administrators can download them. If your server would hand that folder to anyone who guesses the address, Settings warns you.
* **Bring your Contact Form 7 forms across:** the Import tab reads your Contact Form 7 forms, shows field by field what imports, what is approximated and what isn't supported, and creates the matching forms. An optional switch lets your existing `[contact-form-7]` shortcodes show the imported form once Contact Form 7 is turned off, so no page needs editing. Import only reads Contact Form 7's data, it never changes it.
* **Place it anywhere:** the "LaserLead Form" block, or the `[llforms id="…"]` shortcode.
* **Entries on your site:** search, read, mark as spam, trash, delete, and download as CSV (safe to open in a spreadsheet).
* **Email:** a notification to you and an optional automatic reply to the visitor, with tags such as `[your-name]`, `[_site_title]` and `[_entry_link]`. Sent through WordPress, so any SMTP plugin carries it.
* **Spam protection that works on cached pages:** a hidden field robots fill in, a signed token instead of a nonce (cached pages keep working for three days), a minimum time to fill the form, a per-visitor hourly limit, and blocklists for words, addresses and domains. Optional Cloudflare Turnstile or Google reCAPTCHA v3 with your own keys. Spam is kept under Entries → Spam, never thrown away.
* **Privacy:** works with WordPress's Export and Erase Personal Data tools, and can delete old entries after a number of days you choose.
* No tracking. No "Powered by" link on your forms. Deleting the plugin keeps your forms and entries unless you choose otherwise in Settings.

Need leads routed by ZIP code to the right salesperson, with AI spam screening? That's LaserLead Pro, from the same family.

== Installation ==

1. Upload the `laserlead-forms` folder to `/wp-content/plugins/`, or install it from the Plugins screen.
2. Activate it. A "Contact Us" form is ready under **LaserLead Forms → Forms**.
3. Add the "LaserLead Form" block to a page (or paste the shortcode shown next to the form).

== Frequently Asked Questions ==

= Does it send my data anywhere? =

No, unless you switch on a captcha (see External services). Entries stay in your site's own database.

= My site uses a page cache. Will the form still work? =

Yes. The form carries a signed token that stays valid for three days instead of a WordPress nonce, and the form's script fetches a fresh one when the visitor starts typing.

= The email didn't arrive. Is the message lost? =

No. Every entry is saved before the email is sent. Entries → Mail failed lists the ones whose email failed, with the error. An SMTP plugin usually fixes sending.

= Where are uploaded files kept, and who can open them? =

In the folder set under Settings → Uploads, under random names with no extension, so a web server never runs or displays them. Only signed-in administrators can download them, from the entry. The notification email links to the entry, never to the file.

= Does it work if my site blocks the REST API for visitors? =

Yes. If the form cannot reach its REST address, it sends itself the classic way instead, and the message is still saved.

= What happens to my entries if I delete the plugin? =

They stay, unless you turned on "Remove all forms and entries when the plugin is deleted" in Settings. With that on, uploaded files are deleted too.

== External services ==

LaserLead Forms connects to no outside service by default. To check whether your upload folder can be opened from the web, it asks your own site for one test file (a request to itself, as Site Health does); nothing leaves your server. Only if you choose a captcha in Settings → Spam protection and enter your own keys:

* **Cloudflare Turnstile.** Visitors' browsers load the Turnstile widget from challenges.cloudflare.com, and your site sends the visitor's answer, its IP address and your secret key to https://challenges.cloudflare.com/turnstile/v0/siteverify when a form is sent. Terms: https://www.cloudflare.com/website-terms/ · Privacy: https://www.cloudflare.com/privacypolicy/
* **Google reCAPTCHA v3.** Visitors' browsers load reCAPTCHA from www.google.com, and your site sends the visitor's answer, its IP address and your secret key to https://www.google.com/recaptcha/api/siteverify when a form is sent. Terms: https://policies.google.com/terms · Privacy: https://policies.google.com/privacy

== Privacy ==

What a visitor types into a form is stored in your site's database with the date, the page it was sent from, the visitor's IP address and a one-way hash of the browser's user agent (not the user agent itself). Files sent through a form are stored in the folder chosen under Settings → Uploads and are listed (by name, not content) in WordPress's personal-data export. Erasing a person's data deletes their files from disk. The entry is emailed to the addresses you set. LaserLead Forms adds a suggested paragraph to Settings → Privacy, registers with WordPress's personal-data export and erase tools, and can delete entries older than a number of days you set.

== Changelog ==

= 0.2.2 =
* Form submissions are cleaned as soon as they arrive, before any check or add-on sees them; uploads are checked to be real uploads first.
* A form the builder could not save is kept for you to fix only after it has been cleaned.
* The About screen's Copy button and the list filters use script files instead of inline code.
* The "PHP too old" notice shows only on the Plugins screen, to people who can manage plugins.

= 0.2.1 =
* The LaserLead Pro note on the About screen now states the guarantee in full: 30-day, 100% money-back.
* About screen and plugin links go to laserleadpro.com: LaserLead Pro, its docs, and this plugin's page (/forms/).

= 0.2.0 =
* File uploads into a folder you choose (protected, administrator-only downloads, reachability warning).
* Contact Form 7 import with a per-field report, and optional takeover of existing [contact-form-7] shortcodes.
* The form engine: builder, block and shortcode, signed cache-safe token, submit with and without JavaScript, spam protection, notification and autoresponder email with tags, mail status on every entry, Entries screen with views, bulk actions and CSV export, privacy export and erase, retention.

= 0.1.0 =
* First preview: the plugin shell, five admin screens, database tables.
