=== LMS Advisor Form Builder ===
Contributors: wpvishavjeet
Tags: forms, contact form, form builder, lms, drag and drop
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

A secure, accessible form builder for WordPress and LMS sites. Build forms with drag and drop, collect submissions and export your data.

== Description ==

LMS Advisor Form Builder lets you build any number of forms and place them with a shortcode, a block or an Elementor widget. Submissions are stored in your own database and can be searched, exported and emailed. No account is needed and nothing is sent to another service unless you switch on a CAPTCHA.

It is made for people who run courses on WordPress. A form placed on a course or lesson page can record the course, the lesson and the logged-in learner on its own, so an enquiry or an assignment always arrives with its context.

= Build =

* Visual builder: field palette, live form and field settings side by side
* Add fields by click or drag, reorder by drag or keyboard, undo and redo
* 42 field types: text, paragraph, email, phone, number, URL, password, radio, checkboxes, dropdown, multi-select, toggle, date, time, date and time, file and image upload, hidden, name, address, country, state, city, ZIP, range, color, heading, description, HTML and divider
* WordPress and LMS fields filled in on the server: user, user ID, username, email, first and last name, role, course ID, course name, lesson ID, page URL and referrer
* Conditional logic: show or hide a field depending on other answers
* Starter templates: contact, course enquiry, course feedback and assignment upload
* Preview with your theme before publishing

= Collect =

* Submissions list with search, filters, sorting, bulk actions, read and unread, spam and trash
* File uploads stored outside public reach and downloaded through a permission check
* Export to CSV, CSV for Excel or JSON, by form, status and date range
* Notification email to you and a confirmation email to the sender, with placeholders, preview and test send
* Show a message or go to a page or web address after sending

= Protect =

* Every submission is checked on the server, whatever the browser sent
* Honeypot, minimum fill time, rate limits and optional reCAPTCHA or Turnstile
* IP addresses anonymised by default
* Retention periods, a delete tool, and support for the WordPress personal data export and erasure tools

= Accessible =

* Labels, error messages and help text are linked to their fields
* Errors are announced, and focus moves to the first field that needs attention
* Works with a keyboard and a screen reader, in the builder too
* Forms work without JavaScript

= LMS support =

Course and lesson are detected on pages of LifterLMS, LearnDash, Tutor LMS and Sensei LMS. Any other LMS can supply them with the `lms_form_lms_context` filter.

== Installation ==

1. Upload the `lmsadvisor-form-builder` folder to `/wp-content/plugins/`, or install the plugin from the Plugins screen.
2. Activate **LMS Advisor Form Builder**.
3. Go to **LMS Advisor Forms > Add form**, choose a template and save.
4. Place the form with the shortcode shown in the builder, for example `[lms_form id="1"]`, with the **LMS Advisor Form** block or with the Elementor widget.

== Frequently Asked Questions ==

= How do I put a form on a page? =

Copy the shortcode from the builder or the Forms list and paste it into a page, or add the LMS Advisor Form block and choose the form. In a theme template use `echo lms_form_render( 12 );`.

= Where are submissions stored? =

In three tables in your WordPress database. Uploaded files go to `wp-content/uploads/lms-form/` under random names. Files are downloaded from the Submissions screen after a permission check. The folder refuses direct requests on Apache, LiteSpeed and IIS. nginx ignores that protection; the random names keep the files private there as well, and the Help screen shows a server rule that closes the folder completely.

= Who can see submissions? =

Administrators. A developer can open individual areas to other roles with the `lms_form_capability` filter.

= Does it work without JavaScript? =

Yes. Forms post normally and show errors or the confirmation after the page reloads. The exception is a form protected by a CAPTCHA, because the CAPTCHA services need JavaScript.

= Does it work with page caching? =

Yes. A form on a cached page fetches a fresh security token before it is sent.

= Why is there no "custom JavaScript" setting? =

Script stored in the database is a common route for site takeovers. Every form sends `lmsFormSuccess` and `lmsFormError` events that your theme or a small plugin can listen to instead.

= Can I change how forms look? =

Forms use the fonts of your theme. The accent color, columns, label position, field size, spacing and width are settings. For more, add your own CSS with the Additional CSS option of WordPress (Appearance > Customize, or Styles in the Site Editor), or switch the default stylesheet off and style the forms in your theme.

= What happens to my data when I delete the plugin? =

Nothing, unless you switched on "Delete all plugin data on uninstall" under Settings > General.

= A phone number in my CSV export starts with an apostrophe. Why? =

Spreadsheet software runs cells that start with `=`, `+`, `-` or `@` as formulas. The apostrophe makes them plain text. Excel and LibreOffice hide it.

== External services ==

LMS Advisor Form Builder does not contact any external service by default. Two optional spam checks do, and only after an administrator has chosen one and entered its keys under LMS Advisor Forms > Settings > Security.

= Google reCAPTCHA =

Used to tell people and bots apart. When it is active, pages that show a form load a script from `https://www.google.com/recaptcha/api.js`. The script and the widget run in the visitor's browser and send Google the data it collects there, such as the IP address, browser details and interaction signals. When a form is sent, your server sends the response token and your secret key to `https://www.google.com/recaptcha/api/siteverify`. The plugin does not forward the visitor's IP address in that request.

Service provided by Google: [Terms of Service](https://policies.google.com/terms), [Privacy Policy](https://policies.google.com/privacy).

= Cloudflare Turnstile =

Used to tell people and bots apart. When it is active, pages that show a form load a script from `https://challenges.cloudflare.com/turnstile/v0/api.js`. The script and the widget run in the visitor's browser and send Cloudflare the data it collects there, such as the IP address and browser details. When a form is sent, your server sends the response token and your secret key to `https://challenges.cloudflare.com/turnstile/v0/siteverify`. The plugin does not forward the visitor's IP address in that request.

Service provided by Cloudflare: [Terms of Use](https://www.cloudflare.com/website-terms/), [Privacy Policy](https://www.cloudflare.com/privacypolicy/).

== Screenshots ==

1. Dashboard with submission totals and the last 30 days.
2. The form builder: field palette, form and field settings.
3. Conditional logic for a field.
4. Submissions list with filters and bulk actions.
5. A single submission with an uploaded file.
6. Export screen.
7. Security settings.
8. A form on the front end with validation messages.

== Changelog ==

= 1.0.0 =
* First release.

== Upgrade Notice ==

= 1.0.0 =
First release.
