=== Robse Form Guard ===
Contributors: robsejp
Tags: spam, contact form, antispam, contact form 7, japanese
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 2.2.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Stops Japanese cold-sales messages reaching your contact form, and can email you each one it blocks so you can check for false positives.

== Description ==

A CAPTCHA proves the sender is a human being. It does not stop a human being
whose job is to send sales pitches through other people's contact forms. If you
run a small business in Japan, that is most of what arrives in your inbox.

Robse Form Guard reads each submission and scores its wording. Japanese
business-to-business sales boilerplate — 貴社, ご担当者様, 初期費用,
導入実績 and the like — is language a private customer asking about your work
simply does not use. When enough of it piles up in one message, the submission
is stopped.

**Blocked submissions can be forwarded to you.** With forwarding turned on (the
default), each blocked submission is emailed in full to the site administrator
or an address you choose, with the score and the words that matched, so you can
check it for false positives. Forwarding can be turned off on the settings
screen. The copies are sent by your site's own email, so they depend on your
site being able to send mail: if a copy cannot be sent, the submission is still
stopped and is not kept anywhere else. The visitor is shown a phone number or
address you choose, so a real customer caught by mistake can still reach you.

= What it checks =

1. **A honeypot.** A field a person cannot see and a script fills in.
2. **A rate limit.** Repeated submissions from one address in a short time.
3. **The wording.** Each keyword carries points; the submission is stopped when
   the total reaches the score you set. The starting list and every weight are
   editable, and you can add your own words. Forms of address and greetings
   (貴社, ご担当者様, と申します, 弊社 and so on) are written by companies asking
   for a quote as well as by salespeople, so a message that matches only those
   is never stopped: something being sold, or a link, has to be there too.

= Try it before you trust it =

Set it to **watch only** and it will email you what it *would* have blocked
while letting everything through. Run that for a week, look at what arrives,
then turn blocking on. This is the recommended way to start.

= Which form plugins =

* Contact Form 7
* Snow Monkey Forms

It sits alongside reCAPTCHA, Akismet or Turnstile rather than replacing them:
those stop machines, this stops people who are paid to write to you.

= For Japanese sites =

The keyword list is Japanese and the plugin is aimed at Japanese-language
sites. On a site in another language, replace the list with your own wording
under Settings.

== Installation ==

1. Install and activate the plugin.
2. Go to **Settings > Robse Form Guard**.
3. Fill in **how a real customer can still reach you** — a phone number is the
   usual choice. Do not skip this: it is the only way out for someone the
   plugin wrongly stops.
4. Leave **watch only** on for the first week and read the emails it sends you.
5. Switch to **block** once the verdicts look right.

= Rolling it out to many sites =

These constants in `wp-config.php` win over the settings screen, so a
deployment script can configure a site without touching its database:

`define( 'ROBSE_FORM_GUARD_TEL', '03-0000-0000' );`
`define( 'ROBSE_FORM_GUARD_QUARANTINE', 'you@example.com' );`
`define( 'ROBSE_FORM_GUARD_THRESHOLD', 4 );`

== Frequently Asked Questions ==

= It blocked a real customer. =

Read the email it sent you — it lists the words that matched and the score.
Either lower the points on the word that misfired, or raise the score needed
to match. Both are on the settings screen.

= Will it stop bots? =

The honeypot will stop simple ones. For machine submissions in general, keep
reCAPTCHA, Turnstile or Akismet switched on as well. This plugin is aimed at
the sales messages a human being typed.

= Does it send my form data anywhere? =

No. The only message it sends is the copy of a blocked submission, by email
and only while forwarding is turned on, to the address you set on the settings
screen — your own site's administrator
address unless you change it. Nothing is sent to the plugin author or to any
other server.

= The blocked copies are filling my inbox. =

That is the point of them, and you should read them for the first few weeks.
After that, filter the subject line into a folder rather than turning the
copies off — they are the only record of a submission that was wrongly
stopped.

= Can I use it on a site that is not in Japanese? =

Yes, but the built-in list will not match anything. Replace it with the sales
boilerplate used in your language.

== Privacy ==

The plugin stores no personal data of its own and creates no database tables.

When a submission is stopped and forwarding is turned on (the default), its
full contents are emailed to the address configured on the settings screen,
which defaults to the site's own administration email address. That email is sent by WordPress from the site
itself. No data is transmitted to the plugin author or to any third party, and
the plugin makes no outbound network requests.

The rate limit stores a hashed form of the submitting IP address in a
transient, which expires on its own within the window you configure.

== Changelog ==

= 2.2.0 =
* A message whose matches are only forms of address and greetings (貴社,
  御社, ご担当者, 担当者様, 代表者様, ご担当者各位, と申します, 突然のご連絡,
  初めてご連絡, 弊社, 業者様) is no longer blocked, whatever it scores.
  Companies asking for a quote write like this too. The honeypot and the rate
  limit are unchanged. The list can be changed with the
  `robse_form_guard_context_words` filter.
* と申します, 突然のご連絡 and 初めてご連絡 now carry 1 point instead of 2 in the
  starting list. Your saved settings are not changed by the update: if you have
  ever pressed Save on the settings screen, the keyword list was saved with the
  old points and stays as it is. Edit those three lines, or clear the box to
  use the new starting list.
* Reworded the settings screen, the plugin description and this readme so that
  forwarding of blocked submissions is described as a setting that depends on
  your site sending mail, not a guarantee.

= 2.1.1 =
* Removed the bundled Japanese translation files. Translations are handled by
  translate.wordpress.org.

= 2.1.0 =
* First public release.
* Settings screen: mode, score, keyword list, honeypot, rate limit, quarantine
  address and the contact route shown to blocked visitors.
* Blocked submissions are emailed to the site's own administrator by default.
* Watch-only mode for tuning before blocking.

= 2.0.0 =
* Contact Form 7 support alongside Snow Monkey Forms.

= 1.0.2 =
* Internal release for Snow Monkey Forms.

== Upgrade Notice ==

= 2.2.0 =
Messages that match only greetings and forms of address are no longer blocked. Your saved keyword list and settings are kept as they are.
