=== smartEngin Forms ===
Contributors: businesskiai
Tags: contact form, form builder, spam protection, captcha, gdpr
Requires at least: 6.0
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 0.20.2
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Contact form builder with spam protection, captcha, file uploads and opt-in to external newsletter services (Brevo, Mailchimp, MailerLite).

== Description ==

**smartEngin Forms** is a lightweight contact form plugin. Build as many forms as you like by clicking them together, style them without code and embed them with a shortcode. The interface follows your WordPress language; English and German are bundled, and more languages can be added through translation packs.

= Features =

* **Drag-and-drop form builder**: text, email, phone, number, date/time, choice fields (dropdown/multi-select/radio/checkbox), file upload, first & last name, GDPR consent and more.
* **Preconfigured quick fields** (salutation, subject, budget, message and more).
* **Design without code**: colours, spacing, radius and shadows via sliders and colour pickers, plus an optional two-part "hero card" with content widgets.
* **Delivery** to multiple recipients, reply-to and subject placeholders.
* **Confirmation email** to the sender with its own block editor and field placeholders.
* **Automatic spam protection**: nonce (CSRF), honeypot, timestamp check, per-IP rate limit and block lists (emails/words/IPs).
* **Optional captcha**: Cloudflare Turnstile (recommended), hCaptcha or Google reCAPTCHA v2 – enabled per form, invisible mode supported.
* **Newsletter opt-in**: forward a subscription to an external service (Brevo, Mailchimp or MailerLite) – only when the visitor ticks the newsletter consent box.
* **File uploads** with type, size and count limits and a protected storage location.
* **Submissions** are stored, viewable in the admin area and removed automatically after a configurable retention period (including their upload files).
* **GDPR**: configurable retention periods, separate consents, no external scripts unless explicitly enabled.
* Deliverability: emails are sent as multipart (HTML + plain text), based on `wp_mail()` (compatible with SMTP plugins).

= External services =

This plugin loads **no** external scripts on its own. Only when you enable a **captcha** in a form does it load the script of the provider you selected and transmit the visitor's IP address to that service for verification:

* **Cloudflare Turnstile** – script `challenges.cloudflare.com`, verification via `challenges.cloudflare.com/turnstile/v0/siteverify`. Privacy policy: https://www.cloudflare.com/privacypolicy/
* **hCaptcha** – script `js.hcaptcha.com`, verification via `hcaptcha.com/siteverify`. Privacy policy: https://www.hcaptcha.com/privacy
* **Google reCAPTCHA v2** – script `google.com/recaptcha`, verification via `google.com/recaptcha/api/siteverify`. Privacy policy: https://policies.google.com/privacy

Add the provider you enable to your site's privacy policy.

If you connect a **newsletter service** under "Newsletter" and enable it for a form, the submitted email address (and, if present, the name) is sent to that service to create/update a contact – but only when the visitor ticks the newsletter consent box:

* **Brevo** – contact sent to `api.brevo.com/v3/contacts`; lists loaded from `api.brevo.com/v3/contacts/lists`. Privacy policy: https://www.brevo.com/legal/privacypolicy/
* **Mailchimp** – contact sent to `<dc>.api.mailchimp.com/3.0/lists/…/members`; audiences loaded from `<dc>.api.mailchimp.com/3.0/lists`. Privacy policy: https://www.intuit.com/privacy/statement/
* **MailerLite** – subscriber sent to `connect.mailerlite.com/api/subscribers`; groups loaded from `connect.mailerlite.com/api/groups`. Privacy policy: https://www.mailerlite.com/legal/privacy-policy

No newsletter data is sent unless you configure a provider, enable it for a form and the visitor consents. Add the provider you use to your privacy policy and data-processing records.

== Installation ==

1. Upload the plugin via **Plugins → Add New** (or install it from the directory) and activate it.
2. Under **smartEngin Forms → Kontaktformulare** create a form and assemble the fields in the builder.
3. In the **Einstellungen** tab enter the recipient email address.
4. Insert the shortcode shown (for example `[smartengin_form id=1]`) into a page.
5. Optionally set up a captcha under **Sicherheit** and enable it per form.

== Frequently Asked Questions ==

= My form does not submit. =
Check whether a captcha is active and configured correctly (site/secret key correct, domain allowed at the provider). Reload the page and submit again.

= The notification email does not arrive. =
Check the recipient address in the settings. For reliable delivery we recommend an SMTP plugin and a sender address on your own domain.

= Is data transmitted to third parties? =

Only when you explicitly enable one of the integrations: a captcha service or a newsletter provider. Captcha services receive data necessary to verify the challenge, including the visitor's IP address. A newsletter provider only receives the email address and, when available, the name after the visitor actively checks the newsletter consent box.

If no integration is enabled, smartEngin Forms does not load external scripts or send form data to third parties.

= How are uploaded files protected? =

Uploaded files are stored in a protected folder with random file names and are never linked by a public URL. In the admin area they are delivered only through a secure download link that requires an administrator capability and a nonce. The folder is protected against direct access with index.php, an .htaccess rule (Apache) and a web.config rule (IIS). Nginx ignores .htaccess, so on Nginx we additionally recommend a server-side rule that blocks direct access to the folder /wp-content/uploads/sef-uploads/.

= Which languages does the admin interface support? =
The interface language follows your WordPress site or user language – no extra option is required. English is the source language and German is bundled as well, so both work out of the box. For any other language, WordPress automatically loads a matching translation pack when one is available; you can also translate the plugin with tools like Loco Translate or make it multilingual with WPML, Polylang or TranslatePress. Set the language under Settings → General, or your personal language under Users → Profile.

= Can I connect the form to my newsletter tool? =
Yes. Under "Newsletter" choose a provider (Brevo, Mailchimp or MailerLite), enter your API key and use "Test connection" to load your lists. Then enable it per form under Settings → Newsletter and set the list ID. Sign-ups are only forwarded when the visitor ticks the newsletter consent box.

= Can I remove the plugin cleanly? =
Yes. By default your forms and submissions are kept when you uninstall. Under **Sicherheit → Deinstallation** you can choose to remove all data when the plugin is deleted.

== Screenshots ==

1. Finished smartEngin Forms contact form on the front end (desktop).
2. Stored form submissions in the WordPress admin.
3. Contact-form overview with shortcode, preview and submission actions.
4. Newsletter integration with external providers such as Brevo.
5. Design controls with live preview.
6. Security controls and CAPTCHA provider settings.
7. Responsive contact form on a mobile device.
8. Drag-and-drop form builder with available field types.
9. Form delivery settings and confirmation-email editor.

== Changelog ==

= 0.20.2 =
* Documented the intentional load_plugin_textdomain() call (required to load the bundled German translation) so automated plugin checks no longer flag it. No functional or data changes.

= 0.20.1 =
* Added an example placeholder to the recipient email field showing that several recipients can be entered, one address per line. The default value (your site's administration email) is unchanged.
* Removed a personal email address from the bundled German translation file header (privacy); no effect on functionality or translations.

= 0.20.0 =
* Switched the source language to English (WordPress standard). The interface now follows your WordPress site/user language automatically; no code forces a language anymore.
* German is bundled as a de_DE translation, so German sites keep the full German interface out of the box; additional languages can come from translation packs (translate.wordpress.org) or tools like Loco Translate, WPML, Polylang and TranslatePress.
* Removed the previous "force English for non-German locales" mechanism and simplified translation loading to the standard load_plugin_textdomain() on init.
* Regenerated the translation template (.pot) with English source strings and removed the obsolete bundled en_US translation.
* No functional or data changes; all fixes from 0.19.6 are included.

= 0.19.6 =
* Removed an accidental test recipient address from the default form settings; new forms now use the site's administration email address by default.
* Added a safe, one-time migration that replaces that exact test recipient in existing forms with the administration email address, leaving individually configured recipients untouched.
* Fixed form duplication so it now copies the complete form settings (recipients, email/confirmation settings, redirect, captcha, newsletter, uploads and retention) to the new form.
* Added a safe fallback to the administration email address when a form has no valid recipient configured.
* Replaced real company and person names in the optional demo content with neutral placeholders.
* Minor stability and review fixes.

= 0.19.5 =
* Removed the free-form custom CSS input and all remaining references to it; the form design is fully configurable through the dedicated, validated controls (colors, spacing, borders, radius, font sizes, width, shadows, buttons).
* All dynamic form styles are now delivered exclusively through the WordPress style API (wp_add_inline_style); the plugin no longer prints inline <style> tags.
* Removed the manual load_plugin_textdomain() call; WordPress loads translations automatically, and the bundled English translation is loaded only for non-German locales.
* Updated the bundled SortableJS library to 1.15.7 and refreshed the third-party notices.
* Reviewed nonces, capability checks, input sanitization and output escaping across all admin and public requests.
* Corrected plugin metadata (Plugin URI and contributor).

= 0.19.3 =
* Improved script and style handle names to reduce the risk of conflicts with other plugins.
* The admin interface now falls back to English for every non-German site language (previously non-German languages could show untranslated source text).
* Design and form-builder live preview now scales to match the real front-end layout instead of squeezing horizontally.
* Updated translation metadata and release documentation.
* Performed final WordPress.org release preparation.

= 0.19.2 =
* Improved internal naming to reduce the risk of conflicts with other plugins.
* Added a safe migration path for existing settings and stored form data.
* Updated privacy-related wording in the plugin interface and documentation.
* Updated translations and plugin documentation.

= 0.19.1 =
* Improved privacy tools for exporting and erasing stored form submissions.
* Improved protection and secure delivery of uploaded files.
* Clarified third-party data transfer information and privacy documentation.
* Added compatibility fallback for hosts without mbstring.
* Improved cleanup of scheduled tasks on plugin deactivation.
* Updated plugin documentation and third-party notices.

= 0.19.0 =
* Menu streamlined for the free version; added a "smartEngin Pro" info page. Design tab: note that the Container settings only apply to single-part forms (without the hero card).

= 0.18.0 =
* New: full English translation of the admin interface. The backend follows the WordPress user/site language (German or English) – no extra setting needed.

= 0.17.0 =
* New: connect the newsletter consent checkbox to an external service (Brevo, Mailchimp or MailerLite). Opt-in only – data is sent solely when the visitor consents. Includes a "Test connection" button that loads the available lists.

== Upgrade Notice ==

= 0.20.2 =
Documentation-only change so automated plugin checks report cleanly. No functional or data changes; no action required.

= 0.20.1 =
Adds a helpful example placeholder to the recipient field and removes a personal email address from a bundled translation file. No action required; no data is affected.

= 0.20.0 =
The interface language now follows your WordPress site language. English and German are bundled; other languages come from translation packs. No action required; no data is affected.

= 0.19.6 =
Removes an accidental default test recipient and migrates it in existing forms to your administration email; also fixes duplicating a form so all settings are copied. No action required.

= 0.19.5 =
The free custom CSS field was removed to comply with WordPress.org guidelines and dynamic styles now use the WordPress style API. No action required; no data is affected.

= 0.19.3 =
Renamed internal script/style handles for better compatibility. No action required; no data is affected.

= 0.19.2 =
Internal identifiers were renamed for better compatibility. Existing settings and stored data are migrated automatically on update.

= 0.19.1 =
Privacy tools (export/erase), stronger upload protection with a secure download route, and an mbstring compatibility fallback.

= 0.18.0 =
The admin interface is now available in English and German (follows your WordPress language).

= 0.17.0 =
Adds optional newsletter opt-in to Brevo, Mailchimp and MailerLite.
