=== Sobi Forms ===
Contributors: alesas
Tags: contact form, form builder, forms, file upload, lightweight form
Requires at least: 6.0
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.7.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Create fast, lightweight WordPress contact forms with drag-and-drop builder, native SMTP, CSV export, file uploads, webhooks, spam protection, and inbox.

== Description ==

Build any WordPress contact form in minutes, without bloated scripts on your public site. Sobi Forms is a lightweight contact form plugin and drag and drop form builder for those who want native SMTP, webhooks, file uploads, spam protection, and a beautiful submissions inbox in one place.

**Perfect for:**

* Contact forms and lead capture forms
* Quote request forms and support forms
* Registration forms and newsletter signups
* Job application forms and file upload forms (resumes, PDFs, images)

Embed with shortcode or Gutenberg block on any page. React loads in the admin builder only — your visitors get a fast, lean front-end. Works with Elementor, Divi, Gutenberg and WooCommerce.

Learn more: <a href="https://sobiforms.com">sobiforms.com</a> — features, FAQ, and the <a href="https://sobiforms.com/roadmap/">public roadmap</a>.

== Why Sobi Forms? ==

* **Lightweight** — ~5 KB CSS + JS on form pages (gzipped); assets load only where a form is rendered
* **No bloat** — no jQuery, no front-end React, no Bootstrap on the public site
* **Native SMTP** — route notification and confirmation emails through your mail server
* **Native webhooks** — POST JSON to Zapier, Make, n8n, or any HTTPS endpoint
* **Gmail-style submissions inbox** — read, star, filter, search, spam queue, and Trashed tab; split list + detail layout to manage every contact form submission in one place
* **File uploads** — secure private storage; admin-only downloads
* **AJAX contact forms** — submit without a full page reload
* **GDPR-friendly** — inbox-only delivery, hashed IP, no tracking pixels
* **Spam protection** — honeypot, nonces, rate limit, optional Turnstile and Akismet
* **Fast admin** — drag and drop form builder (React in admin only)

== File Upload Forms ==

Collect resumes, PDFs, and images on the same form as the rest of your fields — no extra plugin. You pick what to accept; files stay **private on your server** and download only from the admin inbox.

== Drag and Drop Form Builder ==

Canvas on the left, settings on the right — build a form in minutes and **save without a page reload**. Start from **templates** (Contact, Quote, Job, Event, Support). Put fields **side by side** (First name | Last name). Mark each multi-checkbox option **Required** or **Optional** — mandatory terms, optional newsletter. Add **inline links** in paragraphs and consent checkboxes. Pause a form, close it on a date, or stop after N submissions. Text, email, phone, date, file upload, consent checkbox, and more — all in one builder.

== Native SMTP ==

Stop fighting WordPress mail. Route admin notifications and visitor thank-yous through **your SMTP server** — configure once under **Sobi Forms → Settings**, test the connection, and retry failed sends from the logs. No third-party form SaaS in the middle.

== Webhooks ==

Connect Sobi Forms to **Zapier, Make, n8n**, or any HTTPS endpoint. Set a webhook URL per form; submissions POST as JSON in the background. Failed deliveries land in the logs with **Retry** — no extra connector plugin.

== Submissions Inbox ==

Manage every lead like email: read/unread, star, search, filter, spam queue, and **Trashed** with restore. Split list + detail, admin notes, and a dashboard widget for unread submissions. See which page a submission came from. **Export to CSV or JSON** when you need a report or backup.

== Embed Anywhere ==

Shortcode or Gutenberg block — one click to **Embed**, paste on any page. Works with Elementor, Divi, WooCommerce, and any builder that supports shortcodes or blocks. **~5 KB** on pages with a form; **zero weight** everywhere else.

== Security & Privacy ==

Honeypot, nonces, and server-side validation on every submission. Optional Akismet and Cloudflare Turnstile. Rate limiting against abuse. Data stays on **your** server — no tracking pixels, inbox-only mode when you want zero email.

== Installation ==

1. Upload the `sobi-forms` folder to `/wp-content/plugins/` or install `sobi-forms.zip` from **Plugins -> Add New -> Upload**.
2. Activate **Sobi Forms** through the **Plugins** menu.
3. Go to **Sobi Forms -> Forms** and create your first form.
4. Click **Embed** in the form editor to copy the shortcode, or insert the **Sobi Forms Contact** block in the block editor.
5. Paste the shortcode into any page (Gutenberg, Elementor, Divi, widget, etc.).

== Frequently Asked Questions ==

= How do I create a contact form in WordPress? =

Install and activate Sobi Forms, then go to **Sobi Forms → Forms → Add New**. Use the drag and drop form builder to add fields, configure **After submit** actions, and click **Embed** to copy the shortcode or insert the Gutenberg block on any page.

= Can I create a job application form with file upload? =

Yes. Add text and email fields plus a **file upload** field for resumes or PDFs. Pick allowed file types in the field settings. Submissions with files are saved to the inbox (required for uploads); download attachments from the submissions inbox (admin only).

= Can visitors upload files? =

Yes. Each form can include one or more **file upload** fields (one file per field). Files are stored privately, validated server-side, and downloaded only by admins from the inbox.

= Does Sobi Forms support SMTP email? =

Yes. **Sobi Forms → Settings → SMTP** — enter your host and credentials, test the connection, then enable **Activate SMTP routing**. Notification and visitor confirmation emails use SMTP when routing is on; otherwise Sobi Forms falls back to WordPress `wp_mail()`. Failed sends appear under **Logs** with **Retry**.

= Can I connect Sobi Forms to Zapier? =

Yes. Add **Trigger webhook** under **After submit** and paste your Zapier catch hook URL (or use Make, n8n, etc.). Submissions are POSTed as JSON in the background. Failed deliveries appear under **Settings → Webhooks → Logs** with **Retry**.

= Is Sobi Forms GDPR friendly? =

Sobi Forms is designed for privacy: submissions stay on your server, raw IP addresses are not stored (hashed IP only for rate limiting), there are no tracking pixels, and you can use inbox-only delivery with no email. You are responsible for your site privacy policy and lawful basis for collecting data — see the Privacy Policy section below.

= Does Sobi Forms work with WooCommerce? =

There is no dedicated WooCommerce integration, but you can embed any form with the shortcode or Gutenberg block on WooCommerce pages, product descriptions, or sidebars that support blocks or shortcodes.

= Can I export form submissions to CSV or JSON? =

Yes. **Sobi Forms → Settings → Exports** — pick a form, choose CSV or JSON, optionally filter by inbox view or search. Exports run as background jobs; download securely when ready (files kept 7 days).

= Can I link to my privacy policy in a consent checkbox? =

Yes. Edit the checkbox label in the builder, select the text, click **Link**, and pick a published WordPress page or paste a URL. Links open in a new tab; clicking the link does not toggle the checkbox.

= Can I require terms acceptance but keep newsletter optional? =

Yes. Add a **multi-checkbox** field with two or more options. On each row, set **Required** for terms and **Optional** for newsletter. Visitors must check required options to submit; optional boxes stay unchecked unless they opt in. Works with linked labels (privacy policy URL).

= Do existing forms change checkbox validation automatically? =

No. Forms saved before 1.7.1 without per-option flags keep the previous rules until you open the form in the builder and save again. Single consent checkboxes behave as before.

= Can I place two fields on the same row? =

Yes. Drag a field beside another in the builder to create a multi-column row (up to 3 columns). Drag the separator to resize; double-click the separator to equalize column widths. On narrow screens, columns stack vertically.

= Can I recover deleted form submissions? =

Yes. **Delete** moves submissions to **Trashed** (soft delete). Open the **Trashed** tab in the inbox to restore them or delete permanently. Exports skip trashed rows by default.

= Does Sobi Forms work with Elementor? =

Yes. Paste `[sobiforms id="3"]` or `[sobiforms slug="your-form"]` into an Elementor Shortcode widget, or use the Gutenberg block in the block editor. Front-end assets load only when the form is rendered.

= Does Sobi Forms slow down my site? =

On pages **without** a form, Sobi Forms adds **no** front-end CSS or JavaScript. On pages **with** a form, only ~5 KB gzipped combined — no jQuery, no front-end React, no Bootstrap.

= Where is the form builder JavaScript loaded? =

The admin builder (~39 KB gzipped, plus WordPress-bundled React via `wp-element`) loads **only** on **Sobi Forms → Forms → Edit**. It never runs on the front-end.

= Can I use Sobi Forms with Divi or other page builders? =

Yes. Use the shortcode or Gutenberg block anywhere your page builder supports them.

= Is database storage required? =

No. Choose inbox save, admin notification, webhook, or any combination under **After submit**. New forms default to inbox save plus admin notification.

= Does Sobi Forms include reCAPTCHA? =

No. Honeypot, WordPress nonces, rate limiting, and optional Cloudflare Turnstile or Akismet — kept lightweight by design.

= Does Sobi Forms work with Akismet? =

Yes. Enable **Akismet** under **Settings → Spam protection** when the Akismet plugin is active. Spam is quarantined in the inbox; visitors still see a normal success message.

= Can I pause a form or close it after a deadline? =

Yes. Under **Availability**, pause immediately or set a **Schedule close date**. Visitors see your unavailable message instead of the form.

= Can I disable the plugin stylesheet and use my theme styles? =

Yes. Use the `sobiforms_enqueue_front_assets` filter to disable CSS while keeping AJAX submission.

= Where can I suggest features or see what is planned? =

Visit <a href="https://sobiforms.com/roadmap/">sobiforms.com/roadmap</a> or the WordPress.org support forum (**Sobi Forms → Resources → Feedback**).

== Privacy Policy ==

Sobi Forms processes data submitted through your forms. Per form you choose how submissions are delivered:

* **Email notifications** - when the admin notification action is enabled with valid recipient addresses, field values are sent via `wp_mail()` or SMTP.
* **Visitor confirmation** - when **Send user confirmation** is enabled under **After submit**, the submitter may receive a simple thank-you at the address from the selected email field (no submitted field values in that email).
* **Database storage** - when **Save to inbox** is enabled (default for new forms), submissions are saved in custom tables on your site (`wp_sobiforms_submissions`, `wp_sobiforms_forms`). Retention / auto-purge is configured on that action. You can use inbox-only delivery with no email.
* **Hashed IP** - when storage is enabled, a one-way SHA-256 hash of the visitor IP is stored with each submission for abuse prevention. Raw IP addresses are not stored.
* **Rate limiting** - configurable under **Settings → Spam protection** (default 10 submissions per hashed IP per hour; set to 0 to disable). Transients expire automatically.
* **Admin notes** - internal notes on submissions are stored in your database and never shown on the front-end or included in emails.
* **No tracking** - Sobi Forms does not connect to third-party analytics or advertising when processing form submissions.
* **Optional Akismet** - if you enable Akismet spam filtering under **Settings → Spam protection** and the Akismet plugin is active, submission content may be sent to Akismet’s service for spam checks.
* **Optional Cloudflare Turnstile** - if you enable Turnstile under **Settings → Spam protection**, the browser loads Cloudflare’s Turnstile script and may send a verification token to Cloudflare when a form is submitted.
* **Optional Webhooks** - if you add **Trigger webhook** under **After submit**, submission data (and file URLs when applicable) are POSTed to the URL you provide.
* **No data sent to the plugin author** - form submissions stay on your server and mail server. The **Feedback** settings tab links to the WordPress.org support forum and <a href="https://sobiforms.com/roadmap/">sobiforms.com/roadmap</a> only if you choose to open them.

Site owners are responsible for their privacy policy and lawful basis for collecting visitor data.

== Licenses for Third-Party Resources ==

This plugin bundled resources covered by their own respective licenses:
* Lucide Icons - https://lucide.dev
  License: ISC (https://lucide.dev/license)
  Copyright (c) Lucide Contributors

== Screenshots ==

1. Form builder — canvas, field settings, and **After submit** delivery actions (inbox, email, webhook).
2. Front-end form — lightweight markup on the page with AJAX feedback after submit.
3. Submissions inbox — split list and detail, All/Unread/Starred tabs, spam queue, Trashed soft-delete, and admin notes.
4. Settings — SMTP, Webhooks, Exports, and Spam protection in one place (drawer UI).

== Changelog ==

= 1.7.1 =
* **Per-option required checkboxes** — multi-checkbox fields: each option row has an inline **Required** / **Optional** control (e.g. mandatory terms plus optional newsletter). Single consent checkboxes still use one field-level **Required** toggle. HTML5 and server validation enforce each mandatory option.
* **Inbox** — submission detail lists every checkbox option with checked / unchecked state (not only selected labels).
* **Form builder sidebar** — WordPress panel layout; compact tertiary buttons for setting values; full-width **Add action**; success, error, and inactive messages in popover textareas with multiline previews.
* **Forms list** — **Status** column (Active, Paused, Closed, Limit reached).

= 1.7.0 =
* **CSV and JSON export** — **Settings → Exports**: background export jobs per form. Filter by view (all, unread, read, starred) and search; optional email when ready (your account only). Secure download; files kept 7 days. CSV flat columns with JSON-encoded multi-values; JSON structured records with native types.
* **Inline links** — add hyperlinks in Paragraph text, consent checkbox labels (terms & conditions), and multi-checkbox option labels (builder: select text → Link). Links open in a new tab; clicking a link does not toggle the checkbox.
* **Inline link page picker** — pick a published WordPress page from the link bubble (privacy policy, terms, etc.) or paste an external URL. Page selection auto-applies the permalink.
* **Submission trash** — delete moves submissions to **Trashed** (recoverable). **Trashed** inbox tab to restore or delete permanently; exports skip trashed rows.
* **Form templates** — five starters (Contact, Quote, Job, Event, Support) from the forms list. New forms start with an empty canvas; use a template for a ready-made field set.
* **Multi-column layout** — place up to 3 fields side by side in the builder (e.g. First name | Last name). Drag a field beside another to create a row; drag column separators to resize; double-click a separator to equalize widths. Visitor forms use a responsive grid; columns stack on narrow screens.
* **Fixed** — After submit redirect to a WordPress page kept the selected page on save.
* **Builder** — consistent **Add field** control in the empty canvas and footer.
* **Forms list** — sort by last updated (most recently edited first).
* **Submissions inbox** — discreet **Leave a review**, **Get help**, and **Share an idea** links in the empty detail panel (including when no message is selected).

= 1.6.0 =
* **SMTP** — custom outbound mail under **Sobi Forms → Settings → SMTP**: host, credentials, **Activate SMTP routing**, test connection/email. Falls back to `wp_mail()` until routing is on. **Logs** tab (30 days) for failed notification and confirmation emails with **Retry**.
* **Webhooks** — send ham submissions as JSON to an external URL (async). Set the URL per form under **After submit**; **Settings → Webhooks** lists configured forms. **Logs** tab (30 days) for failed deliveries with **Retry**.
* **Spam protection** — **Settings → Spam protection**: configurable rate limit (default 10/hour per hashed IP; 0 = off), Akismet toggle (moved from Resources → Usage), optional **Cloudflare Turnstile** (invisible mode).
* **Settings** — new menu for SMTP, Webhooks, and Spam protection (no separate install step).
* **After submit** (builder) — clearer post-submit setup: visitor message or redirect, plus actions (inbox, admin email, confirmation, webhook). Existing forms migrate automatically.
* **Onboarding** — redirect to the form builder after activation when no forms exist; dashboard widget CTA to create the first form.
* **Date field** — optional min/max in field settings.
* **Form builder** — always-visible **Add field** above submit; sidebar and context menu polish; After submit action list styling.
* **Submissions inbox** — React app: open messages, filter, and paginate without full page reload; toast feedback for actions; toolbar bulk actions when a message is open; full-row click target.
* **Settings** — toast feedback on save (SMTP, Spam protection).
* **Fixed** — MariaDB activation error on reserved index name `purge`

= 1.5.1 =
* **Security** — File upload: removed archive and web-active formats from the allowed picker (zip, rar, gzip, svg, html, xml).

= 1.5.0 =
* **Form builder** — **Title** and **Paragraph** layout blocks for section headings and instructions (not collected on submit).
* **URL parameter prefill** — optional per-field query-string prefill for text, email, phone, link, number, and long text (client-side; cache-friendly).
* **Hidden fields** — compact sidebar table to pass invisible data (URL params and/or static defaults); invisible on the front; always submitted; visible in inbox.
* **Availability** — close form automatically after a set number of submissions.
* **File upload** — one file per field; pick allowed types by category (Application, Image, Text) or individual extensions (default 5 MB cap); secure server validation; files stored privately under `uploads/sobiforms/`; download from the Submissions inbox (admin only). Save to database is required when a form includes a file field.
* **Inbox** — see which page a submission came from (frozen page title and pathname in the detail sidebar). Useful when one form is embedded on multiple pages. Query strings (UTM, etc.) are not captured — use hidden fields. Older submissions show “Not recorded”.
* **Performance & reliability** — form loading and submission are more robust on cached sites, with a smoother experience for visitors.
* **Admin speed** — builder editing and submissions inbox are noticeably faster on larger forms and busier sites.

= 1.4.3 =
* **Form builder** — settings sidebar sections collapse and expand correctly again (1.4.2 kept them visually open in the WordPress admin).

= 1.4.2 =
* **Form builder** — fix settings (save to inbox, emails, pause, after-submit, etc.) being reset when saving with a collapsed sidebar section.
* **Form builder** — new fields are optional by default (not required).

= 1.4.1 =
* **Submissions inbox** — full-page layout (no card frame); **Spam** view tab after Starred; form filter as a dropdown button with filter icon; search field styling polish; more comfortable list row spacing.
* **Submissions inbox** — starred marker uses filled yellow star.
* Form builder — settings sidebar toggles fully clickable.

= 1.4.0 =
* **Dashboard widget** — unread submissions on the WordPress admin home screen.
* **Visitor confirmation email** — optional per-form thank-you to submitters (Notifications sidebar).
* **Submissions inbox** — split layout (list + detail), resizable columns, pagination, bulk actions, Gmail-style toolbar; **All / Unread / Starred** view tabs; form filter dropdown in the list header; spam via more menu; community links in the empty detail panel.
* Form emails use the **site name** as sender instead of "WordPress".

= 1.3.0 =
* Form builder — redesigned edit screen for more comfort: canvas plus settings sidebar, clearer toggles, and save without a full page reload.
* New **Link** field type — collect website or profile URLs with http/https validation.

= 1.2.0 =
* Form availability — pause or auto-close by date/time (site timezone).
* Configurable unavailable message when the form is not accepting submissions.
* Akismet spam filtering (global setting, spam queue in Submissions).
* Submissions inbox — Spam filter, mark as spam / not spam.
* Submissions — auto mark as read on open; Mark all as read.
* Form improvements — field min/max (number, text); multiple choice tiles; multi-option checkboxes with inline option editing in the builder.

= 1.1.0 =
* Custom submit button text per form (editor preview + front-end).
* Field settings: show/hide label, textarea resize toggle, max character limit.
* Per-form database storage and retention (moved from global settings).
* Submissions inbox always available in admin.
* Form builder UX polish — context menus, field contrast, layout fixes.
* Settings: removed global Privacy & Storage tab; Feedback links to WordPress.org forum and public roadmap.

= 1.0.0 =
* Initial release.
* Multi-form builder with shortcode `[sobiforms slug="…"]` / `[sobiforms id="…"]` and Gutenberg block `sobiforms/contact`.
* Field types: text, email, textarea, phone, number, select, radio, checkbox.
* Multiple recipient emails, post-submit message or redirect.
* Optional DB storage, submissions inbox with notes and filters.
* Prefix `sobiforms_` throughout (WordPress.org coding standards).
* Conditional front-end assets - load only when a form is rendered.

== Upgrade Notice ==

= 1.7.1 =
**Per-option required checkboxes** — mark individual multi-checkbox options as Required or Optional (ideal for terms + newsletter). **Inbox** shows all checkbox options with checked state. **Form builder** sidebar aligned with the WordPress editor. Existing forms keep current validation until you edit and save them in the builder.

= 1.7.0 =
**CSV/JSON export**, **inline links** (paragraph + checkbox / T&C with page picker), **Trashed** inbox tab, **form templates**, and **multi-column layout**. Background export jobs with secure download (7-day retention). Existing forms are unchanged until you edit them.

= 1.6.0 =
**SMTP** (custom mail + logs), **Webhooks** (JSON + failure logs), and **Spam protection** (rate limit, Akismet, Cloudflare Turnstile) under **Sobi Forms → Settings**. **After submit** replaces older builder toggles (auto-migrate). SMTP routing stays off until you enable it.

= 1.5.1 =
Security hardening for file uploads: archive and web-active formats removed from the allowed picker. Re-save a form if its file field had only removed types selected.

= 1.5.0 =
Builder upgrade: layout blocks, URL prefill, hidden fields, submission cap, and file upload. Existing forms are unchanged until you enable these in the builder.

= 1.4.3 =
Fixes the form builder settings sidebar so sections can be collapsed again. No data changes.

= 1.4.2 =
Important builder fix: form settings no longer reset when sidebar sections are collapsed on save. New fields default to optional. Re-check forms you edited on 1.4.0–1.4.1 if save to inbox or notification settings looked wrong.

= 1.4.1 =
Inbox polish: full-page layout, Spam tab in the header, form filter dropdown, and starred icon fill. No settings or data changes.

= 1.4.0 =
Split inbox with All/Unread/Starred tabs, dashboard unread widget, visitor confirmation emails, Lucide admin icons, and shortcode now requires id or slug. Existing embeds with id or slug are unchanged.

= 1.3.0 =
A more comfortable form editor, new Link (URL) field, and smoother save. Existing forms and submissions are unchanged.

= 1.2.0 =
Pause or auto-close forms, Akismet spam queue, inbox polish, choice-tile multiple choice, multi-option checkboxes, and field min/max settings. Existing forms stay open until you enable availability settings.

= 1.1.0 =
Per-form storage settings, submit button customization, and builder improvements. Global save/retention options migrate to each form on upgrade.

= 1.0.0 =
Initial public release of Sobi Forms.
