=== NetForms ===
Contributors: netchameleon
Tags: forms, contact form, form builder, gdpr, booking
Requires at least: 6.3
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Build forms in the block editor. Entries in your dashboard, consent records, file uploads and spam checks with no puzzles.

== Description ==

NetForms is a form builder that works the way the block editor does. Each field is a block: add them, drag them into order, put two side by side, and the form takes on your theme's fonts and colours. Put the form on any page with the NetForms form block or a shortcode.

It was made for village halls, clubs, charities and small businesses, who need forms that are easy to build, kind to the people filling them in, and careful with personal details.

= Fields =

Short text, email, phone, paragraph, dropdown, single choice, checkboxes, date, time, file upload, signature (drawn or typed) and consent.

= Entries in your dashboard =

* New, Read, Done and Spam tabs, search, a filter by form, and bulk actions.
* Each entry shows the answers, any files and signatures, the consent given, and what happened to it (emails sent, other plugins it was passed to).
* Export to CSV, following whatever tab, filter and search you're looking at.

= Emails =

* A notification to you, with Reply-To set to the person who sent the form, so you can just press Reply.
* An optional copy to the sender with your thank-you message and their answers.
* Subject tags: {form_title}, {site_name} and {field:key}.

= Consent records =

Every ticked consent box is stored with the exact wording the person saw and the time they ticked it. Consent wording can include a link to your privacy policy.

= Spam protection with no puzzles =

NetForms doesn't use CAPTCHAs. They put people off, they're hard for some users, reCAPTCHA sends visitor data to Google and needs cookie consent first, and they don't stop scams typed by real people anyway. Instead, every form has:

* A hidden "honeypot" field that people never see but bots fill in.
* A timing check: forms sent faster than a person could fill them in are caught.
* An hourly limit per visitor. Answers with mistakes don't count towards it.
* A word blocklist: anything on WordPress's own Disallowed Comment Keys list (Settings → Discussion), so comments and forms share one list.
* A link limit: messages with more links than you allow (one, by default) are caught. Scam and sales messages are full of links; genuine enquiries rarely have any.

If a site gets attacked by cleverer bots, two optional checks can be turned on in NetForms → Settings:

* **Cloudflare Turnstile:** usually invisible, no puzzles, no tracking cookies.
* **Akismet:** if the site already uses it for comments.

Caught entries go to the Spam tab with the reason, where they wait for 30 days in case something real was caught. Bots get the same thank-you reply as people, so they learn nothing.

= Works with the Netchameleon Suite =

NetForms works on its own. If you also use other Netchameleon plugins by Netchameleon, entries can be passed on:

* **NetBookings:** create a booking request that waits for your approval.
* **NetEvents:** sign people up for an event, or for the events they tick.
* **NetCampaigns:** add people to an email list, only when they tick a consent box, and keeping the list's double opt-in.

Choose which answer goes where with "Send to" on each field, and switch each connection on in the form's settings. The result shows on every entry, with a Try again button if something went wrong (for example, the date was already booked).

= Privacy =

* IP addresses are never stored. A one-way scrambled version is kept for up to an hour for the hourly limit.
* Works with WordPress's Export Personal Data and Erase Personal Data tools.
* Choose how long each form's entries are kept; older entries are deleted automatically.
* Suggested text for your privacy policy is added to Settings → Privacy.
* NetForms makes no requests to other servers unless you turn on Cloudflare Turnstile or Akismet (see External services below).

= Works with page caching =

Forms are sent through the WordPress REST API and refresh their spam-check token when the page loads, so they work on cached pages. They also work without JavaScript (except the signature pad).

== Installation ==

1. Install and activate NetForms.
2. Go to Netchameleon → NetForms and choose Add form. A new form starts with name, email, message and privacy fields.
3. Add, remove and arrange fields. Select a field to change its label, rules and width in the sidebar.
4. In the Form sidebar, set the button text, thank-you message, emails and spam settings, then Publish.
5. On any page, add the NetForms form block and pick your form, or paste the shortcode shown in the form's sidebar, e.g. `[netforms id="12"]`.

== Frequently Asked Questions ==

= Where do entries go? =

To Netchameleon → NetForms → Entries, and by email to the address set in each form. If you leave it empty, the site's admin email is used.

= Can I style the form? =

Forms take their fonts and colours from your theme, and the button uses your theme's button style. For finer control, override the `--netforms-*` CSS custom properties on `.netforms`.

= Where are uploaded files kept? =

In `wp-content/uploads/netforms/`, each in its own randomly named folder. They only open from the Entries screen, for people who can manage entries. On Apache servers the folder also refuses direct requests. On nginx servers, add a rule that denies access to `/wp-content/uploads/netforms/` for the same protection.

= Who can see entries? =

Editors and administrators. Developers can change this with the `netforms_entries_capability` filter.

= Do I need the other Netchameleon plugins? =

No. The connections only appear when those plugins are active.

= Why no reCAPTCHA? =

Google reCAPTCHA sets cookies and sends visitor data to Google, so under UK and EU law it needs consent first: visitors who reject cookies couldn't send your form. Picture puzzles also cost you enquiries and are hard for people with some disabilities. And no CAPTCHA stops scams typed by real people, or bots that pay services to solve them. NetForms' checks look at how a form was sent and what it says, and keep anything caught in a Spam tab so nothing real is lost. If you need more, turn on Cloudflare Turnstile.

= Is anything deleted when I uninstall? =

No, unless you tick "Also delete all forms, entries, consent records and uploaded files" in Netchameleon → NetForms → Settings first.

= Can developers extend it? =

Yes. There are filters for field types (`netforms_field_types`), validation (`netforms_validate`), spam decisions (`netforms_before_submit`), emails (`netforms_notification_email`, `netforms_confirmation_email`) and connections (`netforms_connectors`), and an action when an entry is saved (`netforms_entry_saved`).

== External services ==

NetForms works without any outside service. Two optional spam checks, both off by default, connect to other companies when a site owner turns them on in NetForms → Settings:

* **Cloudflare Turnstile** checks that a form is being filled in by a person. When it's on, visitors' browsers load a script from challenges.cloudflare.com when a page with a form is shown, and when a form is sent, your site sends Cloudflare the check result, your secret key and the visitor's IP address to confirm it. [Terms](https://www.cloudflare.com/website-terms/), [Privacy policy](https://www.cloudflare.com/privacypolicy/).
* **Akismet** (by Automattic) checks entries for spam. It's only available if the Akismet plugin is installed with a key. When it's on, each entry's answers, name, email address, the visitor's IP address, browser and the page address are sent to Akismet when the form is sent. [Terms](https://akismet.com/tos/), [Privacy policy](https://automattic.com/privacy/).

== Screenshots ==

1. Building a form in the block editor, with the form settings in the sidebar.
2. A form on the page, styled by the theme, pointing out an answer that needs fixing.
3. The Entries screen with New, Read, Done and Spam tabs.
4. A single entry with its answers, consent record and what was sent to other plugins.
5. Connections to NetBookings, NetEvents and NetCampaigns.

== Changelog ==

= 1.0.1 =
* Renamed the shared plugin family to the Netchameleon Suite. The shared admin menu is now called "Netchameleon" (page title "Netchameleon Suite") and sits between Tools and Settings. Shared hub updated to 0.7.0: class Netchameleon_Suite, menu slug ncsuite, filters netchameleon_suite_plugins, netchameleon_suite_catalogue, netchameleon_suite_menu_position and netchameleon_suite_fold_menus. The overview's list of other plugins is now headed "More from Netchameleon", and plugin links point to each plugin's own page and to netchameleon.co.uk/plugins/.

= 1.0.0 =
* First release: block-editor form builder with 12 field types, Entries screen, CSV export, email notifications, consent records, file uploads and signatures, spam protection without CAPTCHAs, WordPress privacy tools, automatic deletion of old entries, connections to NetBookings, NetEvents and NetCampaigns, a word blocklist and link limit, and optional Cloudflare Turnstile and Akismet checks.

== Upgrade Notice ==

= 1.0.0 =
First release.
