FlowBridge Forms

=== FlowBridge Forms === Contributors: flowbridgeforms Tags: forms, multistep forms, crm, rest api, submissions Requires at least: 6.5 Tested up to: 6.6 Requires PHP: 7.4 Stable tag: 0.1.0 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html

Secure multi-step forms with configurable REST API delivery, email notifications, local submissions, exports, file uploads, and privacy controls.

== Description ==

FlowBridge Forms lets administrators create multiple multi-step forms, configure fields and steps, customize frontend design, store submissions, send notifications through WordPress wp_mail(), and send submitted data to administrator-configured CRM or REST API endpoints.

The plugin does not send submission data to the plugin developer. It does not include telemetry, tracking, license checks, remote scripts, or hidden developer-controlled endpoints.

External services disclosure: submitted form data may be sent to an API endpoint only when a site administrator explicitly enables API delivery for a form and configures an endpoint. Site owners are responsible for their CRM or API provider privacy terms.

Email disclosure: email is sent through WordPress wp_mail(). SMTP delivery requires separate WordPress SMTP configuration or an SMTP plugin.

Upload disclosure: uploaded files may contain personal data. Site administrators should configure allowed file types, retention, and privacy notices appropriately.

== Features ==

• Multi-step form builder with unlimited steps and fields.
• Shortcode: [flowbridge_form id="123"].
• Elementor shortcode compatibility without requiring Elementor.
• Frontend progress indicators and design controls.
• Local submission storage with indexed custom database tables.
• Generic REST API connector with API key, bearer token, basic auth, custom headers, JSON/form payloads, retries, and status logging.
• Admin and user email notifications using wp_mail().
• Secure file upload validation with blocked executable/archive types.
• CSV export, privacy exporter, privacy eraser, retention controls, and optional uninstall cleanup.
• Built-in honeypot, minimum completion time, rate limiting, and duplicate-submission prevention.

== Installation ==

1. Upload the flowbridge-forms directory to /wp-content/plugins/.
2. Activate FlowBridge Forms from the Plugins screen.
3. Go to FlowBridge Forms > Forms and create a form.
4. Publish the form.
5. Copy the shortcode into a page, post, widget, template, or Elementor shortcode widget.

== Form Creation Guide ==

Create a new form from FlowBridge Forms > Forms. Add steps, fields, labels, keys, options, required status, file upload limits, CRM mapping keys, and design settings. Publish the form when ready.

Field keys are sanitized server-side and should be unique per form. Select, radio, and checkbox group options should be one per line, optionally as value|Label.

== API Configuration Guide ==

Open a form and enable API delivery in Form Settings. Configure endpoint URL, method, authentication, custom headers, content type, timeout, success status codes, mapping keys, and static values.

HTTPS is required by default. HTTP requires explicit opt-in. Localhost and private-network endpoint URLs are rejected to reduce SSRF risk. Authorization headers and credentials are redacted from logs.

Supported placeholders include {field_key}, {form_id}, {form_title}, {submission_id}, {submission_date}, and {site_url}. IP address and user agent placeholders require explicit administrator opt-in.

== Email Configuration Guide ==

Admin and user notifications use wp_mail(). The plugin does not include an SMTP client. Use a trusted SMTP plugin or server configuration for authenticated SMTP delivery.

Recipient, CC, BCC, subject, body, reply-to field, submitted field inclusion, and safe attachment behavior are configurable per form.

== File Upload Guide ==

File upload fields are disabled unless a file field is added. Each file field supports allowed extensions, maximum size, and maximum count. Blocked extensions include PHP, script, executable, SVG, and archive formats. WordPress file APIs validate MIME and extension before storage.

== Privacy ==

Local submission storage can be disabled per form. IP collection is disabled by default. Retention days can be configured per form. WordPress personal data exporter and eraser integrations are included. Delete-all-data-on-uninstall is disabled by default.

== Security Overview ==

Privileged admin actions require capabilities and nonces. Public submissions require a nonce, form availability checks, spam checks, validation, sanitization, idempotency, and safe output. Dynamic SQL uses $wpdb->prepare(). Credentials are not exposed in frontend HTML or JavaScript.

== Developer Hooks ==

See docs/hooks.md for actions and filters.

== Frequently Asked Questions ==

= Does the plugin send data to FlowBridge Forms developers? =

No. The plugin does not send submission data, telemetry, usage tracking, or license checks to the developer.

= Does this require Elementor? =

No. The shortcode works inside Elementor shortcode widgets, but Elementor is not required.

= Does this include SMTP? =

No. It uses WordPress wp_mail() and works with SMTP plugins that configure or replace wp_mail().

== Changelog ==

= 0.1.0 =

• Initial development build with form builder, shortcode renderer, submissions, API delivery, email notifications, uploads, export, privacy tools, and documentation.

== Upgrade Notice ==

= 0.1.0 = Initial development version.