XortGHL Form self-updates

Professional, standalone WordPress form builder engineered for GoHighLevel (HighLevel) integration with multi-step workflows, conditional logic, spam protection, and privacy-first submission storage.

Description

XortGHL Form is an advanced, standalone WordPress form builder tailored for high-converting lead generation and direct integration with GoHighLevel (HighLevel). It dispatches form submissions straight to GoHighLevel Workflows via Inbound Webhooks with enterprise-grade reliability, attribution tracking, spam protection, and delivery queueing.

Key Features

• Visual Drag-and-Drop Builder: Build responsive, multi-column forms with instant live inspector and customizable styling presets (Default, Minimal, Modern, Rounded, Compact).
• Multi-Step Workflows: Create engaging multi-step lead funnels with progress bars, step validation, and smooth step navigation.
• Smart Conditional Logic: Dynamically show or hide fields based on user input using flexible rules (equals, not_equals, contains, empty, not_empty) with ALL or ANY rule groups.
• GoHighLevel Inbound Webhook Integration: Send normalized form submissions straight to your GoHighLevel Automation Workflows with 1-click field mapping. Standard contact keys (first_name, last_name, email, phone, company_name, message) are automatically recognized.
• Attribution & UTM Tracking: Automatically captures utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid, and fbclid for end-to-end campaign tracking in GoHighLevel.
• Smart Delivery Queue & Retry: Automatic exponential backoff retries for transient server issues with consistent, canonical payload preservation across every delivery attempt.
• Spam Protection: Multi-layered spam prevention with invisible honeypots, IP-based rate limiting, and Google reCAPTCHA v3.
• File Upload Security: Robust server-side file validation with strict MIME and extension whitelisting (PDF, JPG, PNG, DOC, DOCX), randomized storage paths, and execution prevention (.htaccess).
• Privacy & Data Governance: Flexible submission storage policies (Permanent Storage or Ephemeral / Storage OFF with temporary encrypted retry mode).
• Diagnostic Delivery Logs: Detailed delivery inspection with sensitive secret scrubbing, manual retry trigger, and granular log deletion.

Installation

1. Upload the xortghl-form directory to your WordPress /wp-content/plugins/ directory, or install the plugin ZIP file via Plugins → Add New → Upload Plugin.
2. Activate the plugin through the Plugins menu in WordPress.
3. Access XortGHL Form in your WordPress admin menu:
   • Navigate to Forms to create your form or instantiate from built-in templates.
   • In the Form Editor, open Integrations to configure your GoHighLevel Inbound Webhook URL.
   • Navigate to Settings to configure global Google reCAPTCHA v3 keys.

Shortcode Usage

Display any active form on your site by placing the shortcode into any post, page, or widget:

[xortghlf_form id="123"]

Replace 123 with your form's unique ID shown on the Forms list screen.

Optional shortcode parameters:

• title="false": Suppress form title display.
• description="false": Suppress form description display.

Built-in Templates

Quickly launch forms using 8 professionally designed starter templates:

1. Blank Form: A blank canvas for fully custom form designs.
2. Contact Form: Standard contact inquiry form with name, email, phone, and message.
3. Lead Generation: High-converting lead form with company and service interest selectors.
4. Request a Quote: Detailed quotation request with budget dropdowns and conditional fields.
5. Consultation Booking: Appointment and consultation intake with date and note fields.
6. Job Application: Comprehensive employment application featuring secure resume file uploads.
7. Customer Inquiry: Support and client question triage form.
8. Multi-Step Lead Funnel: 3-step structured lead qualification funnel.

Every instantiated template generates immutable, unique field IDs (fld_xxx) and step IDs (stp_xxx) with automatic conditional reference remapping. Templates never copy credentials.

Conditional Logic

Conditional logic rules evaluate both in the browser in real time and strictly on the server:

• Supported operators: equals, not_equals, contains, empty, not_empty.
• Supported logic groups: ALL (AND) or ANY (OR).
• Server-side authority: If a field is conditionally hidden when the user submits, its submitted value is stripped on the backend to guarantee data consistency.

Multi-Step Forms

• Build structured multi-step forms with dedicated step navigation (Next / Previous).
• Independent step validation prevents advancing until current step requirements are satisfied.
• Uploaded files persist seamlessly across step navigation.
• Outbound integrations (GHL API, Webhooks) fire only upon final submission completion.

GoHighLevel Inbound Webhook Integration

• Connect any WordPress form directly to a GoHighLevel Workflow using an Inbound Webhook trigger.
• Sends clean, structured JSON payloads with top-level contact fields (first_name, last_name, full_name, email, phone, company_name, message) mapped automatically.
• Captures complete first-touch and submission-page marketing attribution (utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid, fbclid, referrer, source_url).
• One-click "Send Test Ping" sends realistic form-specific sample payloads so GoHighLevel instantly detects all custom fields.
• Diagnostic delivery logging with smart retry queue (exponential backoff) for temporary network/rate-limiting errors.

Webhooks

• Configure custom outbound webhook endpoints per form.
• Supported methods: POST (JSON).
• Delivery status tracking (200 Success, 4xx Client Error, 5xx Server Error, Timeouts).
• Automatic retry queue with exponential backoff.
• Diagnostic logs mask sensitive authentication headers.

Spam Protection

• Honeypot: Hidden trap field invisible to genuine users, catching automated spam bots.
• Rate Limiting: Configurable IP-based rate limiting prevents brute-force submissions.
• Google reCAPTCHA v3: Score-based invisible verification with configurable threshold (default 0.5).
• Cloudflare Turnstile: Privacy-preserving, CAPTCHA-free smart challenge.
• Per-form provider configuration: Form A can use reCAPTCHA v3 while Form B uses Turnstile and Form C uses Honeypot only.

File Upload Security

• Authoritative backend file type validation.
• Allowed file extensions: PDF, JPG, PNG, DOC, DOCX.
• Dangerous file extensions (PHP, PHTML, JS, EXE, SVG, double extensions) are rejected immediately.
• Upload directory protected with randomized file names and .htaccess direct execution prevention.

Submissions & Privacy Governance

• Storage ON: Submissions and field values are stored in local WordPress database tables for administration.
• Storage OFF: Ephemeral mode; submission data is dispatched directly to GoHighLevel/webhooks without local database persistence.
• Temporary Retry Mode: When local storage is disabled, failed transmissions are stored temporarily in an encrypted queue payload and deleted immediately upon successful delivery or final expiration.
• Data Retention Auto-Cleanup: Automatically purge historical submission records older than a configured day threshold (e.g., 30, 60, 90 days).
• Form Deletion Safety: Deleting a form preserves historical submissions and delivery logs by default for audit safety, displaying "Deleted Form (ID X)" gracefully. An explicit purge option is available if permanent data removal is requested.

Plugin Updates

XortGHL Form supports seamless updates via GitHub Release integration. When a new release tag is published, WordPress detects the update automatically, allowing one-click upgrades with full data preservation.

Uninstall Policy

Under XortGHL Form → Settings → Uninstall Policy, administrators can choose between two behaviors:

1. Preserve Data (Default): Deactivating or uninstalling the plugin keeps all form structures, submissions, and delivery logs intact in the database.
2. Purge All Data: When enabled, deleting the plugin completely removes all XortGHL database tables, options, and uploaded files. Unrelated WordPress data is never touched.

Changelog

1.0.0-rc.1

• Release Candidate 1.
• Complete visual form builder with multi-step workflows and live inspector.
• 8 built-in production templates with unique ID generation and reference remapping.
• 5 styling presets with CSS variable scoping and zero cross-form leakage.
• Real-time client and server-side conditional logic engine.
• Dedicated GoHighLevel Inbound Webhook integration with automatic contact field mapping.
• Multi-form isolation on single pages with unique DOM wrapper IDs.
• Per-form spam protection supporting Honeypot, Rate Limiting, Google reCAPTCHA v3, and Cloudflare Turnstile.
• Privacy & data governance modes (Storage ON, Ephemeral / Storage OFF, Encrypted Temporary Retry).
• Secure file uploads with authoritative server-side MIME and extension whitelisting.
• Outbound webhooks with exponential retry queue and diagnostic delivery logs.
• Masked secret handling and authenticated encryption at rest (sodium_crypto_secretbox / AES-256-GCM).
• Historical audit log and submission preservation upon form deletion with graceful "Deleted Form" fallback.