WPCalibrate Forms

An enterprise-grade, high-performance WordPress form builder engineered from the ground up for high-traffic sites, mission-critical workflows, and enterprise scale. Featuring dedicated indexed database tables, dual client/server conditional logic, multi-step pagination, spreadsheet formula injection defense, and seamless 1-click automatic updates from the WordPress dashboard.

Table of Contents

• About
• Key Features
• Starter Demo Templates
• Architecture & Storage Engine
• Installation
• Automatic Dashboard Updates
• Documentation & Usage
  • Gutenberg Block
  • Shortcode Embedding
  • PHP Template Helper
  • Supported Smart Tags
• Developer API & Hooks
• Security & GDPR Privacy
• Changelog
• License & Support

About

Most traditional WordPress form plugins store submissions and dynamic field entries inside the standard WordPress wp_posts and wp_postmeta tables. As forms accumulate tens of thousands of entries, core database tables experience severe fragmentation, query contention, and locking issues during high-volume spikes.

WPCalibrate Forms solves this architectural bottleneck through:

1. Dedicated Indexed Tables: Entries, values, and staff notes are stored in 3 custom indexed database tables, completely isolating form data from core WordPress content.
2. Zero-Bloat Standalone Architecture: 100% independent PSR-4 autoloaded architecture with zero WooCommerce dependency and zero third-party framework overhead.
3. Spreadsheet Formula Injection Defense: Native neutralization of malicious spreadsheet formula characters (=, +, -, @, \t, \r) during CSV export, preventing remote code execution vulnerabilities in Microsoft Excel and Google Sheets.
4. WCAG 2.1 AA Accessibility: Semantic HTML5 form controls, explicit label-for pairings, live inline validation feedback, and ARIA announcement regions.

Key Features

🎨 Visual Drag-and-Drop Form Builder

• Original 3-panel builder layout: field palette on the left, interactive live canvas in the center, and granular inspector on the right.
• Instant responsive viewport preview toggles: Desktop, Tablet, and Mobile.
• Live form title editing and auto-save indicators.

📋 18 Versatile Field Types

• Standard Inputs: Single-line Text, Email, Phone, Number, Textarea, Website URL, Hidden Field.
• Choice Fields: Dropdown Select, Radio Buttons, Checkboxes, Multi-Select Dropdowns.
• Date & Time: Date Picker, Time Selector.
• Layout & Structure: Custom HTML / Content blocks, Page Break (Multi-Step Forms), Submit Button.
• Advanced Fields: Protected File Upload, Privacy Consent Checkbox.

🔀 Dual Conditional Logic Engine

• Show or hide any field dynamically based on user inputs.
• Compound logic rules with Match ALL or Match ANY evaluation.
• Supported comparison operators: equals, not_equals, contains, greater_than, less_than, is_empty, is_not_empty.
• Dual Evaluation: Evaluates client-side for smooth real-time UI transitions, while strictly mirroring the exact logic server-side during submission to ignore hidden inputs safely.

📑 Multi-Step Forms with Progress Tracking

• Insert Page Breaks anywhere on the canvas to break complex forms into bite-sized steps.
• Interactive step-by-step progress bars and customizable Next/Previous navigation buttons.

🛡️ Multi-Tier Anti-Spam Pipeline

• Zero-Friction Honeypot: Invisible trap field filtering bots silently without requiring captchas.
• Cloudflare Turnstile: Privacy-focused challenge token verification.
• Google reCAPTCHA v2 / v3: Native score evaluation and verification tokens.

📬 Delivery & Integrations

• Administrator Alerts & Auto-Responders: HTML or plain text emails dispatched via WordPress core wp_mail().
• Dynamic Smart Tags: Inject submission details and metadata into email subjects and bodies ({all_fields}, {field:field_id}, {form_title}, etc.).
• SSRF-Protected Outgoing Webhooks: Dispatches JSON payloads to external CRMs, Zapier, or automation platforms via wp_safe_remote_request() with optional HMAC SHA-256 signatures.

Starter Demo Templates

WPCalibrate Forms comes bundled with 5 production-ready, 1-click starter templates:

Architecture & Storage Engine

Submissions and entry values are stored in high-performance custom tables:

erDiagram
    WPCALIBRATE_FORMS_ENTRIES ||--o{ WPCALIBRATE_FORMS_ENTRY_VALUES : contains
    WPCALIBRATE_FORMS_ENTRIES ||--o{ WPCALIBRATE_FORMS_ENTRY_NOTES : contains
    WPCALIBRATE_FORMS_ENTRIES {
        bigint id PK
        bigint form_id FK
        bigint user_id
        varchar status
        varchar ip_address
        text user_agent
        datetime created_at
        datetime updated_at
    }
    WPCALIBRATE_FORMS_ENTRY_VALUES {
        bigint id PK
        bigint entry_id FK
        varchar field_id
        varchar field_type
        longtext field_value
    }
    WPCALIBRATE_FORMS_ENTRY_NOTES {
        bigint id PK
        bigint entry_id FK
        bigint user_id
        text note
        datetime created_at
    }

• Entries Table (wpcalibrate_forms_entries): Tracks submission status (unread, read, spam, trash), user IP, and timestamps.
• Values Table (wpcalibrate_forms_entry_values): Normalized EAV structure storing each field value separately for indexing and fast search.
• Notes Table (wpcalibrate_forms_entry_notes): Threaded staff notes log for internal customer support tracking.

Installation

Method 1: Install via WordPress Dashboard (Recommended)

1. Download the latest wpcalibrate-forms-1.0.0.zip from GitHub Releases.
2. Log into your WordPress admin dashboard and navigate to Plugins > Add New Plugin.
3. Click Upload Plugin at the top, select the downloaded .zip file, and click Install Now.
4. Click Activate Plugin.

Method 2: Manual FTP / SFTP Installation

1. Extract wpcalibrate-forms-1.0.0.zip on your local machine.
2. Upload the extracted wpcalibrate-forms directory to your web server's /wp-content/plugins/ directory.
3. In WordPress admin, go to Plugins and click Activate under WPCalibrate Forms.

Automatic Dashboard Updates

WPCalibrate Forms features native GitHub release update detection:

• When a new version is published to this GitHub repository, WordPress checks for updates automatically.
• A notification banner appears in Dashboard > Updates and on the Plugins screen with 1-click Update Now support.
• Clicking View version details displays release notes, bug fixes, and upgrade instructions in the native WordPress modal.
• Compatible with Git Updater through declared headers:

  GitHub Plugin URI: zeeshanraza-official/wpcalibrate-forms
  Primary Branch:    main
  Release Asset:     true

Documentation & Usage

1. Gutenberg Block

Search for WPCalibrate Form in the Gutenberg Block Inserter. Select your form from the inspector dropdown to preview and embed the form live on any page.

2. Shortcode Embedding

Embed forms anywhere shortcodes are supported (posts, pages, elementor widgets, text blocks):

[wpcalibrate_form id="123"]

3. PHP Template Helper

Render a form directly in custom theme templates or action hooks:

<?php
if ( function_exists( 'wpcalibrate_forms_render_form' ) ) {
    echo wpcalibrate_forms_render_form( 123 );
}
?>

Supported Smart Tags

Use smart tags dynamically in admin email notifications, confirmation messages, and webhook payloads:

Developer API & Hooks

Action Hooks

// Fired immediately after an entry is saved to the database
add_action( 'wpcalibrate_forms_entry_created', function( int $entry_id, int $form_id, array $entry_data ) {
    // Custom post-submission workflow
}, 10, 3 );

// Fired before dispatching outgoing webhooks
add_action( 'wpcalibrate_forms_before_webhook_dispatch', function( string $url, array $payload ) {
    // Audit logging or webhook pre-processing
}, 10, 2 );

Filter Hooks

// Modify sanitized submission values before persistence
add_filter( 'wpcalibrate_forms_sanitize_field_value', function( $value, string $field_type, string $field_id ) {
    return $value;
}, 10, 3 );

// Filter outgoing webhook request arguments (headers, timeout, etc.)
add_filter( 'wpcalibrate_forms_webhook_args', function( array $args, string $url ) {
    $args['headers']['X-Custom-Auth'] = 'MySecretToken';
    return $args;
}, 10, 2 );

Security & GDPR Privacy

• Spreadsheet Formula Injection Defense: Neutralizes Excel/Sheets command injection (=, +, -, @, \t, \r) during CSV exports.
• SSRF Hardening: Webhooks route through wp_safe_remote_request() with loopback and private IP blocks.
• Protected File Storage: Uploads are stored in execution-protected directories with strict .htaccess deny rules.
• Automated Data Retention: Daily WP-Cron pruning of entries exceeding the configured retention threshold.
• GDPR Personal Data Exporter & Eraser: Fully wired to core WordPress privacy tools.

Changelog

[1.0.3] - 2026-10-21

• Fixed: Screen slug check in asset loader to support parent menu wpcalibrate.
• Fixed: Dynamic filemtime cache-busting on admin stylesheets and scripts.
• Fixed: Critical inline CSS fallback preventing unstyled layout under aggressive reverse proxy caching.
• Fixed: WordPress admin notice barrier <hr class="wp-header-end"> isolating third-party notices above header cards.

[1.0.2] - 2026-10-21

• Added: Interactive Overview Tab featuring System Health Hero metrics, Purpose, Method, and 6-step Creator guide.
• Added: 5 Production-ready Starter Form Templates with 1-click generator.
• Added: Unified admin header navigation bar across all management screens.

[1.0.1] - 2026-10-21

• Added: Standalone distribution package and automated verification suite.
• Added: Remote FTP mirroring deployment pipeline.

[1.0.0] - 2026-10-20

• Initial Release: Core form engine, 3-panel visual builder, 18 field types, conditional logic, custom database tables, CSV export, and email notifications.

License & Support

WPCalibrate Forms is licensed under the GNU General Public License v2.0 or later.

• Website: https://wpcalibrate.com
• Support: support@wpcalibrate.com
• Repository: https://github.com/zeeshanraza-official/wpcalibrate-forms