=== Nolimit Forms ===
Contributors: nolimit
Tags: forms, contact form, form builder, turnstile, smtp
Requires at least: 6.4
Tested up to: 7.1.2
Requires PHP: 7.4
Stable tag: 0.1.8
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

A drag-and-drop form builder with nothing held back. Conditional logic, file uploads, multi-step forms, entry storage, Turnstile and SMTP — all of it, free.

== Description ==

Nolimit Forms is a form builder for WordPress that does not have a paid tier,
because there is nothing to hold back for one.

The reason it exists is specific. The popular free form plugins are free the
way a trial is free: the builder works, and then conditional logic is paid,
file uploads are paid, multi-page forms are paid, and — the one that catches
people out — **submissions are not stored at all** unless you upgrade. A site
owner discovers that after the enquiries have already been missed.

Everything below is in this plugin, for everyone:

* **A real drag-and-drop builder.** Twenty-three field types, drag from the
  palette or click to add, reorder by dragging or with the keyboard.
* **Conditional logic.** Show or hide any field based on any other, with
  eight comparisons and all-of/any-of matching.
* **Multi-step forms.** Drop in a page break; you get a step indicator, Back
  and Next, and per-step validation.
* **File uploads.** Multiple files, size and type limits, stored outside the
  media library so nothing is published at a guessable URL.
* **Entries you can actually read.** Stored in the database, with an inbox,
  a full view of each submission, and CSV export.
* **Spam protection that works.** Cloudflare Turnstile, hCaptcha and Google
  reCAPTCHA v2 or v3, plus an optional honeypot and timing check.
* **SMTP that explains itself.** Brevo, SMTP2GO, Mailgun, SendGrid, Postmark,
  Amazon SES, Google Workspace, Microsoft 365, or any other SMTP server.
* **GDPR built in.** A consent field, per-form retention, and proper
  registration with WordPress' own personal-data exporter and eraser.

= On spam protection =

Turnstile is the one to choose if you have no reason to prefer another. It is
free at any volume, needs no Google account, and shows most visitors nothing
at all.

One design decision worth stating: **verification fails closed**. If the
provider cannot be reached, the submission is refused with a message asking
the visitor to try again, rather than let through. That has a real cost on a
flaky network and it is the correct trade — a spam gate that opens whenever
somebody can break the site's outbound request is not a spam gate.

= On sending mail =

WordPress hands mail to the server's own sendmail unless something tells it
otherwise, and most hosts do not authenticate that — so the mail is accepted
and then silently dropped by the recipient. That is the usual reason a contact
form "does not work".

Each provider's entry names the credential it actually wants, because that is
where the support tickets come from: Brevo wants an **SMTP key**, not the
account password and not the API key. SMTP2GO wants an **SMTP user** created
under Sending → SMTP Users, not your login. SendGrid wants the literal word
`apikey` as the username.

If another SMTP plugin is active, Nolimit Forms **stands down and says so**
rather than fighting for the same hook.

= On privacy =

No telemetry. Nothing about your site is sent anywhere, and there is no
account to create. The only outbound requests this plugin makes are to your
chosen captcha provider to verify a token, to your chosen SMTP server to send
your mail, and to its own release feed to check for updates.

IP addresses are **not** stored by default. Each entry carries a salted hash
of the address and browser that is regenerated daily — enough to recognise the
same submitter twice today, and not an identifier tomorrow. That is a
deliberate choice: it means counting submitters needs no cookie banner.

= Part of the Nolimit family =

Shares one wp-admin menu with Nolimit Security, Cache, Assistant, Discounts,
Subscriptions, SEO and Views. Each works alone.

== Installation ==

1. Upload the zip under **Plugins → Add New → Upload Plugin**.
2. Activate it.
3. **Forms → Add form**, build it, tick Published, save.
4. Put the shortcode the list shows you on a page, or use the Nolimit Forms
   block.

After the first install the plugin updates itself from its own release feed
and appears on Dashboard → Updates like any other plugin.

== Frequently Asked Questions ==

= Is anything held back for a paid version? =

No. There is no paid version.

= Will my entries survive if I deactivate the plugin? =

Yes. Deactivating changes nothing, and deleting the plugin leaves the data
alone unless you have ticked the box on the settings screen that says
otherwise. Deleting a plugin is not the same as deciding the enquiries it
collected may be destroyed.

= Can I keep the SMTP password out of the database? =

Yes, and it is worth doing. Put `define( 'NLFRM_SMTP_PASS', '…' );` in
`wp-config.php` and it is used instead of the stored value, so the credential
is never in a database backup.

= Does it work with page caching? =

Yes. Submission goes through the REST API rather than a cached page, and the
timing check ignores a stale timestamp rather than rejecting it.

== Changelog ==

= 0.1.8 =
* Nolimit Forms now tells WooCommerce that it works with High-Performance Order
  Storage and the Cart and Checkout blocks, so it no longer appears under
  "Incompatible with WooCommerce features" on the Plugins screen. Nothing else
  changes.

= 0.1.7 =
* Fixed: the `nlfrm_submission` hook no longer fires for a submission filed as spam on reputation, as the developer documentation already said it did not. Nothing in this plugin was affected; it matters to anything that listens to the hook, such as a mailing-list signup.

= 0.1.6 =
* Fixed: the Send button. It had no styling of its own, so visitors got the browser's plain grey button, and on a site that runs the form through WordPress's automatic paragraphs it also had a stray line break inside it that pushed the label to the bottom of a tall box. Send and Next now take the look of your theme's buttons, with a plain fallback when a theme has none; Back stays a quiet outline.
* Fixed: the form no longer gets stray `<p>` and `<br>` elements inserted into it on sites that run the Shortcode block's output through wpautop. Fourteen extra paragraphs were measured in one live form.
* The Plugin URI now points at a page that exists.

= 0.1.5 =
* Forms keep working when Nolimit Security's REST API lockdown is switched on. That setting refuses every REST route to logged-out visitors except an allow-list, and this plugin was not on it — so a form would have answered "you must be signed in" to every visitor, with no obvious cause. The lockdown is off by default, so no site was affected.

= 0.1.4 =
* New: a Company field, with browser autofill.
* Fixed: you can now change the labels on each box of a Name or Address field. They defaulted to English with no way to edit them, which showed "First name" and "Last name" on forms in every other language.
* Browser autofill on every field that should have it — name, email, phone, website, company and each part of an address. Previously no field offered it at all, so visitors retyped their own details on every form. A field can turn it off, for a box that asks about somebody else.

= 0.1.3 =
* The test message can now be sent to any address you type, instead of only to the one on your own user profile.
* The screen now names that default address, says it is your WordPress profile rather than a setting of this plugin, and links to where it lives.
* When a test fails it now says which address it tried and which server it went through, not only what went wrong. Previously you only learned the recipient if the mail server happened to echo it back.

= 0.1.2 =
* Fixed: you could not add a field at the bottom of a form by dragging. Dropping onto a field always inserted above it, and once a form had three fields there was nowhere else to drop — so the only way to add one at the end was to drop it in the middle and drag the bottom field up over it. Dropping on the lower half of a field now means after it, and there is a drop zone below the last field.
* Fixed: dragging a field downwards landed it one place past where it was dropped.
* The builder now shows which side of a field a drop will land on.

= 0.1.1 =
* An address the site owner has allowlisted in Nolimit Security is never filed as spam, and skips this plugin's honeypot. Security's firewall checks its allowlist before its block list, so an allowlisted address carrying a stale block row is let through — and a verdict that outlived that would have binned the owner's own submission.
* A logged-in member of staff is never filed as spam. Without this, an administrator filling in their own form from an office address on a threat list had their submission binned.
* Submissions filed as spam are now deleted after 30 days by default. A rate limit bounds how fast a bot can submit, never how much it can accumulate.

= 0.1.0 =
* First release.
