=== FormForge ===
Contributors: avakode
Donate link: https://avakode.com
Tags: forms, form-builder, ai, conditional-logic, contact-form
Requires at least: 6.5
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.0.30
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Drag & drop form builder with conditional logic, webhooks, file uploads, anti-spam, and CSV export. Unlimited forms, 22 field types.

== Description ==

**Form Forge** is a fast, modern form builder. Build unlimited forms with a drag-and-drop builder, 22 core field types, conditional logic, generic webhooks, file uploads, anti-spam, and submissions with one-click CSV export — all in the free plugin, no form caps. Start from 168 ready-made templates or the included shortcode. Upgrade to Pro for AI form generation, payments, multi-step, and branded integrations.

= Free =
* Unlimited forms (no form caps)
* 22 core field types (text, email, number, select, checkbox, radio, file upload, etc.)
* Drag-and-drop form builder
* Conditional logic
* Generic webhooks (Zapier, Make, n8n, custom APIs)
* File uploads
* Anti-spam (honeypot, time-trap)
* Submissions dashboard + CSV export
* 168 ready-made templates (contact, registration, survey, booking, etc.)
* Shortcode embedding ([formforge id="X"])
* Email notifications (admin + autoresponder)
* Mobile-first responsive layouts

= Pro =
* AI form generation (describe → done)
* Multi-step forms with progress bar
* Conversational mode (Typeform-like one-question-at-a-time)
* Stripe payments
* Mailchimp / HubSpot / Google Sheets integrations
* Telegram / WhatsApp / Slack / Discord notifications
* Submission analytics

Part of the **Forge Suite** — bundle includes Lang Forge, SEO Forge, Field Forge.

== Third-Party Services ==

Form Forge connects to the following third-party services. Each is optional and is contacted only when you add the relevant field type or enable the relevant integration.

* **Avakode API** (https://avakode.com) — powers AI form features and validates your license; sends your site URL, license key, and the relevant form data only when you use an AI action. Terms: https://avakode.com/terms — Privacy: https://avakode.com/privacy
* **Google reCAPTCHA** — only if you add a reCAPTCHA field; the visitor's token is verified at https://www.google.com/recaptcha/api/siteverify on form submission. Terms: https://policies.google.com/terms — Privacy: https://policies.google.com/privacy
* **Stripe** — only if you add a Stripe payment field; https://js.stripe.com is loaded so card details are collected directly by Stripe (never stored on your site). Terms: https://stripe.com/legal — Privacy: https://stripe.com/privacy
* **Google Maps JavaScript API** — only if you add a map/address field using Google Maps; https://maps.googleapis.com is loaded to render the map. Terms: https://cloud.google.com/maps-platform/terms — Privacy: https://policies.google.com/privacy
* **Google Sheets API** — only if you enable the Google Sheets integration; https://apis.google.com is loaded to authorise access to your sheet. Terms: https://policies.google.com/terms — Privacy: https://policies.google.com/privacy
* **Yandex Maps & Geocoder** — only if you choose Yandex as the map provider; https://api-maps.yandex.ru and https://geocode-maps.yandex.ru are contacted to render the map and geocode addresses. Terms: https://yandex.com/legal/maps_api
* **Anonymous usage analytics (opt-in, OFF by default)** — Only if you explicitly opt in from the Form Forge settings, the plugin sends anonymous product-usage telemetry to the Avakode API (https://avakode.com/telemetry): a random install ID (UUID, not tied to your site URL or any account), your bucketed WordPress and PHP version ranges, the plugin version, and aggregate feature-usage event counters. It is sent ONLY after you opt in and can be disabled at any time. It never sends your site URL, email address, post or form content, or license key. Privacy: https://avakode.com/privacy

== Installation ==

1. Upload `formforge` to `/wp-content/plugins/`, or install via Plugins → Add New.
2. Activate the plugin.
3. Go to **Form Forge → All Forms → New Form**.
4. Drop the shortcode (e.g. `[formforge id="1"]`) anywhere on a page or post.

== Frequently Asked Questions ==

= Can I import forms from Gravity Forms / WPForms? =

Migration tooling is on the roadmap. For now, the AI generation can recreate a form from a screenshot or description.

= Are webhook URLs validated for security? =

Yes — Form Forge rejects webhook URLs that resolve to private IP ranges (RFC1918), loopback, or cloud-metadata endpoints. The check uses `is_safe_url()` (per-plugin) and `Forge_Net` (shared SSRF helper).

= How does anti-spam work? =

Free tier ships honeypot + time-trap (form submitted in < 2s is rejected). Pro adds optional integrations with Cloudflare Turnstile and reCAPTCHA.

= Does Form Forge track abandoned (unsubmitted) forms? =

Abandonment tracking is a Pro feature; the free plugin does not collect any abandoned-form data. When enabled in Pro, it defaults to metadata-only: it records which fields a visitor interacted with (for funnel analytics) but stores no field values, no IP address, and no user agent. Storing the partial values a visitor typed, along with their IP and user agent, is a separate per-form opt-in ("capture values") that is OFF by default. If you enable value capture, disclose it in your site's privacy policy.

== Screenshots ==

1. Form builder (drag-drop)
2. AI form generator (Pro)
3. Conditional rules applied at submit (configured via import or AI)
4. Submissions list + CSV export
5. Notification configuration

== Changelog ==

= 1.0.30 =
* Security hardening: all dynamic output is now escaped late at the output site with the context-appropriate function (esc_html/esc_attr/esc_url, esc_html__ for translated strings used as format strings, and wp_kses for trusted pre-built admin/field markup). No behavioural changes.

= 1.0.29 =
* Pro-only features (Post Submission, User Registration, multi-step forms, conversational mode, repeater and calculation fields) are now provided entirely by the Form Forge Pro add-on and are no longer bundled in the free plugin — the free download contains only fully-functional free features.
* Removed the leftover form-count limit scaffolding; the free plugin has always supported unlimited forms.

= 1.0.28 =
* Uninstall cleanup now removes transients only under the plugin's own unambiguous prefix, so unrelated transients belonging to other plugins are never deleted.

= 1.0.24 =
* New: Support menu item that opens the Avakode support dashboard.
* New: Opt-in anonymous usage analytics (OFF by default) — see Third-Party Services.
* New: Contextual, dismissible Pro feature tips on the plugin dashboard (Free users only).


= 1.0.21 =
* Hardened inline admin script output (field-mapping editors).
* WordPress.org compliance and code-quality improvements.

= 1.0.20 =
* Fix: AI form generation now shows a clear reason when it can't run (license/credits needed, or the service is unreachable) instead of a generic "Unknown error".

= 1.0.19 =
* Security: the Google Account connection now starts via a one-time token, so the license key is never placed in a URL.

= 1.0.18 =
* WordPress.org compliance and licensing hardening.
* Pro entitlement is now resolved by the Form Forge Pro add-on; the free plugin bundles no licensing SDK.
* The Google integration SDK now loads only when the Pro Google Sheets feature is active.
* readme metadata cleanup.

= 1.0.0 =
* Initial release.

== Upgrade Notice ==

= 1.0.24 =
Adds a Support menu, optional anonymous analytics (off by default), and dashboard Pro tips.


= 1.0.21 =
Security hardening and WordPress.org compliance improvements.

= 1.0.18 =
Licensing and WordPress.org compliance improvements.

= 1.0.0 =
Initial release.
