=== FormForge ===
Contributors: avakodeforge
Donate link: https://avakode.com
Tags: forms, form-builder, ai, conditional-logic, contact-form
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.39
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Drag & drop form builder with conditional logic, webhooks, file uploads, anti-spam, and CSV export. Unlimited forms, 22 field types.

== Description ==

**Form Forge** is a fast, modern form builder. Build unlimited forms with a drag-and-drop builder, 22 core field types, conditional logic, generic webhooks, file uploads, anti-spam, and submissions with one-click CSV export — all in the free plugin, no form caps. Start from 168 ready-made templates or the included shortcode. Upgrade to Pro for AI form generation, payments, multi-step, and branded integrations.

= Free =
* Unlimited forms (no form caps)
* 22 core field types (text, email, number, select, checkbox, radio, file upload, etc.)
* Drag-and-drop form builder
* Conditional logic
* Generic webhooks (Zapier, Make, n8n, custom APIs)
* File uploads
* Anti-spam (honeypot, time-trap, and Google reCAPTCHA v3 with your own keys)
* Address field with map and geocoding (your own Google or Yandex key)
* Appointment picker with locally generated time slots
* Submissions dashboard + CSV export
* 168 ready-made templates (contact, registration, survey, booking, etc.)
* Shortcode embedding ([formforge id="X"])
* Email notifications (admin + autoresponder)
* Fluid single-column layout that fits a phone screen without extra setup
* Import from Contact Form 7, Gravity Forms, WPForms and Ninja Forms

= Form Forge Pro =

Pro is a separate add-on plugin, distributed from https://formforgewp.com and not
included in this download. Everything listed above is part of this plugin and
works without it.

* AI form generation (describe → done)
* Multi-step forms with progress bar
* Conversational mode (Typeform-like one-question-at-a-time)
* Stripe payments
* Mailchimp / HubSpot / Google Sheets integrations
* Telegram / WhatsApp / Slack / Discord notifications
* Live Google Calendar availability and event creation
* Submission analytics and abandonment recovery

Part of the **Forge Suite** — bundle includes Lang Forge, Rank Forge, Field Forge.

== External services ==

Out of the box this plugin contacts nothing. Every outbound request below is switched on by you, by entering a key or a URL of your own on the plugin's settings screen or in a form's settings. Activating the plugin does not contact any server and does not schedule anything that would.

The plugin has no analytics, no telemetry, no usage reporting and no licensing calls of its own.

= Google reCAPTCHA v3 =

*What it is for.* Scoring form submissions so automated ones can be rejected without asking a human to solve a puzzle. The plugin's own honeypot and time-trap run locally and need no service; reCAPTCHA is the optional third layer.

*What is sent.* From the visitor's browser to Google: the page the form is on and whatever signals reCAPTCHA itself collects, under Google's own terms. From your server to Google on submit: your reCAPTCHA secret key, the one-time token the widget produced, and the visitor's IP address. No form field values are sent — not the name, not the email, not the message.

*What is received.* A success flag and a score between 0 and 1.

*When.* The script loads on pages that render a form, and the verification request happens on submit — but only while both the site key and the secret key are filled in under Form Forge → Settings → Anti-spam. With either one blank, no script is loaded, no request is made, and submissions are simply not scored.

*Which endpoints.* `https://www.google.com/recaptcha/api.js` (browser) and `https://www.google.com/recaptcha/api/siteverify` (server).

*Terms of the provider.* [Terms](https://policies.google.com/terms), [privacy](https://policies.google.com/privacy).

= Google Maps JavaScript API =

*What it is for.* Drawing the map and offering address suggestions in an address field, when you pick Google as the map provider.

*What is sent.* From the visitor's browser to Google: your Google Maps API key and whatever the visitor types into the address box or clicks on the map. Google's terms and privacy policy govern that traffic; your server sends Google nothing.

*What is received.* Map tiles and address suggestions.

*When.* Only on pages rendering a form that has an address field, and only while a Google Maps API key is filled in under Form Forge → Settings → Maps with Google chosen as the provider. With no key, no script is loaded and the field falls back to a plain text address input.

*Which endpoint.* `https://maps.googleapis.com/maps/api/js`.

*Terms of the provider.* [Terms](https://cloud.google.com/maps-platform/terms), [privacy](https://policies.google.com/privacy).

= Yandex Maps and Yandex Geocoder =

*What it is for.* The same address field, when you pick Yandex as the map provider instead. Yandex Maps draws the map in the browser; the Geocoder turns a typed address into coordinates on the server.

*What is sent.* From the visitor's browser to Yandex: your Yandex Maps JavaScript API key (and your Suggest key, if you filled one in) and what the visitor types or clicks. From your server to the Geocoder: **the address the visitor typed into the form**, or the coordinates they clicked, together with your Geocoder API key. The plugin does not send the visitor's IP address, name, email or any other form field to Yandex.

*What is received.* Map tiles and suggestions in the browser; a single resolved address with its coordinates on the server.

*When.* Only on pages rendering a form that has an address field, and only while Yandex is chosen as the provider under Form Forge → Settings → Maps and the matching key is filled in. The geocoding request additionally requires a Geocoder API key and is rate-limited to 60 lookups per minute per IP address. With no key, no script is loaded, no request is made, and the field falls back to a plain text address input.

*Which endpoints.* `https://api-maps.yandex.ru/2.1/` (browser) and `https://geocode-maps.yandex.ru/v1` (server).

*Terms of the provider.* [Terms](https://yandex.com/legal/maps_termsofuse/), [privacy](https://yandex.com/legal/confidential/).

= Webhooks to an address you choose =

*What it is for.* Handing a submission to another system of yours — Zapier, Make, n8n, a CRM, your own endpoint — the moment it arrives.

*What is sent.* A JSON document with the form id and title, the submission id, a timestamp, and the submitted field values, plus any HTTP headers you configured. This is your own data going to your own destination; no third party of ours is involved and nothing passes through our servers.

*What is received.* Only the HTTP status code, which is written to the plugin's webhook log.

*When.* Only on submission of a form whose **Webhook URL** you filled in, in that form's settings. Empty by default on every form. The URL is validated and checked against an SSRF policy before anything is sent, so a webhook cannot be pointed at your own private network.

*Which endpoint.* Whichever URL you entered. The plugin ships no default and contacts no address of its own.

*Terms of the provider.* Whatever applies to the service you chose.

= Services reached only through the separate Pro add-on =

The Stripe payment field and the Google Sheets integration are part of Form Forge Pro, a separate plugin that is not included in this download. The field's code, and the requests below, ship in the add-on. For completeness: with the add-on installed and your own keys entered, a form with a payment field loads `https://js.stripe.com/v3/` so that card details go straight to Stripe and never touch your site, and the form editor loads `https://apis.google.com/js/api.js` so you can pick a spreadsheet, after which `https://sheets.googleapis.com/v4/spreadsheets` receives the rows. Without the add-on neither is reachable and neither host is contacted. Stripe: [terms](https://stripe.com/legal), [privacy](https://stripe.com/privacy). Google: [terms](https://policies.google.com/terms), [privacy](https://policies.google.com/privacy).

== Installation ==

1. Upload `formforge` to `/wp-content/plugins/`, or install via Plugins → Add New.
2. Activate the plugin.
3. Go to **Form Forge → New form**, or open **Form Forge → Forms** and pick one.
4. Drop the shortcode (e.g. `[formforge id="1"]`) anywhere on a page or post.

== Frequently Asked Questions ==

= Can I import forms from Gravity Forms / WPForms? =

Yes. **Form Forge → Migration** detects Contact Form 7, Gravity Forms, WPForms and Ninja Forms if they are installed and imports their form fields. What comes across besides the fields depends on the source: Contact Form 7 does not store submissions at all, and WPForms keeps entries only in its own Pro version. The Migration screen names what it can take from each source before you run it.

= Are webhook URLs validated for security? =

Yes — Form Forge rejects webhook URLs that resolve to private IP ranges (RFC1918), loopback, or cloud-metadata endpoints. The check uses `is_safe_url()` (per-plugin) and `Forge_Net` (shared SSRF helper).

= How does anti-spam work? =

Free tier ships honeypot + time-trap (a form submitted in under 2s is rejected) and Google reCAPTCHA v3 with your own site and secret keys. No third-party anti-spam service is bundled.

= Does Form Forge track abandoned (unsubmitted) forms? =

Abandonment tracking is a Pro feature; the free plugin does not collect any abandoned-form data. When enabled in Pro, it defaults to metadata-only: it records which fields a visitor interacted with (for funnel analytics) but stores no field values, no IP address, and no user agent. Storing the partial values a visitor typed, along with their IP and user agent, is a separate per-form opt-in ("capture values") that is OFF by default. If you enable value capture, disclose it in your site's privacy policy.

== Screenshots ==

1. Form builder (drag-drop)
2. AI form generator (Pro)
3. Conditional rules applied at submit (configured via import or AI)
4. Submissions list + CSV export
5. Notification configuration

== Changelog ==

= 1.0.39 =
* **This release needs Form Forge Pro 1.2.0 or newer.** The free plugin no longer checks licences at all: the Pro features — the Stripe payment field, Google Sheets, WhatsApp, HubSpot, conversational forms, analytics and AI generation — now carry their own code and their own licence check inside the add-on. An older add-on is switched off whole rather than left half-working.
* The free plugin no longer loads anything from Google or Stripe on its own screens; those scripts come with the add-on.
* Request input is sanitised where it is read, and admin output is escaped.

= 1.0.38 =
* **This release needs FormForge Pro 1.1.0 or newer.** An older add-on is switched off whole rather than left running, because beside this core it would be present and wrong rather than absent. Until you update it Post Submission, User Registration, multi-step and conversational forms, payment, repeater and calculation fields, AI form generation and the analytics screens are unavailable. Forms already saved and the submissions already collected are untouched, an admin notice names both versions and what stopped, and installing the current add-on brings all of it back.
* Deleting the last Forge product on a site now clears the job queue the Forge plugins share — its table, its two scheduled events and its version marker. While any other Forge product is still installed, deleting this one leaves the queue exactly as it is, because the pending jobs in those rows are that product's too.
* Fixed: with a Pro licence linked through Avakode, Settings → Google showed the Avakode connection card where Connect Google Account belongs. The card now offers the Google connection and names the step that failed.
* The Conditional Logic section no longer shows a PRO badge — conditional logic is part of the free plugin.
* Admin screens load their scripts and styles through WordPress instead of inline tags, and file writes go through the WordPress filesystem API.
* The Forge Suite dashboard links Guard Forge, Velocity Forge and Flow Forge to their sites: guardforge.app, velocityforge.app and flowforgewp.app.

= 1.0.37 =
* Suite banner: the eleven products and the three-step set discount are up to date.

= 1.0.36 =
* Forge Suite dashboard: results are the first screen — each tool's own results with window and completeness, detected and confirmed apart, a Needs-attention filter and a local CSV export for administrators.
* Set discounts in the Suite banner follow the three-step ladder (2 tools 15%, 3 tools 25%, 4 or more 35%).
* Translations refreshed for all catalogues.

= 1.0.35 =
* Licensing no longer depends on a third-party SDK. The plugin asks avakode.com whether this site is licensed and caches the answer for a day; if the check cannot be completed — a network hiccup, a timeout, our own error — your paid features stay on. Only a clear “this licence is not active” turns them off.
* Deactivating from the Forge Suite dashboard now releases the site slot directly, instead of the three-step fallback the old SDK needed when a licence had been cancelled server-side.
* Smaller package and one less admin surface: the SDK’s own menu, opt-in screen and promotional notices are gone.

= 1.0.34 =
* Forge Suite dashboard: names of the builder-rail tools (Clearway, Profit, Inclusive Forge) no longer truncate next to the “Not installed” badge.

= 1.0.33 =
* The Forge Suite dashboard now shows the whole seven-tool line-up from the product registry — Clearway Forge, Profit Forge and Inclusive Forge join the four WordPress tools — counts active tools against seven, and its cross-sell banner points at the Forge Builder on avakode.com (one checkout, set discount up to 45%) instead of the retired Freemius bundle.

= 1.0.32 =
* The shared inline assets (docs link, feedback widget) are now emitted as a literal nowdoc block instead of being assembled in an output buffer — the same hardening Lang Forge 1.0.31 and Rank Forge 1.1.3 received.
* The Bundle License card no longer shows the Connect result twice; translations synced.

= 1.0.31 =
* Google reCAPTCHA v3 is no longer behind a licence. It runs on your own reCAPTCHA keys and talks directly to Google, so gating it was withholding built-in functionality.
* The address field with map and geocoding is likewise unrestricted — it uses your own Google or Yandex key and never touches our servers.
* The appointment picker now generates its time slots on any install. Overlaying real busy times from a connected Google Calendar still needs the separate Pro add-on, which holds the OAuth application.
* Removed licence checks that could never fail, on conditional logic, file uploads and webhooks. Those have been free for some time, but the code still asked and the admin screens still showed a PRO badge.
* Availability of add-on features is now decided by whether the add-on is installed, not by a licence call.

= 1.0.30 =
* Security hardening: all dynamic output is now escaped late at the output site with the context-appropriate function (esc_html/esc_attr/esc_url, esc_html__ for translated strings used as format strings, and wp_kses for trusted pre-built admin/field markup). No behavioural changes.

= 1.0.29 =
* Pro-only features (Post Submission, User Registration, multi-step forms, conversational mode, repeater and calculation fields) are now provided entirely by the Form Forge Pro add-on and are no longer bundled in the free plugin — the free download contains only fully-functional free features.
* Removed the leftover form-count limit scaffolding; the free plugin has always supported unlimited forms.

= 1.0.28 =
* Uninstall cleanup now removes transients only under the plugin's own unambiguous prefix, so unrelated transients belonging to other plugins are never deleted.

= 1.0.24 =
* New: Support menu item that opens the Avakode support dashboard.
* New: Opt-in anonymous usage analytics (OFF by default) — see Third-Party Services.
* New: Contextual, dismissible Pro feature tips on the plugin dashboard (Free users only).


= 1.0.21 =
* Hardened inline admin script output (field-mapping editors).
* WordPress.org compliance and code-quality improvements.

= 1.0.20 =
* Fix: AI form generation now shows a clear reason when it can't run (license/credits needed, or the service is unreachable) instead of a generic "Unknown error".

= 1.0.19 =
* Security: the Google Account connection now starts via a one-time token, so the license key is never placed in a URL.

= 1.0.18 =
* WordPress.org compliance and licensing hardening.
* Pro entitlement is now resolved by the Form Forge Pro add-on; the free plugin bundles no licensing SDK.
* The Google integration SDK now loads only when the Pro Google Sheets feature is active.
* readme metadata cleanup.

= 1.0.0 =
* Initial release.

== Upgrade Notice ==


= 1.0.39 =
Needs Form Forge Pro 1.2.0 or newer — an older add-on is switched off whole, so payment, Google Sheets, conversational forms, analytics and AI generation stop until you update it. Saved forms and submissions are untouched.

= 1.0.38 =
Needs FormForge Pro 1.1.0 or newer — an older add-on is switched off whole, so Post Submission, User Registration, multi-step forms, payment and calculation fields, AI generation and analytics stop until you update it. Saved forms and submissions are untouched.

= 1.0.24 =
Adds a Support menu, optional anonymous analytics (off by default), and dashboard Pro tips.


= 1.0.21 =
Security hardening and WordPress.org compliance improvements.

= 1.0.18 =
Licensing and WordPress.org compliance improvements.

= 1.0.0 =
Initial release.
