=== Formatrica - Drag and Drop Form Builder ===
Contributors: thezoran
Tags: forms, form builder, contact form, drag and drop, email
Requires at least: 6.4
Tested up to: 7.0
Requires PHP: 8.1
Stable tag: 1.1.3
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html
Text Domain: formatrica

Lightweight drag-and-drop WordPress form builder with reliable email delivery, strong security, and flexible integrations. By NexusPlugins.

== Description ==

Formatrica is a clean, modern drag-and-drop form builder for WordPress. Build a production-ready form in a few clicks and drop it onto any page with a shortcode or block — with reliable email delivery, strong anti-spam, and practical defaults out of the box.

= Highlights =

* **Drag-and-drop builder** with live preview, field search, and ready-made templates
* **Rich field set** — text, email, file upload, date, select, radio, checkbox, number, range, colour, and more
* **Reliable email delivery** via WordPress or a third-party provider (SendGrid, Mailgun, Postmark, Amazon SES, and more), with encrypted credentials and a built-in test-email tool
* **Anti-spam & security** — honeypot, CSRF tokens, IP rate limiting, minimum submission time, and reCAPTCHA v3 / Cloudflare Turnstile / FriendlyCaptcha
* **Privacy controls** — full, anonymised, or no IP storage, plus automatic submission cleanup
* **Submissions screen** — browse stored entries and export them to CSV
* **Integrations** — Zapier, Make.com, Slack, Mailchimp, Brevo, WordPress Post (with ACF support), WooCommerce, and signed custom webhooks, processed in the background
* **User registration forms** with required email verification
* **Form theming** — a brand accent colour and a light, dark, or automatic colour scheme
* **Translation-ready** — ships with German, French, and Macedonian

Formatrica does not phone home. External services are contacted only when you explicitly enable and configure them for a form — see the External services section below.

= Documentation =

Full guides, hook/filter reference, and REST API docs live at [docs.nexusplugins.com](https://docs.nexusplugins.com/products/formatrica).

== Installation ==

1. Install through the WordPress plugins screen, or upload the files to `/wp-content/plugins/formatrica`.
2. Activate the plugin through the "Plugins" screen.
3. Visit **Formatrica → Forms** to create your first form (from scratch or a template).
4. Configure email delivery in **Settings → Email** and send a test email before going live.
5. Embed the form with the `[formatrica id="123"]` shortcode or the Formatrica block.

== Frequently Asked Questions ==

= How do I send a test email? =
Open a form in the builder, click **Settings**, go to the **Email** tab, configure your settings, and click **Send test email**.

= Where are submissions stored? =
When storage is enabled, submissions are saved in the `{$wpdb->prefix}formatrica_submissions` table with full field metadata. You can browse them under **Formatrica → Submissions** and export to CSV.

= Can I create WordPress users from forms? =
Yes. Use the "User Registration" template or set the form type to "User Registration". The form creates a WordPress user and sends a verification email using the same delivery provider configured for that form. The new user must confirm their email before they can log in.

= What file types are allowed for uploads? =
By default: JPG, PNG, GIF, WebP, PDF, DOC, DOCX, and TXT. Customise this with the `formatrica_allowed_file_types` filter.

= How do I disable a form without losing its data? =
Use the **Deactivate** action in the Forms list. Deactivated forms are hidden on the front end and stop accepting submissions, but all data is kept. **Delete permanently** removes the form and its submissions and cannot be undone.

= How do I connect forms to Zapier, Make.com, or Slack? =
Open a form, go to **Settings → Integrations**, enable the integration, and paste the webhook URL. For Zapier use "Webhooks by Zapier → Catch Hook"; for Make use "Webhooks → Custom webhook".

= What data is sent to integrations? =
Integrations receive the form title, submitted field values, and field metadata; Zapier, Make.com, and custom webhooks also include the submitter's IP address and user agent. Use the `formatrica_webhook_payload` filter to customise the payload.

== Screenshots ==

1. Drag-and-drop form builder with live preview
2. Form settings with tabs: General, Email, Integrations, Security, Privacy, Advanced
3. Form templates library
4. Field editor with validation options
5. Front-end form with inline validation

== External services ==

Formatrica does not contact any external service by default. Each service below is used only when a site administrator explicitly enables and configures it for a form.

= CAPTCHA verification =

When a CAPTCHA provider is enabled, the visitor's browser loads the provider's widget and, on submission, the visitor's IP address and a verification token are sent to the provider for scoring. Providers: **Google reCAPTCHA v3** ([Terms](https://policies.google.com/terms) | [Privacy](https://policies.google.com/privacy)), **Cloudflare Turnstile** ([Terms](https://www.cloudflare.com/terms/) | [Privacy](https://www.cloudflare.com/privacypolicy/)), and **FriendlyCaptcha** ([Terms](https://friendlycaptcha.com/legal/terms/) | [Privacy](https://friendlycaptcha.com/legal/privacy-end-users/)).

= Email delivery =

When a third-party email provider is configured, each notification email (recipient, sender, subject, and the submitted form data) is sent to that provider's API. Providers: **SendGrid** ([Terms](https://www.twilio.com/en-us/legal/tos) | [Privacy](https://www.twilio.com/en-us/legal/privacy)), **SMTP2GO** ([Terms](https://www.smtp2go.com/terms/) | [Privacy](https://www.smtp2go.com/privacy/)), **Mailgun** ([Terms](https://www.mailgun.com/legal/terms/) | [Privacy](https://www.mailgun.com/legal/privacy-policy/)), **Postmark** ([Terms](https://postmarkapp.com/terms-of-service) | [Privacy](https://postmarkapp.com/privacy-policy)), **Brevo** ([Terms](https://www.brevo.com/legal/termsofuse/) | [Privacy](https://www.brevo.com/legal/privacypolicy/)), and **Amazon SES** ([Terms](https://aws.amazon.com/service-terms/) | [Privacy](https://aws.amazon.com/privacy/)). Custom SMTP and Mailpit send to your own mail server; the default WordPress provider uses `wp_mail()` with no external API call.

= Integrations =

When an integration is enabled, form submission data (form title, submitted field values, and field metadata) is sent to the configured endpoint on each submission. Zapier, Make.com, and custom webhooks also include the submitter's IP address and user agent.

* **Zapier** — Automation platform ([Terms](https://zapier.com/legal/terms-of-service) | [Privacy](https://zapier.com/privacy))
* **Make.com** — Automation platform ([Terms](https://www.make.com/en/terms) | [Privacy](https://www.make.com/en/privacy-notice))
* **Slack** — Team messaging; sends form title and field values to an Incoming Webhook (no IP or user agent) ([Terms](https://slack.com/terms-of-service) | [Privacy](https://slack.com/trust/privacy/privacy-policy))
* **Mailchimp** — Email marketing; subscribes the visitor's email and mapped fields to an audience ([Terms](https://mailchimp.com/legal/terms/) | [Privacy](https://www.intuit.com/privacy/statement/))
* **Brevo** — Email marketing; adds the visitor's email and mapped fields to a list ([Terms](https://www.brevo.com/legal/termsofuse/) | [Privacy](https://www.brevo.com/legal/privacypolicy/))
* **Custom Webhooks** — Sends a signed JSON payload to an endpoint URL you configure

Local data: submissions are stored in a custom table on your site; IP storage can be full, anonymised, or off; automatic deletion can be enabled per your retention setting; API keys and secrets are encrypted at rest and never exposed in the admin UI or REST responses.

== Changelog ==

= 1.1.3 - 2026-07-16 =
* Security: hardened form-submission authentication so unauthenticated API-style requests are rejected
* Security: the visitor IP is now read only from the trusted connection by default (configurable for sites behind a reverse proxy), preventing rate-limit evasion via spoofed headers
* Security: submission rate limiting is now atomic, and oversized submission requests are rejected before processing
* Fixed: the background integration queue is now bounded, with an admin warning if it fills (for example when WP-Cron is not running)

= 1.1.2 - 2026-07-15 =
* Fixed a submission error (500) on forms containing a radio field
* Fixed the FriendlyCaptcha widget failing to load on the public form
* Dragging a field from the palette now inserts it where you drop it
* Fixed the field-palette search freezing after a field had been dragged into the canvas
* The Hidden field gained a Value input and no longer shows Placeholder/Required options that never applied
* Stored email-delivery API keys show their placeholder again after reopening the builder (they were preserved, only looked unset)
* Fixed the form accent colour resolving to white on some themes, making the submit button and focus outlines invisible
* Fixed user-registration verification emails ignoring the site-wide email delivery provider

= 1.1.1 - 2026-07-10 =
* Two- and three-column form layouts are now free, plus a live block preview
* Submissions screen: Export CSV and mark entries read/unread
* Compact colour pickers with an inline hex field
* Fixed a fatal error that could occur on activation
* Security: hardened CSV export, error responses, and outbound webhooks (SSRF)

= 1.1.0 - 2026-07-09 =
* New field types (URL, Number, Range, Date & Time, Color) and per-field validation rules
* Brevo integration, form theming (accent colour + light/dark/auto), and email placeholders
* New Submissions screen with CSV export; new templates; German/French/Macedonian translations
* Security: authenticated AES-256-GCM encryption for stored API keys and secrets

== Upgrade Notice ==

= 1.1.2 =
Fixes a submission error (500) on forms containing a radio field, plus several form-builder fixes. Recommended for all users.
