LHAS

<p>LW Simple Forms is a versatile WordPress form plugin that allows you to create customizable forms. It supports the Japanese-style workflow of a complete form submission process:</p>
<ol>
<li>Input screen – Users enter their information</li>
<li>Confirmation screen – Users review their input before submitting</li>
<li>Completion screen – Thank you message after successful submission</li>
</ol>
<p>The plugin also supports a simpler one-step submission process when confirmation is not needed.</p>
<p>A sample form with all supported field types is automatically created on first activation, so you can get started right away.</p>
<p><strong>Important: Cache Plugin Compatibility</strong><br />
If you are using a caching plugin (e.g., WP Super Cache, W3 Total Cache, WP Total Cache, LiteSpeed Cache) or a CDN (e.g., Cloudflare), form submissions may not work correctly because cached pages do not process POST data. Please exclude the form page URLs (input, confirmation, completion, error) from caching.</p>
<p><strong>CSS Styling</strong><br />
This plugin does not include any frontend CSS for form display. You are expected to style the forms using your own theme’s stylesheet. HTML/CSS samples are available for reference on the plugin’s website.</p>
<h3>Development Concept</h3>
<ul>
<li>
<p><strong>HTML-First Approach</strong>: This plugin is designed to faithfully reproduce your designed HTML forms, confirmation screens, and error screens without forcing you to adapt to plugin limitations. The forms conform to your design, not the other way around.</p>
</li>
<li>
<p><strong>Built for Web Professionals</strong>: LW Simple Forms does not provide CSS or HTML templates for the frontend. It’s specifically created for web designers and developers who already have designed their form screens and need a way to implement the functionality. (HTML/CSS samples are available for reference.)</p>
</li>
<li>
<p><strong>Minimalist Philosophy</strong>: This plugin intentionally maintains a minimalist approach, focusing on core functionality rather than excessive features. We prioritize site speed and minimal data usage to keep your websites running efficiently.</p>
</li>
</ul>
<h3>Key Features</h3>
<ul>
<li><strong>Complete Form Workflow</strong>: Create forms with input screen, error screen, confirmation screen, and completion screen</li>
<li><strong>Flexible Design</strong>: Customize each screen with your own HTML</li>
<li><strong>Form Validation</strong>: Server-side and client-side validation for each input field (required fields, email format, phone number validation)</li>
<li><strong>Email Notifications</strong>: Send confirmation emails to both administrators and users</li>
<li><strong>Security Features</strong>: CSRF protection, data sanitization, input validation, and secure data handling</li>
<li><strong>Multiple Field Types</strong>: Support for text fields, text areas, checkboxes, radio buttons, select menus, and multi-select menus</li>
<li><strong>Shortcode Support</strong>: Easy integration into WordPress pages via shortcodes</li>
<li><strong>Custom HTML</strong>: Design your forms with complete HTML freedom</li>
<li><strong>Multi-Form Support</strong>: Create and manage multiple forms on a single site</li>
<li><strong>Database Storage</strong>: Form data is temporarily stored in the database rather than in sessions or cookies, allowing for unlimited submission data</li>
<li><strong>JavaScript/No-JavaScript Support</strong>: Forms work properly even in environments where JavaScript is disabled (e.g., screen readers)</li>
<li><strong>Field Validation</strong>: Extensive validation system with customizable error messages</li>
<li><strong>reCAPTCHA v3 Support</strong>: Optional Google reCAPTCHA v3 integration for spam protection</li>
<li><strong>Duplicate Submission Prevention</strong>: PRG (Post-Redirect-Get) pattern prevents duplicate form submissions on page reload</li>
<li><strong>Security Measures</strong>: Protection against common vulnerabilities including CSRF attacks and header injection</li>
</ul>
<h3>Usage Guide</h3>
<ol>
<li>Design and create the HTML for input screen, confirmation screen, and completion screen</li>
<li>Register each screen as a WordPress page</li>
<li>Create a new form from “Forms” in the WordPress admin panel</li>
<li>Configure each section. You can configure the following:
<ul>
<li>HTML for each screen (input, confirmation, completion)</li>
<li>URL for each screen</li>
<li>Administrator email settings</li>
<li>User email settings</li>
<li>Validation settings (required fields, email format, phone number validation)</li>
</ul>
</li>
<li>Use the “Parse HTML” button to automatically extract form fields from your input screen HTML</li>
<li>Add the appropriate shortcodes to your pages</li>
<li>Test the form operation before going live</li>
</ol>
<p>Note: This plugin is designed to give you maximum freedom in writing form HTML, so you need to write the HTML for your form pages yourself. The plugin does not provide CSS or images for form display. HTML samples are available for reference.</p>
<h3>Supported Input Fields</h3>
<ul>
<li><code><input type="text"></code></li>
<li><code><input type="tel"></code></li>
<li><code><input type="email"></code></li>
<li><code><input type="radio"></code></li>
<li><code><input type="checkbox"></code></li>
<li><code><textarea></code></li>
<li><code><select></code></li>
<li><code><select multiple></code></li>
</ul>
<h3>Form Screen Placeholders</h3>
<p><strong>Input Screen:</strong><br />
* Use <code>[lwsf_value_fieldname]</code> to display previously entered values<br />
* Use <code>[lwsf_error_fieldname]</code> to display validation error messages<br />
* Use <code>[lwsf_send]</code> for the submit button</p>
<p><strong>Confirmation Screen:</strong><br />
* Use <code>[lwsf_confirm_fieldname]</code> to display submitted values<br />
* Use <code>[lwsf_back]</code> for the back button<br />
* Use <code>[lwsf_send]</code> for the submit button</p>
<p><strong>Completion Screen:</strong><br />
* Use <code>[lwsf_field_fieldname]</code> to display submitted values</p>
<h3>Email Settings</h3>
<p><strong>Available placeholders for email templates:</strong><br />
* <code>[lwsf_field_fieldname]</code> – Display submitted form data<br />
* <code>[lwsf_site_admin_email]</code> – Display site admin email<br />
* <code>[lwsf_site_name]</code> – Display site name<br />
* <code>[lwsf_site_home_url]</code> – Display site URL</p>
<h3>Additional Information</h3>
<ul>
<li>
<p>For items that allow multiple selections (<code><input type="checkbox"></code>, <code><select multiple></code>), you need to add [] to the name attribute.<br />
Example:</p>
<ul>
<li>For checkboxes: <code><input type="checkbox" name="services[]" value="ServiceA"> Service A <input type="checkbox" name="services[]" value="ServiceB"> Service B</code></li>
<li>For select multiple:<br />
<code><select id="products" name="products[]" multiple size="4"><br />
<option value="ProductA">Product A</option><br />
<option value="ProductB">Product B</option><br />
</select></code></li>
</ul>
</li>
<li>
<p>Works in environments where JavaScript is disabled, such as screen readers</p>
</li>
<li>The outputted source code uses entity references for security measures and stable operation</li>
<li>Includes Japanese language files (UTF-8 only)</li>
<li>Avoids using reserved WordPress query variable names for form fields to prevent conflicts</li>
<li><strong>PHP Compatibility</strong>: Requires PHP 7.4 or higher. Tested on PHP 7.4 and PHP 8.3.</li>
</ul>
<h3>Data Storage and Security</h3>
<ul>
<li>Form submissions are temporarily stored in the WordPress database (prefix_lwsf_form_data table)</li>
<li>Data is automatically cleaned up after 1 hour</li>
<li>All user inputs are sanitized before processing</li>
<li>CSRF protection is implemented on all form submissions</li>
<li>Email headers are validated to prevent header injection</li>
</ul>
<h3>Why This Plugin Was Created</h3>
<p>This plugin was created because MW WP Form, which had been used for client work for many years, ended development. There was a need for a form plugin with confirmation screens that operated cleanly. The plugin was created primarily for web development work, and we thought many web development companies might have similar needs.</p>
<h3>Future Implementation Plans</h3>
<ul>
<li>The ability to change validation error messages</li>
<li>PHP-based validation hooks that operate before and after form submission</li>
<li>Additional validation types (URL, numeric values, custom regex patterns)</li>
<li>Hooks to trigger at important timings such as just before and just after email sending</li>
<li>File upload handling</li>
</ul>
<h3>Privacy Policy</h3>
<p>This plugin stores form submission data in the WordPress database (prefix_lwsf_form_data table) for the purpose of displaying confirmation and completion screens. Data is automatically deleted after 1 hour.</p>
<p>When enabled, user email addresses may be used to send confirmation emails to form submitters.</p>
<p>When reCAPTCHA v3 is enabled, form submission data (reCAPTCHA token and user’s IP address) is sent to Google’s reCAPTCHA verification API (https://www.google.com/recaptcha/api/siteverify) for spam detection. Please refer to <a href="https://policies.google.com/privacy" rel="nofollow ugc">Google’s Privacy Policy</a> and <a href="https://policies.google.com/terms" rel="nofollow ugc">Terms of Service</a> for details on how Google handles this data. No other data is shared with external services.</p>


LW Simple Forms

A flexible form plugin that implements the flow of input → confirmation → completion screen, while also supporting simple one-step submissions.

alesas

<p>Sobi Forms is a lightweight contact form plugin built for speed and simplicity. Create multiple forms, embed them anywhere with a shortcode or Gutenberg block, and keep your front-end lean.</p>
<p>Learn more on the official site: <a href="https://sobiforms.com" rel="nofollow ugc">sobiforms.com</a> — features, FAQ, and the <a href="https://sobiforms.com/roadmap/" rel="nofollow ugc">public roadmap</a>.</p>
<p><strong>Performance-first front-end</strong></p>
<ul>
<li>Vanilla JavaScript on the front-end</li>
<li>~3.7 KB CSS + JS combined (gzipped transfer; ~13.3 KB unminified source on form pages)</li>
<li>Assets enqueue only when a form is rendered on the page – zero impact on other pages</li>
<li>Script loaded in the footer with <code>defer</code> strategy (WordPress 6.3+)</li>
<li>No global front-end CSS frameworks</li>
</ul>
<p><strong>Form builder (admin only)</strong></p>
<ul>
<li>Redesigned editor for more comfort — form canvas on the left, settings sidebar on the right; save without a full page reload</li>
<li>Lucide icons in the admin builder and submissions inbox (modern, consistent UI)</li>
<li>Document-first drag-and-drop editor (React via WordPress <code>wp-element</code>, loaded only on the form edit screen)</li>
<li>Field types: text, email, link (URL), textarea, phone, number, select, multiple choice (radio tiles), multi-option checkbox, <strong>file upload</strong>; layout blocks: title (section heading), paragraph (instructions)</li>
<li>URL prefill: optional per-field URL parameter to pre-populate scalar fields from query strings (client-side; cache-friendly)</li>
<li>Hidden fields: compact sidebar table to pass invisible data (URL params and/or static defaults); invisible on the front; always submitted; visible in inbox</li>
<li>File upload: one file per field; admin picks allowed types by category (Application, Image, Text) or individual extensions; private storage under <code>uploads/sobiforms/</code>; download from the Submissions inbox (admin only). <strong>Save to database</strong> is required when a form includes a file field</li>
<li>Field settings: number min/max; text min/max characters; show/hide label; textarea resize and max length; file max size (default 5 MB, capped by server)</li>
<li>Radio and multi-checkbox options edited inline in the builder (add option, remove on hover); dropdown options in the field menu</li>
<li>Multiple recipient emails per form</li>
<li>After submit: inline success message or redirect to a published page</li>
<li>Availability: pause a form, auto-close at a date/time, or after a set number of submissions, with a visitor message when closed</li>
</ul>
<p><strong>Embedding</strong></p>
<ul>
<li>Shortcode: <code>[sobiforms id="3"]</code> or <code>[sobiforms slug="contact"]</code> (ID or slug required; slug is fixed after creation)</li>
<li>Gutenberg block: <strong>Sobi Forms Contact</strong> with form picker</li>
<li>Works with any page builder that supports shortcodes or blocks</li>
</ul>
<p><strong>Submissions</strong></p>
<ul>
<li>Email notifications via <code>wp_mail()</code> (HTML)</li>
<li>Optional visitor confirmation email — simple thank-you receipt to the submitter (per form, Notifications sidebar)</li>
<li>Per-form delivery — email notifications and/or database storage (new forms default to inbox storage)</li>
<li>Inbox with read/unread, starred, spam queue, admin notes, search and filters; split list + detail layout with resizable columns; <strong>All / Unread / Starred</strong> view tabs and per-form filter in the list header</li>
<li>Submission source page — frozen page title and pathname at submit time in the detail sidebar (no query string; use hidden fields for UTM/campaign params)</li>
<li>Dashboard widget on the WordPress admin home — recent unread submissions at a glance</li>
<li>Optional Akismet spam filtering (when the Akismet plugin is active)</li>
<li>Honeypot, nonce verification, rate limiting (5 submissions/hour per hashed IP)</li>
</ul>
<p><strong>Security</strong></p>
<ul>
<li>Nonce on every submission</li>
<li>Honeypot field</li>
<li>Server-side field validation against a strict JSON schema</li>
<li>Capability checks and nonces on all admin actions</li>
<li>Optional Akismet integration — spam submissions quarantined when the Akismet plugin is active</li>
<li>File uploads — server-side MIME validation; upload directory hardened on Apache (direct HTTP access denied); admin-only download with path verification</li>
</ul>
<h3>Privacy Policy</h3>
<p>Sobi Forms processes data submitted through your forms. Per form you choose how submissions are delivered:</p>
<ul>
<li><strong>Email notifications</strong> – when enabled and recipient addresses are set, field values are sent via <code>wp_mail()</code>.</li>
<li><strong>Visitor confirmation</strong> – when <strong>Visitor email confirmation</strong> is enabled, the submitter may receive a simple thank-you at the address from the selected email field (no submitted field values in that email).</li>
<li><strong>Database storage</strong> – when <strong>Save to database</strong> is enabled (default for new forms in the builder), submissions are saved in custom tables on your site (<code>wp_sobiforms_submissions</code>, <code>wp_sobiforms_forms</code>). Each form has its own retention setting (auto-delete after N days). You can use inbox-only delivery with no email.</li>
<li><strong>Hashed IP</strong> – when storage is enabled, a one-way SHA-256 hash of the visitor IP is stored with each submission for abuse prevention. Raw IP addresses are not stored.</li>
<li><strong>Rate limiting</strong> – a transient keyed by hashed IP limits submissions to 5 per hour. Transients expire automatically.</li>
<li><strong>Admin notes</strong> – internal notes on submissions are stored in your database and never shown on the front-end or included in emails.</li>
<li><strong>No tracking</strong> – Sobi Forms does not connect to third-party analytics or advertising when processing form submissions.</li>
<li><strong>Optional Akismet</strong> – if you enable Akismet spam filtering and the Akismet plugin is active, submission content may be sent to Akismet’s service for spam checks.</li>
<li><strong>No data sent to the plugin author</strong> – form submissions stay on your server and mail server. The <strong>Feedback</strong> settings tab links to the WordPress.org support forum and <a href="https://sobiforms.com/roadmap/" rel="nofollow ugc">sobiforms.com/roadmap</a> only if you choose to open them.</li>
</ul>
<p>Site owners are responsible for their privacy policy and lawful basis for collecting visitor data.</p>
<h3>Licenses for Third-Party Resources</h3>
<p>This plugin bundled resources covered by their own respective licenses:<br />
* Lucide Icons – https://lucide.dev<br />
  License: ISC (https://lucide.dev/license)<br />
  Copyright (c) Lucide Contributors</p>


Sobi Forms

Lightweight form builder with inbox, shortcode, Gutenberg block, and vanilla AJAX.

LW Simple Forms vs Sobi Forms