=== FormForge ===
Contributors: avakodeforge
Donate link: https://avakode.com
Tags: forms, form-builder, ai, conditional-logic, contact-form
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.31
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Drag & drop form builder with conditional logic, webhooks, file uploads, anti-spam, and CSV export. Unlimited forms, 22 field types.

== Description ==

**Form Forge** is a fast, modern form builder. Build unlimited forms with a drag-and-drop builder, 22 core field types, conditional logic, generic webhooks, file uploads, anti-spam, and submissions with one-click CSV export — all in the free plugin, no form caps. Start from 168 ready-made templates or the included shortcode. Upgrade to Pro for AI form generation, payments, multi-step, and branded integrations.

= Free =
* Unlimited forms (no form caps)
* 22 core field types (text, email, number, select, checkbox, radio, file upload, etc.)
* Drag-and-drop form builder
* Conditional logic
* Generic webhooks (Zapier, Make, n8n, custom APIs)
* File uploads
* Anti-spam (honeypot, time-trap, and Google reCAPTCHA v3 with your own keys)
* Address field with map and geocoding (your own Google or Yandex key)
* Appointment picker with locally generated time slots
* Submissions dashboard + CSV export
* 168 ready-made templates (contact, registration, survey, booking, etc.)
* Shortcode embedding ([formforge id="X"])
* Email notifications (admin + autoresponder)
* Mobile-first responsive layouts

= Form Forge Pro =

Pro is a separate add-on plugin, distributed from https://formforgewp.com and not
included in this download. Everything listed above is part of this plugin and
works without it.

* AI form generation (describe → done)
* Multi-step forms with progress bar
* Conversational mode (Typeform-like one-question-at-a-time)
* Stripe payments
* Mailchimp / HubSpot / Google Sheets integrations
* Telegram / WhatsApp / Slack / Discord notifications
* Live Google Calendar availability and event creation
* Submission analytics and abandonment recovery

Part of the **Forge Suite** — bundle includes Lang Forge, Rank Forge, Field Forge.

== Third-Party Services ==

Form Forge connects to the following third-party services. Each is optional and is contacted only when you add the relevant field type or enable the relevant integration.

* **Avakode API** (https://avakode.com) — powers AI form features and validates your license; sends your site URL, license key, and the relevant form data only when you use an AI action. Terms: https://avakode.com/terms — Privacy: https://avakode.com/privacy
* **Google reCAPTCHA** — only if you enable reCAPTCHA in the settings and supply your own site and secret keys; the visitor's token is verified at https://www.google.com/recaptcha/api/siteverify on form submission. Terms: https://policies.google.com/terms — Privacy: https://policies.google.com/privacy
* **Stripe** — only if you add a Stripe payment field; `js.stripe.com` is loaded so card details are collected directly by Stripe (never stored on your site). Terms: https://stripe.com/legal — Privacy: https://stripe.com/privacy
* **Google Maps JavaScript API** — only if you add a map/address field using Google Maps; https://maps.googleapis.com is loaded to render the map. Terms: https://cloud.google.com/maps-platform/terms — Privacy: https://policies.google.com/privacy
* **Google Sheets API** — only if you enable the Google Sheets integration; https://apis.google.com is loaded to authorise access to your sheet. Terms: https://policies.google.com/terms — Privacy: https://policies.google.com/privacy
* **Yandex Maps & Geocoder** — only if you choose Yandex as the map provider; `api-maps.yandex.ru` and `geocode-maps.yandex.ru` are contacted to render the map and geocode addresses. Terms: https://yandex.com/legal/maps_termsofuse/
* **Anonymous usage analytics (opt-in, OFF by default)** — Only if you explicitly opt in from the Form Forge settings, the plugin sends anonymous product-usage telemetry to the Avakode API (https://avakode.com/telemetry): a random install ID (UUID, not tied to your site URL or any account), your bucketed WordPress and PHP version ranges, the plugin version, and aggregate feature-usage event counters. It is sent ONLY after you opt in and can be disabled at any time. It never sends your site URL, email address, post or form content, or license key. Privacy: https://avakode.com/privacy

== Installation ==

1. Upload `formforge` to `/wp-content/plugins/`, or install via Plugins → Add New.
2. Activate the plugin.
3. Go to **Form Forge → All Forms → New Form**.
4. Drop the shortcode (e.g. `[formforge id="1"]`) anywhere on a page or post.

== Frequently Asked Questions ==

= Can I import forms from Gravity Forms / WPForms? =

Migration tooling is on the roadmap. For now, the AI generation can recreate a form from a screenshot or description.

= Are webhook URLs validated for security? =

Yes — Form Forge rejects webhook URLs that resolve to private IP ranges (RFC1918), loopback, or cloud-metadata endpoints. The check uses `is_safe_url()` (per-plugin) and `Forge_Net` (shared SSRF helper).

= How does anti-spam work? =

Free tier ships honeypot + time-trap (form submitted in < 2s is rejected). Pro adds optional integrations with Cloudflare Turnstile and reCAPTCHA.

= Does Form Forge track abandoned (unsubmitted) forms? =

Abandonment tracking is a Pro feature; the free plugin does not collect any abandoned-form data. When enabled in Pro, it defaults to metadata-only: it records which fields a visitor interacted with (for funnel analytics) but stores no field values, no IP address, and no user agent. Storing the partial values a visitor typed, along with their IP and user agent, is a separate per-form opt-in ("capture values") that is OFF by default. If you enable value capture, disclose it in your site's privacy policy.

== Screenshots ==

1. Form builder (drag-drop)
2. AI form generator (Pro)
3. Conditional rules applied at submit (configured via import or AI)
4. Submissions list + CSV export
5. Notification configuration

== Changelog ==

= 1.0.31 =
* Google reCAPTCHA v3 is no longer behind a licence. It runs on your own reCAPTCHA keys and talks directly to Google, so gating it was withholding built-in functionality.
* The address field with map and geocoding is likewise unrestricted — it uses your own Google or Yandex key and never touches our servers.
* The appointment picker now generates its time slots on any install. Overlaying real busy times from a connected Google Calendar still needs the separate Pro add-on, which holds the OAuth application.
* Removed licence checks that could never fail, on conditional logic, file uploads and webhooks. Those have been free for some time, but the code still asked and the admin screens still showed a PRO badge.
* Availability of add-on features is now decided by whether the add-on is installed, not by a licence call.

= 1.0.30 =
* Security hardening: all dynamic output is now escaped late at the output site with the context-appropriate function (esc_html/esc_attr/esc_url, esc_html__ for translated strings used as format strings, and wp_kses for trusted pre-built admin/field markup). No behavioural changes.

= 1.0.29 =
* Pro-only features (Post Submission, User Registration, multi-step forms, conversational mode, repeater and calculation fields) are now provided entirely by the Form Forge Pro add-on and are no longer bundled in the free plugin — the free download contains only fully-functional free features.
* Removed the leftover form-count limit scaffolding; the free plugin has always supported unlimited forms.

= 1.0.28 =
* Uninstall cleanup now removes transients only under the plugin's own unambiguous prefix, so unrelated transients belonging to other plugins are never deleted.

= 1.0.24 =
* New: Support menu item that opens the Avakode support dashboard.
* New: Opt-in anonymous usage analytics (OFF by default) — see Third-Party Services.
* New: Contextual, dismissible Pro feature tips on the plugin dashboard (Free users only).


= 1.0.21 =
* Hardened inline admin script output (field-mapping editors).
* WordPress.org compliance and code-quality improvements.

= 1.0.20 =
* Fix: AI form generation now shows a clear reason when it can't run (license/credits needed, or the service is unreachable) instead of a generic "Unknown error".

= 1.0.19 =
* Security: the Google Account connection now starts via a one-time token, so the license key is never placed in a URL.

= 1.0.18 =
* WordPress.org compliance and licensing hardening.
* Pro entitlement is now resolved by the Form Forge Pro add-on; the free plugin bundles no licensing SDK.
* The Google integration SDK now loads only when the Pro Google Sheets feature is active.
* readme metadata cleanup.

= 1.0.0 =
* Initial release.

== Upgrade Notice ==

= 1.0.24 =
Adds a Support menu, optional anonymous analytics (off by default), and dashboard Pro tips.


= 1.0.21 =
Security hardening and WordPress.org compliance improvements.

= 1.0.18 =
Licensing and WordPress.org compliance improvements.

= 1.0.0 =
Initial release.
