HXFE — Code-First Forms

add_filter( 'hxfe_schemas', function( $schemas ) {
    $schemas['contact'] = [
        'id'      => 'contact',
        'to'      => 'admin@example.com',
        'subject' => 'Contact: {name}',
        'fields'  => [
            [ 'key' => 'name',  'type' => 'text',     'label' => 'Name',    'required' => true ],
            [ 'key' => 'email', 'type' => 'email',    'label' => 'Email',   'required' => true ],
            [ 'key' => 'body',  'type' => 'textarea', 'label' => 'Message', 'required' => true ],
            [ 'key' => 'hp',    'type' => 'honeypot' ],
        ],
    ];
    return $schemas;
} );

$schemas['support'] = [
    'id'        => 'support',
    'to'        => 'admin@example.com',
    'step_mode' => 'chatbot',
    'bot_name'  => 'Support Bot',
    'bot_icon'  => '🤖',
    'greeting'  => 'Hi! How can I help you today?',
    'fields'    => [
        [ 'key' => 'name',  'type' => 'text',  'label' => 'Name',
          'bot_message' => 'What is your name?' ],
        [ 'key' => 'email', 'type' => 'email', 'label' => 'Email',
          'bot_message' => 'Thanks {name}! What is your email?' ],
        [ 'key' => 'hp', 'type' => 'honeypot' ],
    ],
];

$schemas['diagnosis'] = [
    'id'        => 'diagnosis',
    // No 'to' — result shown without sending email
    'step_mode' => 'chatbot',
    'complete_html_rules' => [
        [ 'when' => ['plan', '==', 'basic'],
          'html' => '<h3>Basic plan recommended</h3><p>Hi {name}!</p>' ],
        [ 'when' => 'default',
          'html' => '<p>Thank you, {name}. We will be in touch.</p>' ],
    ],
    'fields' => [ ... ],
];

// functions.php — one line
require_once get_template_directory() . '/inc/hxfe-forms.php';

Changelog

1.3.7

• Security: Removed skip_sanitize parameter from hxfe_process_fields() — all values are now sanitized on every call, including confirm→submit flow
• Security: Clarified that sanitize_text_field() and related functions are idempotent, so re-sanitizing already-sanitized values is safe

1.3.6

• Security: Added nonce verification to hxfe_handle_back() to prevent unauthorized form re-rendering
• Security: Back button now passes hxfe_nonce (hxfe_validate_{form_id}) via hx-vals
• Code: Clarified skip_sanitize=true comment in hxfe_handle_submit() to explain double-sanitize prevention

1.3.5

• Renamed schema key: redirect_rules → complete_redirect_rules (consistent with other complete_* keys)
• Renamed schema keys: before_open_html / after_close_html → before_html / after_html
• Renamed field keys: min_check / max_check → min / max (consistent with min_date / max_date)
• Deprecated field key hide_if — use show_if instead (backward compatible, will be removed in a future version)

1.3.4

• Added: Page slug auto-injected into subject as [form-id@slug] for per-page tracking
• Added: Schema examples panel in admin UI with 7 copy-paste samples
• Added: Responsive breakpoint at 768px
• Added: CSS custom properties (design tokens) for easy theme customization
• Added: download_url / download_label schema keys — download button on complete screen
• Added: available_from / available_until schema keys — form availability window
• Added: before_html / after_html schema keys — custom messages outside window
• Added: allowed_origins schema key — per-form iframe CORS restriction
• Added: Embed HTML <iframe> copy button in admin form list
• Improved: Admin UI redesigned — stat cards, clean table, monospace field type chips
• Improved: chatbot send button replaced with paper-plane SVG icon
• Improved: Login/auth screen with border, padding, full-width button
• Improved: iframe / CORS Settings tab removed — now schema-level only
• Fixed: hx-encoding=”multipart/form-data” auto-applied when file field present
• Fixed: File name shown correctly on confirm screen
• Fixed: File attachment preserved through confirm → submit flow
• Fixed: Temporary file cleanup cron (hourly, 1h expiry)
• Fixed: Fade-in flash bug (remove+reflow caused visible flicker)
• Added: complete_html_rules schema key — conditional complete screen HTML (supports {field_key} interpolation)
• Added: Diagnosis/calculator mode — omit to with complete_html_rules for no-email chatbot
• Added: chatbot + show_if / required_if conditional fields now fully supported
• Improved: chatbot UI redesigned with LINE/Slack-style header, timestamps, and bubble shadows
• Added: pattern / minlength / maxlength / error_message schema keys for field-level validation
• Added: hxfe_validate_field filter for per-field custom validation
• Added: hxfe_validate_form filter for cross-field validation (password confirm, at-least-one, etc.)
• Added: before_html / after_html schema keys for injecting HTML around fields
• Added: disable_context schema key to opt out of page slug auto-injection

1.3.3

• Renamed: SHFE → HXFE across all PHP/JS/CSS (class names, IDs, function prefixes)
• Fixed: Scroll after htmx outerHTML swap (re-fetch element by ID after swap)
• Fixed: Step form Back button returning 403 (nonce was missing from hx-vals)
• Fixed: chatbot phpcs:ignore comment appearing as visible text in UI
• Fixed: Copy button fallback for HTTP environments (execCommand)
• Changed: Shortcode copy buttons labeled “Form” / “iFrame” for clarity

1.3.2

• Added: IP restriction — whitelist IPs and CIDR ranges per form (allowed_ips)
• Added: Customizable IP blocked message (ip_blocked_html)
• Added: Form-level password authentication (auth.users)
• Added: Brute-force protection — lockout after 5 failed attempts (15 min)
• Added: Auth session via secure httponly samesite=strict cookie
• Added: Login form labels fully customizable per form
• Added: Support for wp-config.php constants as password source (keeps secrets out of Git)

1.3.1

• Security: file field now uses HXFE’s own safe MIME whitelist by default instead of WordPress defaults
• Security: added .htaccess to hxfe-uploads/ directory to prevent PHP execution
• Added: file field type now works — uploaded files are attached to admin notification emails
• Added: includes/file-upload.php with wp_handle_upload() based processing
• Added: mime_types schema key to whitelist allowed MIME types server-side
• Added: temporary files are automatically deleted after email is sent
• Removed: lint warning about file field being unimplemented

1.3.0

• Refactored: extracted field renderer functions to includes/fields/field-renderers.php
• Refactored: added hxfe_validate_step_request() to DRY up step endpoint gate logic
• Refactored: improved PhpDoc type definitions on core functions (hxfe_process_fields, hxfe_eval_condition, hxfe_interpolate)

1.2.2

• Fixed: confirm_label now correctly applies to the input form submit button
• Fixed: hxfe-front.js (scroll, focus, loading state) was not enqueued
• Fixed: disable_default_css and custom_css now work correctly
• Fixed: chatbot.js is now only loaded on pages with chatbot forms
• Fixed: uninstall.php now removes all plugin settings from the database
• Added: error_message schema key to customize the validation error summary text
• Added: confirm_label schema key (separate from submit_label for clarity)
• Note: file field type renders HTML but file saving is not yet implemented

1.2.1

• Added tel and url field types with built-in validation
• Added Webhook support (Zapier, Make, Slack, custom HTTP endpoints)
• Added label customization: submit_label, back_label, next_label, confirm_heading
• Fixed confirmation screen: radio/select now shows label instead of value
• Fixed confirmation screen: checkbox_group shows comma-separated labels
• Fixed confirmation screen: hidden fields (show_if=false) are now excluded
• Fixed mail body: empty fields and hidden fields are now excluded
• Added confirm: false support for step forms
• Added built-in placeholders: {site_name}, {site_url}, {date}, {time}
• Added admin form list page with lint warnings and shortcode copy buttons
• Strengthened schema lint: all 15 field types, cascade_from, chatbot bot_message
• Added wp_mail() failure logging when WP_DEBUG is enabled

1.2.0

• Added field types: radio, checkbox_group, number, date, file
• Added chatbot UI mode (step_mode: chatbot) with typing animation
• Added 4 completion patterns: message, custom HTML, redirect, redirect_rules
• Added default values (value key on any field)
• Added multiple recipients (to as array)
• Added confirm: false for immediate submission
• Added cascade select (cascade_from / cascade_options)

1.1.0

• Added step forms (groups and one_by_one mode)
• Added reCAPTCHA v2 and v3
• Added privacy policy field
• Added auto-reply email
• Added SMTP configuration (Gmail, SendGrid, Mailgun, custom)
• Added iframe embedding with CORS support
• Added conditional logic (show_if, required_if, skip_if, to_rules, subject_rules)
• Added CSS customization options

1.0.0

• Initial release
• Schema-driven form rendering
• htmx-powered input → confirm → complete flow
• Admin notification email and auto-reply
• Honeypot spam protection