HolmesPortfolio Forms

Changelog

1.0.0

Builder

• Drag-and-drop builder with a grouped component palette (collapsible, closed by default), page tabs and a right-hand options panel.
• Undo / Redo, Save and Save-and-continue, and saved multi-field blocks you can delete.
• One HolmesPortfolio look across every admin screen.
• A “?” by every field, setting and the variables area opens a short explanation with a “Read more” link into the user guide.
• Form tutorial: one button on the Forms list opens a practice form with short, hands-on topics. They cover your first form, kinds of question, groups, labels and hints, lists of choices, dates and times, numbers and units, addresses, files, show/hide rules, pages, calculations with two worked examples, hidden fields, emails, thank-you messages, HTML and tokens, publishing, entries, settings, backups and saved blocks. Nothing on the practice form is saved unless you press Save. Save asks you first, because it makes a real form.
• Saved blocks: pick from a searchable box and press Insert. Three come built in and start locked: “Privacy notice”, “Terms and conditions” and “Customer contact” (name, email, phone). The first two have placeholder wording the builder flags for replacement. Settings decides which built-ins appear. To save a whole group, right-click it and choose Save as a block.
• Version history keeps the last 30 saves, each with the person, the time and a note. Restore an earlier version, delete one, or compare any two.
• Version history keeps backslashes, such as those in a Windows file path, however often the form is saved.
• The builder checks the markup in every HTML box, such as a notice’s text or an email body. The check accepts a link with a query string, such as ?a=1&b=2.
• A form open in the builder is locked to one editor. Another editor sees who has it and can take over.
• Saving a form with a Data Name that belongs to a built-in token, or that another question already uses, renames it with a number on the end and tells you. Form check warns first, and imported forms are checked the same way.
• Deleting, duplicating, exporting, restoring a version, taking over a lock and importing over a form all check the same per-form access as saving it.
• The builder accepts a repeatable group’s answer token, so one form can have both a repeatable group and an Answers summary.

Fields

• Text: input mode, character limits, a pattern check, an optional “must match another field” check for confirm-email pairs, and a default value.
• Email questions spot likely typos in common addresses, such as sam@gmial.com. When the visitor leaves the box, a line asks “Did you mean sam@gmail.com?” with a button to use it. A confirm email box never shows the line, because typing the address twice is its job. It’s only a suggestion and never stops the form being sent. The check runs in the visitor’s browser and sends nothing anywhere.
• Text area: word limit with a live counter, resizable on the front end, and a default value.
• Radio, checkbox (stacked or side by side, with optional fewest and most selections), dropdown and slider.
• Date: format, allowed range, a default such as “today” or “today + 20 workdays”, and a check against another date field (on or after, on or before, a minimum gap, or within a number of days).
• Time: one box for a time like 09:30, 24-hour by default, with an optional earliest and latest time.
• Measurement: a length, weight, volume, area or temperature. The visitor picks the unit, such as feet and inches or centimetres. Formulas and rules get the answer in one unit you choose.
• Numbers and money: a text input in Number mode takes a unit after the box, decimal places and a lowest and highest value. Money mode puts £, € or $ in front and keeps 2 decimal places.
• Address: line 1, town and postcode, with the postcode checked against the UK format. Optional line 2, county and country follow the field’s own required setting and have their own error messages. Save / Change address, and an optional Find address postcode lookup.
• File attachments: PDF, JPEG, PNG and BMP, checked by real content, with size and count limits. Files are emailed and not kept with the entry. They wait on your site only until their emails have gone. A note when you add the field, and a line on the notification email, cover safe handling.
• When a visitor adds too many files to a one-file upload, the message reads “You can attach 1 file.”
• Alert notices (notification banner, inset text, warning or error) with an optional confirmation tick.
• Hidden fields (fixed value, another field, calculation, URL or user), navigation buttons, email actions and the submit message.
• Read only: text, text area, dropdown, radio, checkbox and date can show their value greyed out and still submit it. A read-only box never keeps anything the visitor’s browser posted. The server puts its own value back on submit, so editing the page can’t change it.
• Radios, checkboxes and dropdowns can pre-select an option when a matching word appears in the page’s query string. The query string is kept for the whole form, so this works on later pages too.
• Every field takes a width, a “*” / “(optional)” marker and custom error messages, and can change its type in place.
• A hint can run to several lines and hold a link.
• Groups: a plain Group and a Conditional group shown or hidden by a rule. A group’s optional title is a real heading, and answers are grouped under it on the check-your-answers step and in emails. Groups are optional: questions work the same in or out of one.

Logic and pages

• Multi-page forms with page rules, computed variables and show/hide rules on fields.
• Rules that test a choice on the same page work in the browser. A notice with an answer in its text still waits for the server. Other rules are checked on the server as soon as a field they depend on changes, and on every page move. Every rule is checked again at submit.
• When a question appears or is hidden, the form tells screen readers which one. Under a browser rule, a hidden question or notice stays in the page, hidden. Under a server rule, it leaves the page.
• A Back button appears whenever there’s a previous page. It keeps what was typed on the page without checking it. Only Continue checks a page and saves its answers. The browser’s own Back and Forward buttons do the same.
• A page opened from Check your answers has a Back button that returns there and drops the edit. Continue saves the edit and returns there too, after any new question the change needs. Send only sends the answers Check your answers showed. If they changed in the meantime, the page shows again with a message.
• On a form with more than one page, the browser tab’s title changes with each step. It names the page and the step, such as “The fault – Step 1 of 3 – Report a repair”. Check your answers has its own step in the title too. A one-page form keeps its usual title until it’s sent.
• After a form is sent, the browser tab’s title names the thank-you message instead of the last step. It starts with the message’s heading, or “Form sent” when there’s no heading, then the page’s usual title.
• A question can be set to clear its answer whenever Continue changes an answer on another page, so a declaration tick box on Check your answers only ever stands for the answers the visitor saw when they ticked it.
• Working days skip the days outside your working week and the UK bank holidays you pick in Settings. A form can pick its own bank holidays. The Freedom of Information starter leaves out bank holidays in every part of the UK, to follow the Freedom of Information Act 2000’s definition of a working day, as we understand it.
• Visitors with JavaScript turned off see a message by default. A setting lets them fill forms in without it instead.
• The plugin’s stylesheet decides what a form shows when JavaScript is off. A small script in the page head marks the page when JavaScript runs. No style tags are printed in the form.
• An add-on can check each page as the visitor presses Continue, with the holmesforms_validate_page_errors filter. A problem then shows on the page it belongs to.

Answers, emails and export

• A confirmed alert reads Yes / No. A multi-select checkbox lists each option with Yes or No. A radio shows only the chosen option.
• The check-your-answers page keeps every question, blank if unanswered. Emails leave blank questions out. The CSV has a column for every question in the form.
• A question label ending in a question mark drops it when it labels an answer, in emails, the check-your-answers page and the entry view.
• Email actions: To / CC / BCC with one-click chips for the form’s email fields, and a From name that defaults to the form title.
• Each action has a switch for whether uploaded files go with it. It’s on by default. Turn it off for an action whose recipient doesn’t need them, such as the visitor’s confirmation. An email that carries files adds a short safe-handling line.
• The email body is written in a line-numbered editor that checks the markup and [tokens] before it saves. [all-fields] / [all-data] expand to a clean list of answers.
• When a new question is missing from an email that lists answers one by one, the builder offers to add its line.
• Settings “Email appearance” adds a header and a footer to every email. A developer can add CSS to emails with a filter, which is applied after the Email look settings.
• The “Fill in the basic example” button on Settings, Email can be translated, along with its confirm box and the footer line it adds.
• An Email look panel on the Email tab sets the colours, font, text size and width of every email, with a colour picker for each colour, a rough preview and a Back to the default look button. Text, headings and links need a contrast of at least 4.5 to 1 against the colour behind them, or the colour isn’t saved.
• Links in the email template are clickable. Web addresses a visitor typed show as plain text.
• An answer used inside a link in an HTML email or the Answers summary is made safe for the link. A javascript: answer becomes an empty link.
• Confirmation emails to an address a visitor typed are limited to 5 an hour per address, across the site.
• A send whose emails fail is tried 3 times, then kept with its answers and files until an admin acts or the form’s retention period ends.
• A Sending issues section on the Issues tab under Entries lists every send still on its way, oldest first, with Try again and Remove for stuck ones, singly or all at once. A message then says what each press did.
• The reason the mail system gave for each failed try is recorded and shown there, in red.
• Files waiting to go with a stuck send can be downloaded from the Issues tab and forwarded by hand.
• When a send fails its first try, the Issues tab shows a warning while the other tries run. The issues email, if it’s on, goes straight away.
• An admin who opens an entry whose emails are stuck sees “The emails for this entry haven’t been sent.”, with the reason and a Try again button.
• When a send belongs to a stored entry, every try builds its emails from the entry’s answers as they are now, automatic retries and Try again alike. An email address corrected on the entry is the one Try again sends to. A form that saves no entries uses the answers as they were sent.
• Files waiting to go with emails can use up to 200 MB between them. Past that, new emails still go, but without their files. The Issues tab warns at 80% and says when a file was left off. The holmesforms_held_files_max_bytes filter changes the limit.
• On Settings, Email, the sending limit boxes and the test email box have bold labels above them, like the other settings.

Entries and data

• Entries are stored in their own table, with CSV export. You can delete the exported rows straight after.
• Filter and sort by form, and search from the Forms list.
• Forms can be tagged with a named group (Contact forms, Highways, Licensing). The group has its own column, and the list can be filtered to one group.
• The Entries screen and CSV export are open to any admin, or to a role given the holmesforms_view_entries / holmesforms_export_entries capability. That gives entry access without full admin.
• Each form can pick which answers make up the entry title.
• Admin times show in the site’s time zone.
• An entry page shows a data address only when it’s an image. Any other data address is left out.
• Data & privacy: store every form, per form, or never. Retention defaults to 365 days, can be set from 30 to 730, and always applies. A plain “storage used” read-out shows what’s in the database and what the next clean-up will remove.
• The note under “What is using the most” says uploaded files and photos aren’t kept in entries, so they don’t count towards entry sizes.
• Each submission gets a reference like ENQ-000042. A form can have its own prefix and count.
• Personal Data Export / Erase integration. Both cover any waiting or stuck send that holds the person’s email address. The export lists it under “Form sends waiting to go”, and the eraser deletes it with its files.
• A notice on Tools, Export Personal Data lists what to check before you send someone their data. The holmesforms_privacy_export_notice_points filter lets an add-on add its own points.
• An activity log on the Issues tab, for admins. It shows who exported, marked or deleted entries, and who changed a setting. It also shows what happened to sends that failed. Filter it by person, what happened or entry number, and download what the filters show as a CSV file. Each entry has a “What has happened to this entry” panel. The log holds no answers or setting values, and each record is kept for two years. Add-ons can add their own records with HP_Forms_Activity::add().
• Optional encryption at rest for stored answers when HOLMESFORMS_ENCRYPTION_KEY is set in wp-config.php (libsodium, off by default).

Bundled forms

• The plugin comes with 13 ready-made forms for you to open, copy or put on a page. Activating the plugin adds the Simple enquiry form. The setup wizard can add the others. They are:
  • a simple enquiry form
  • an informal feedback form
  • a complaint form (example acknowledge and full-response dates)
  • a “Report a fault” form for buildings, equipment and safety. Its “Which best describes it?” dropdown is filtered by the choice above it
  • an appointment or callback form
  • an event or room booking form
  • a Freedom of Information request, for public bodies only. It works out an example deadline of 20 working days from the date received. Its acknowledgement points to an internal review, then the Information Commission’s Office (ICO). The guide shows a Scottish public authority what to change
  • a Subject Access Request (an example one-month deadline, notes on identity checks, extensions and how to complain)
  • three council forms: “Report a problem”, “Book a council appointment” and “Council feedback, compliment or complaint”. In “Report a problem”, the “Which best describes it?” dropdown is filtered by the category above it, and both can be pre-filled from the query string
  • “Calculation examples”, showing every kind of calculation step by step
  • “Costs and pay examples”, showing costs, pay and dates
• Every recipient starts as the site admin address and never appears on the public form.
• Each starter team email lists every answer on its own line, which you can edit. Worked-out values, such as a deadline, get their own lines too. A question you add later isn’t added by itself. The builder offers to add it.
• The setup wizard’s “Starter forms” step offers them in six groups: Customer contact, Complaints & reports, Bookings & appointments, Data & information requests, Council services, and Worked examples. Each form says who it suits. Pick any or none. Each form is tagged with its group.
• Settings → General → “Restore starter content” re-creates the starter forms you tick, and any starter block that was deleted. It skips anything locked or open in the builder, and only resets an existing one after you confirm.
• Opening a starter form in the builder shows a note: rename it before making it your own, so a restore leaves it alone.

Backup, checks and presentation

• Backup and import: an optional weekly backup (or Back up now) of every form, the saved blocks and all Settings, add-on settings included, as one JSON file you can download and import again.
• Export a single form from the Forms list.
• Backup files hold forms and settings only, with no submissions, entries, uploads or drafts. They include email addresses you entered, so keep them private. Secret keys are locked or left out.
• Form check: a bar at the bottom of the builder that lists problems by severity. It covers missing labels and legends, blank options, duplicate keys, required fields with no custom message, empty notices, autofill purposes worth setting, fields narrower than their answer needs, and an email or Answers summary that leaves out a question.
• The Form check count is red for errors, amber for warnings and plain blue when only notes remain, on the button and on each row of the Forms list.
• It checks structure only. A clean result isn’t proof of WCAG conformance or an accessibility statement, so test the published page with a keyboard and a screen reader. It links to the W3C guide to accessible forms.
• Presentation: a site-wide style mode (GOV.UK, Bootstrap, Plain, or the theme’s own), with a list of class names you can style from your theme’s Additional CSS.
• An Issues tab under Entries, for admins: everything the plugin has found that needs an admin, worst first. Each issue says what’s wrong, when it started and what to do, with a link to the right screen. The tab is always there for admins, and each issue clears itself once the problem has gone.
• It covers stuck sends, a send that failed and is being tried again, the space for waiting files filling up, uploaded files that could not be kept, a spam check that is refusing every visitor, an email action with no valid To address, stored entries that cannot be read, background sending that has fallen back to the slow way, an overdue scheduled job, and the address lookup service not answering.
• A banner on every admin page while there’s an issue: red when something needs fixing, amber otherwise, with up to three titles and an Open Issues button. Staff who can view entries but aren’t admins are asked to tell a site admin.
• An optional email about new issues, to an address you choose, once an hour. When a send fails its first try, it goes straight away. It says what’s wrong and what to do, and never includes anyone’s answers.
• Three checks on Tools → Site Health: the PHP extensions the plugin needs, how your host handles visitor addresses and form replies, and HolmesPortfolio Forms issues.
• The issues check is critical when any issue needs fixing, and recommended when every issue is only worth a look. It lists each issue’s title, with a link to the tab.
• The holmesforms_issues filter lets an add-on list its own issues on the tab, and holmesforms_form_saved fires after a form is saved.
• The holmesforms_send_first_failure action fires when a send fails its first try. Filters starting holmesforms_activity_ let an add-on change what the activity log records and how it describes it.
• Admin screens escape their output at the moment it’s printed. They use one list of allowed tags and attributes. The holmesforms_admin_allowed_html filter lets a developer change that list.
• Data sent from the admin screens is checked for its security token first. It’s then cleaned before it’s read. This covers the builder, rename records, calculation previews, saved blocks, imports and the Describe your form page.
• An optional front-end debugger, visible only to logged-in editors. It shows every field and computed value by page, marked shown or hidden, with a Refresh button and an Errors panel.

Spam

• Built-in spam checks that are always on and need no setup.
• Blocked words, on by default: text answers are checked for swear words and slurs, matched as whole words. Ask the visitor to reword, accept and highlight the words for staff, or save the entry as spam. Each form can have its own rule.
• Cloudflare Turnstile or Google reCAPTCHA as an opt-in extra. The widget sits above the submit button, and the token is checked on the server.