Form Monitor for Contact Form 7 – Email Delivery Alerts

Description

Contact Form 7 can break silently. A plugin update, a mail-server change, an
expired SMTP password, or a hosting move, and your enquiries stop arriving.
Nothing on your site looks wrong. The form still says “Thank you for your
message.” You find out weeks later, when a customer asks why nobody called back.

Arvelos Form Monitor catches it for you. On a schedule, and again right
after every plugin, theme, or WordPress update, it sends a real test submission
through your live Contact Form 7 forms and checks that it goes through. If a
check fails, you get an email. When it recovers, you get another. When
everything is fine, you hear nothing.

• Tests run through your actual forms, not a simulated copy.
• Test messages never reach your real recipients and never bypass your spam
  protection.
• Re-checks automatically after updates, when forms most often break.
• Works across all your client sites: one subscription covers up to 10 sites.

Pricing: the plugin is free, and your first test is free. Scheduled
monitoring is a subscription through the Arvelos service; current pricing is at
https://clickarvelos.com/products/wordpress-form-monitoring/.

How it works: this plugin is the small piece that runs on your site. It
pairs with a free Arvelos account (create one at
https://forms.clickarvelos.com/onboarding), which runs the tests and sends the
alerts. On its own, without pairing, the plugin does nothing and sends nothing.

What a passing status means: a controlled test submission was accepted by
your form and its notification reached a mailbox Arvelos controls for the test.

What it does not mean: it does not verify your real inbox and does not
guarantee delivery of real visitor enquiries. It is a signal from a synthetic
test, not a delivery guarantee.

Boundaries this plugin respects:

• It only authorizes a submission that carries a valid, unexpired, single-use,
  site-scoped token issued by the Arvelos service. It never mints tokens itself
  and never authorizes an ordinary visitor submission.
• It never circumvents a CAPTCHA (reCAPTCHA, hCaptcha, Turnstile). A form
  protected by one is reported as unsupported and is not monitored.
• A synthetic run’s notification is routed to the Arvelos verification address
  (an Arvelos-controlled mailbox) and is never delivered to your real recipients
  as if it were a real enquiry.
• It transmits nothing to Arvelos until you pair the site by entering your
  Site ID and secret.

External services

This plugin connects to Arvelos Form Monitor, a hosted service operated
by Arvelos Software, so the service can run and confirm the synthetic tests
described above. The service is what makes the plugin useful; without pairing,
the plugin sends nothing.

Service endpoint: https://forms.clickarvelos.com

What is sent to Arvelos, and when — only after you pair the site:

• When you save your pairing settings, the plugin asks the service to verify
  control of this site. The request contains your Site ID. The service then
  fetches a public, read-only proof route on your site (below) to confirm the
  plugin is installed here and holds the paired secret.
• When you rotate your secret, the plugin sends a signed rotation request
  containing your Site ID and a timestamp.
• After a plugin, theme, or WordPress core update completes, the plugin sends a
  single debounced, signed “site updated” event containing your Site ID and
  a timestamp, so the service can re-test promptly instead of waiting for its
  next scheduled check.

The rotation and “site updated” requests above are signed with your per-site
secret; the initial pairing request is not signed — instead Arvelos confirms
control by fetching the public proof route below, which is derived from your
secret. The plugin does not send your form submissions, your visitors’ data, or your
real recipient addresses to the service. The Arvelos verification address that a
synthetic notification is routed to is built into the plugin — you never enter,
store, or manage it, and run correlation uses a per-run single-use code, not the
address itself.

Public route this plugin exposes: once paired, the plugin serves a read-only
REST route, GET /wp-json/orion-fm/v1/pairing, that returns a fixed
proof-of-control value derived from your secret. It exposes no submission data
and is a 404 until the site is paired.

This plugin connects your site to Arvelos Form Monitor, a paid hosted
service operated by Arvelos Software. Your use of that service, and the
data it handles, are governed by the Arvelos Terms of Service and Privacy
Policy, which cover Arvelos Form Monitor specifically:

• Terms of Service: https://clickarvelos.com/terms/
• Privacy Policy: https://clickarvelos.com/privacy/

The Privacy Policy describes what the service stores (your account email,
connected site and form identifiers, alert recipient, billing identifiers
via Stripe, and monitoring results) and confirms that your real visitors’
submissions are never sent to or stored by the service.

Privacy

This plugin stores your Arvelos pairing details (Site ID, per-site secret) in
your site’s options table. The secret is never
exposed to the front end. See External services above for exactly what the
plugin transmits to Arvelos and when, and the linked Privacy Policy for how the
Arvelos service handles data.

Support

Support is by email through Arvelos: https://clickarvelos.com/support/