Hi {name}!
' ], [ 'when' => 'default', 'html' => 'Thank you, {name}. We will be in touch.
' ], ], 'fields' => [ ... ], ]; ``` #### Organize schemas in separate files ``` // functions.php — one line require_once get_template_directory() . '/inc/hxfe-forms.php'; ``` Or use HXFE as a standalone plugin with `glob()` auto-loading. ### External Services This plugin optionally connects to Google reCAPTCHA when the `recaptcha` field type is enabled in a form schema. **What the service is and what it is used for:** Google reCAPTCHA is a spam-prevention service. When enabled, it loads a script from Google’s servers and verifies the user’s response server-side to determine whether the form submission is from a human or a bot. **What data is sent and when:** When a page containing an HXFE form with reCAPTCHA is loaded, the visitor’s browser loads the reCAPTCHA script from `google.com`. On form submission, the reCAPTCHA token generated in the visitor’s browser is sent to Google’s verification endpoint (`https://www.google.com/recaptcha/api/siteverify`) along with your site key. No other form field data is transmitted to Google. reCAPTCHA is **disabled by default**. It is only active when a site administrator adds a `recaptcha` field to a form schema and configures valid API keys in the plugin settings. **Links:** * Google reCAPTCHA Terms of Service: https://policies.google.com/terms* Google Privacy Policy: https://policies.google.com/privacy ## Installation 1. Upload the plugin folder to `/wp-content/plugins/` 2. Activate in **Plugins Installed Plugins** 3. Add schemas via the `hxfe_schemas` filter in `functions.php` 4. Place `[hxfe_form id="your-id"]` in any page or post 5. View all registered forms at **Settings Form Engine — Forms** ## FAQ ### Does HXFE save submissions to the database? No. HXFE sends email only. This is intentional — forms defined in code stay lightweight and free of database dependencies. Use Webhook support to send data to external services like Google Sheets or a CRM. ### Can I use HXFE without writing PHP? HXFE is designed for developers who want code-first form management. If you need a GUI builder, plugins like WPForms or Fluent Forms may be a better fit. ### Does the chatbot mode work with conditional logic? Yes. `show_if` conditions work in chatbot mode — hidden fields are automatically skipped. You can also use `{field_key}` placeholders in `bot_message` to reference previous answers. ### Is HXFE GDPR / EU cookie compliant? Yes. HXFE uses zero cookies. Form state is preserved via hidden JSON fields on the server side, not browser storage. ### Can I embed forms on external domains? Yes. Use `[hxfe_iframe id="contact" site="https://your-site.com"]` and configure allowed origins in **Settings Form Engine iframe / CORS Settings**. ### How do I connect to Zapier or Make? Add a `webhooks` array to your schema with the target URL. HXFE will POST form data as JSON after each successful submission. Webhook failures do not block form submission. ### Can I skip the confirmation screen? Yes. Add `'confirm' => false` to your schema. Works for normal forms and step forms. ### Can I restrict a form to specific IP addresses? Yes. Add `allowed_ips` to your schema with a list of IPs or CIDR ranges. Visitors outside the whitelist see a blocked message, which you can customize with `ip_blocked_html`. ``` allowed_ips => [ '192.168.1.0/24', '203.0.113.5' ], ip_blocked_html => 'This form is only available on the campus network.
', ``` ### Can I require a password to access a form? Yes. Add an `auth` key to your schema. To keep passwords out of Git, define them as constants in `wp-config.php` and reference them in the schema. In `wp-config.php`: `define( 'HXFE_STAFF_PASS', 'your-secret-password' );` In your schema: ‘auth’ => [ ‘users’ => [ [ ‘id’ => ‘staff’, ‘password’ => defined(‘ HXFE_STAFF_PASS’) ? HXFE_STAFF_PASS : ” ] ] ] Brute-force protection is built in — access is locked for 15 minutes after 5 failed attempts. ### Can I prevent PHP files from being edited via the WordPress admin? Yes. Add this to `wp-config.php`: ``` define( 'DISALLOW_FILE_EDIT', true ); ``` This disables the theme and plugin editors in the WordPress admin. It pairs well with HXFE’s code-first approach — forms and code are managed via deployment, not the admin UI. ### Can I save uploaded files somewhere other than email attachments? HXFE deletes uploaded files from the server immediately after sending the email. This is intentional — keeping files on the server increases security risk and GDPR responsibility. For permanent storage, the recommended approach is to use Gmail + Google Apps Script( GAS): set up a time-based trigger that reads incoming form emails and saves attachments to a designated Google Drive folder. This keeps files off your WordPress server entirely and lets you manage access through Google’s permission system. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “HXFE — Code-First Forms” is open source software. The following people have contributed to this plugin. Contributors * [ youheiokubo ](https://profiles.wordpress.org/youheiokubo/) [Translate “HXFE — Code-First Forms” into your language.](https://translate.wordpress.org/projects/wp-plugins/hxfe-code-first-forms) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/hxfe-code-first-forms/), check out the [SVN repository](https://plugins.svn.wordpress.org/hxfe-code-first-forms/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/hxfe-code-first-forms/) by [RSS](https://plugins.trac.wordpress.org/log/hxfe-code-first-forms/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.3.7 * Security: Removed skip_sanitize parameter from hxfe_process_fields() — all values are now sanitized on every call, including confirmsubmit flow * Security: Clarified that sanitize_text_field() and related functions are idempotent, so re-sanitizing already-sanitized values is safe #### 1.3.6 * Security: Added nonce verification to hxfe_handle_back() to prevent unauthorized form re-rendering * Security: Back button now passes hxfe_nonce (hxfe_validate_{form_id}) via hx- vals * Code: Clarified skip_sanitize=true comment in hxfe_handle_submit() to explain double-sanitize prevention #### 1.3.5 * Renamed schema key: `redirect_rules` `complete_redirect_rules` (consistent with other `complete_*` keys) * Renamed schema keys: `before_open_html` / `after_close_html` `before_html` /` after_html` * Renamed field keys: `min_check` / `max_check` `min` / `max` (consistent with` min_date` / `max_date`) * Deprecated field key `hide_if` — use `show_if` instead (backward compatible, will be removed in a future version) #### 1.3.4 * Added: Page slug auto-injected into subject as [form-id@slug] for per-page tracking * Added: Schema examples panel in admin UI with 7 copy-paste samples * Added: Responsive breakpoint at 768px * Added: CSS custom properties (design tokens) for easy theme customization * Added: `download_url` / `download_label` schema keys — download button on complete screen * Added: `available_from` / `available_until` schema keys — form availability window * Added: `before_html` / `after_html` schema keys — custom messages outside window * Added: `allowed_origins` schema key — per-form iframe CORS restriction * Added: Embed HTML `