Description

Liuer Contact Form provides a visual form builder, AJAX submission, optional database storage, file uploads, email notifications, optional SMTP and CAPTCHA adapters.

The plugin does not track visitors or contact an external service by default. CAPTCHA is disabled on each form until an administrator enables it; LCF Captcha is the default provider when enabled. WordPress mail is used unless an administrator explicitly enables and configures SMTP.

LCF Captcha is the built-in, privacy-friendly option. It displays a short numeric challenge and verifies the submitted answer on the server without contacting a third party.

External services

When an administrator selects an external CAPTCHA provider and enables CAPTCHA on a form, the visitor’s browser downloads that provider’s script and the website server sends the challenge response to the provider for verification. Liuer Contact Form does not add a visitor IP parameter. These connections occur only for forms on which CAPTCHA is enabled.

Cloudflare Turnstile is provided by Cloudflare, Inc. Service information: https://www.cloudflare.com/application-services/products/turnstile/ – Terms: https://www.cloudflare.com/website-terms/ – Privacy: https://www.cloudflare.com/privacypolicy/

hCaptcha is provided by Intuition Machines, Inc. Service information: https://www.hcaptcha.com/ – Terms: https://www.hcaptcha.com/terms – Privacy: https://www.hcaptcha.com/privacy

Google reCAPTCHA is provided by Google LLC. Service information: https://www.google.com/recaptcha/about/ – Terms: https://policies.google.com/terms – Privacy: https://policies.google.com/privacy

When an administrator enables SMTP and configures a Host, submitted form data configured for email delivery is sent through that SMTP server.

Email queue

Notification email is stored in a private database queue and delivered asynchronously by WP-Cron. The queue worker does not expose a public REST route or custom web endpoint.

On production VPS hosting, disable traffic-driven cron and run due events once per minute from the system scheduler:

* * * * * cd /path/to/wordpress && /usr/local/bin/wp cron event run --due-now --quiet

Add define( 'DISABLE_WP_CRON', true ); to wp-config.php only after the system cron command is working.

Failed jobs use increasing retry delays and can be reviewed under Liuer Contact > Email Queue. Manual retries require an authorized administrator and a valid WordPress nonce.

Styling

The plugin loads a complete, responsive default design from assets/css/frontend.css. Themes can customize an individual form with the shortcode class and wrapper_class attributes without editing plugin files.

The wrapper exposes --lcf-primary, --lcf-primary-dark, --lcf-text, --lcf-muted, --lcf-border, --lcf-surface, --lcf-surface-soft, and --lcf-error CSS variables for lightweight branding.

Privacy

Depending on form settings, the plugin may store submitted field values, private upload metadata, the source page and locale. It does not store visitor IP addresses, IP fingerprints, browser details or device information. WordPress personal data export and erase tools are supported. Private files are deleted with their submission. A retention period can be configured.

Failed notification jobs retain their email payload and private attachments for retry until the configured cleanup period, capped at 30 days. Successfully sent payloads are removed immediately.

Installation

Upload the plugin directory to /wp-content/plugins/.
Activate Liuer Contact Form in WordPress.
Open Liuer Contact > Add form.
Build and publish the form, then insert its shortcode.

FAQ

Are uploaded files private?

Yes. New uploads are stored in wp-content/uploads/liuer-contact-form-private by default, are not added to the Media Library, and can be downloaded from WordPress only by an authorized administrator through a nonce-protected endpoint.

The storage location can be changed under Liuer Contact > Settings. Enter a dedicated path relative to wp-content, such as uploads/liuer-contact-form-private. Absolute paths, traversal segments, and WordPress code directories are rejected.

The plugin creates the default directory during activation, checks that it is writable, and displays an administrator notice when storage is unavailable. It also creates .htaccess, web.config, index.php, and index.html protection files. Nginx does not read .htaccess, so Nginx sites must add the deny rule shown on the plugin settings page whenever the directory changes.

Nginx example: location ^~ /wp-content/uploads/liuer-contact-form-private/ { return 404; }.

Does the plugin replace another SMTP plugin?

No. SMTP is optional and is attached only while Liuer Contact Form sends its own notification.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“Liuer Contact Form” is open source software. The following people have contributed to this plugin.

liuer

Translate “Liuer Contact Form” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

0.2.10

Removed obsolete synchronous mail and legacy queue retry paths after queue delivery was consolidated.
Removed an unused internal schema helper.

0.2.9

Added an optional {random} email template tag that generates one stable 8-character code per submission.

0.2.8

Removed visitor IP, IP fingerprint, browser, device, proxy, and IP blocklist collection and administration.
Replaced IP-based throttling and native CAPTCHA binding with anonymous per-form request sessions.
Cleared legacy identifying entry data and removed the retired IP blocklist table during upgrade.

0.2.7

Added Send now and Retry now actions for pending and failed queue jobs.
Added per-job deletion and a Delete all jobs control with nonce and capability protection.

0.2.6

Allowed failed notification jobs to be retried even when submission storage is disabled.
Retained failed queue payloads until cleanup and clearly marked legacy jobs whose payload was already removed.

0.2.5

Unified test and queued email delivery so transport failures retain their original diagnostic message.
Added clickable email template tags and generated label-based message templates for empty or legacy key-only bodies.

0.2.4

Restored explicit SMTP opt-in and kept SMTP fields collapsed until enabled.

0.2.3

Enabled SMTP automatically when a Host is configured and removed the redundant SMTP checkbox.
Added a custom recipient field for test emails and surfaced mail transport errors to administrators.

0.2.2

Hardened administrator input handling and escaped dynamic administration classes.
Stopped creating starter content automatically during plugin activation.
Replaced silenced validation calls with explicit error handling.
Clarified the default CAPTCHA behavior in the documentation.

0.2.1

Added clear WP-Cron delivery guidance and status warnings to the Email Queue administration screen.
Linked SMTP settings to the queue scheduling guidance.

0.2.0

Added a persistent asynchronous notification email queue powered by WP-Cron.
Added atomic worker locking, stale lock recovery, increasing retry delays, and a recurring watchdog.
Preserved private attachments until queued delivery finishes and cleaned temporary files safely.
Added an administrator-only email queue monitor and nonce-protected retry action.
Kept the queue worker internal without adding a public endpoint.

0.1.20

Added an accessible form-level waiting overlay while notification email is being delivered.

0.1.19

Refined the submissions table with clearer hierarchy and compact actions.
Added responsive table and card layouts for narrower administrator screens.

0.1.18

Added an admin setting for the private upload directory inside wp-content.
Create and verify private storage during activation and periodically in the administrator area.
Display storage permission errors and a directory-specific Nginx deny rule.
Preserve each new upload’s storage root so directory changes do not break existing files.

0.1.17

Store private uploads inside the WordPress project for straightforward deployment.
Document the required Nginx deny rule and protect private files in the local router.

0.1.16

Moved new form uploads out of the Media Library into private storage.
Added capability- and nonce-protected administrator downloads.
Added server protection files and configurable private storage location.
Included private files in retention, privacy erasure, entry deletion, and uninstall cleanup.

0.1.15

Hardened CSV exports against spreadsheet formula injection.
Fixed privacy-tool pagination and retention attachment cleanup.
Cleaned uploaded attachments after failed or non-persistent submissions and uninstall.
Added strict submitted-value shape and length limits.
Removed dynamic HTML insertion from the success dialog.
Documented optional external CAPTCHA services and their policies.

0.1.14

Hardened the native CAPTCHA endpoint with POST-only signed form sessions.
Bound challenges to the form, client IP, and request UUID.
Added global, per-form, and per-session challenge rate limits.

0.1.13

Reset and unlock the form when a native CAPTCHA expires.
Removed automatic CAPTCHA refresh and network retry loops.

0.1.12

Added explicit Confirm and Reset actions to the native CAPTCHA step.
Lock form fields during CAPTCHA verification and restore them after reset.

0.1.11

Added a compact submit action directly inside the lazy LCF Captcha panel.
Hide the original submit row while the CAPTCHA challenge is active.

0.1.10

Load LCF Captcha only after the first valid submit attempt.
Keep native CAPTCHA hidden again after a successful submission.

0.1.9

Changed native CAPTCHA challenges to a 30-second lifetime.
Replaced manual refresh with a countdown and automatic challenge renewal.

0.1.8

Added common SMTP port suggestions while preserving custom port support.

0.1.7

Replaced the CAPTCHA refresh text with an accessible compact icon button.
Reduced the native CAPTCHA footprint on desktop and mobile.

0.1.6

Improved spacing between settings fields, switches, and descriptions.

0.1.5

Added a compact single-row layout for LCF Captcha.
Clarified global and per-form CAPTCHA settings.

0.1.4

Added the built-in LCF Captcha with server-side, one-time numeric challenge verification.

0.1.3

Added a neutral, theme-independent default frontend design.
Added generic form and wrapper class arguments for theme integrations.
Removed LIUER theme-specific newsletter styles from the plugin.

0.1.2

Added a complete submission detail dialog while keeping the entries table compact.
Updated the WordPress admin menu icon.

0.1.0

Initial development release.