Description
Saudi CR Pro Business Forms helps business customers complete your Contact Form 7 forms with less manual typing. Visitors enter a Saudi commercial registration (CR) or unified business number, review the matching business details, and choose whether to fill the fields you have mapped.
Use it for supplier applications, wholesale enquiries, B2B service requests, company onboarding and business-account registration forms built with Contact Form 7. Your existing form, submission process and email workflow remain in place.
How it works
- Look up: the applicant enters a complete ten-digit CR or unified business number. Arabic and Persian digits are normalized.
- Review: the plugin shows the original Arabic legal name, separate CR and unified numbers, available city/region, published data period and lookup time.
- Fill: the applicant selects Use business details. Only mapped fields are filled. Replacing existing values requires an additional confirmation; missing source values never erase entered details.
- Continue: the applicant completes and submits your normal Contact Form 7 form. Looking up a business does not submit the form.
Features
- Exact lookup by ten-digit Saudi CR or unified business number.
- Field mapping through WordPress settings; no PHP editing required.
- Separate targets for the CR number and unified business number.
- Original Arabic legal name and optional city/region from the published registry.
- English or Arabic widget text, selected by the site administrator.
- Explicit per-form activation: enable only the forms that need business lookup.
- Review-before-fill, replacement confirmation and manual-entry fallback.
- Server-side API requests: the private Saudi CR Pro key is not included in visitor HTML, JavaScript or browser storage.
- Configurable local daily budget, per-minute request protection and upstream rate-limit handling.
Connect your site
Create and verify your account at https://saudicrpro.com, then generate an API key in your dashboard. In WordPress, open Settings > Saudi CR Pro, privately enter the key, confirm the external-service disclosure, select your language and enable the forms you want to use. Add [scrpro_business] to each Contact Form 7 template and choose its target fields in the mapping controls.
The plugin is free, open-source software. The external Saudi CR Pro API is a separate service requiring a verified account, valid API key and active trial or annual access. Installing the plugin does not create a service account or include unlimited API use. See https://saudicrpro.com/pricing for current access details.
Requirements and compatibility
- WordPress 7.1 or newer and PHP 8.3 or newer.
- Contact Form 7, tested with version 6.2.4.1.
- A verified Saudi CR Pro account, valid server-side API key and active service access.
- Outbound HTTPS access from your WordPress server to https://saudicrpro.com.
- Ordinary, uniquely named Contact Form 7 text, tel or textarea fields.
Per-site activation is supported; network activation is not. This release is a Contact Form 7 integration, not a WooCommerce checkout adapter or a Shopify app. Elementor, Gravity Forms, WPForms, select controls and arbitrary form-builder compatibility are not included.
Data source and scope
Business details come from official published Ministry of Commerce registry records. Each result identifies the published data period. This is a published-record lookup, not a live Ministry status check, certified extract, ownership check, personal identity check, VAT validation, national-address service or ZATCA clearance/submission service. A record not found does not mean that a business is inactive.
Saudi CR Pro is independently operated as part of Morouna Business Services Company. It is not affiliated with the Ministry of Commerce or any government body. WordPress.org directory approval does not imply endorsement by WordPress.org or Contact Form 7.
Help and documentation
- Setup guide: https://saudicrpro.com/docs#wordpress-pilot
- API documentation: https://saudicrpro.com/docs
- Support: https://saudicrpro.com/support or support@saudicrpro.com
External service and privacy
The code is GPL-2.0-or-later. The external Saudi CR Pro service requires a verified account, a valid private API key and active trial or annual access; an API subscription may be paid. Installing this plugin does not grant or extend service access. Account limits and usage are shared across integrations and keys.
When the visitor presses Look up business, WordPress sends the normalized business identifier and an Authorization header to https://saudicrpro.com/api/v1/lookup/{identifier}. This uses the service’s active published registry release, not an insights-report endpoint. Other form fields and visitor IP addresses are not forwarded by this plugin. The external service sees the WordPress server’s address and processes requests under its own privacy policy. No analytics, external fonts or executable scripts are loaded by this plugin.
Terms: https://saudicrpro.com/terms
Privacy: https://saudicrpro.com/privacy
Fair use: https://saudicrpro.com/fair-use
Documentation: https://saudicrpro.com/docs#wordpress-pilot
Support: support@saudicrpro.com
The administrator must explicitly enable external-service use and update the site’s own privacy notice. The plugin provides suggested privacy-policy text in WordPress. It keeps no lookup-result history. Contact Form 7 mail, storage addons, server logs, backups and your own form workflow have separate retention. A bounded rate-counter option retains daily totals and salted visitor-address hashes for the most recent request minute until subsequent lookup activity replaces them or the plugin is uninstalled. Raw visitor IPs and identifiers are not stored by these counters.
The integration key is encrypted at rest using AES-256-GCM and the installation’s WordPress salts, or read from a private SAUDICRPRO_API_KEY constant. Server administrators and installed plugins must still be trusted; encryption does not protect against a compromised WordPress server. Changing salts makes the stored key unreadable: replace it through settings. Never put the key in a form tag, mail template, screenshot, public repository or browser code.
Reliability and operating limits
Requests have a ten-second server timeout, no redirects, TLS verification, a fixed HTTPS destination and a 32 KiB response limit. Browser requests time out after twelve seconds. No automatic retries, persistent result caches or background lookups occur.
Local protection combines enabled-form checks, form tokens, same-origin checks and atomic counters. A public nonce or origin header is not authentication: bots can obtain or spoof them. Defaults: 5 requests per visitor address per minute, 30 per site per minute, and a configurable 250 per UTC day (1-10,000). These local budgets do not raise/reset the upstream account’s limits. Rejected upstream lookups can consume account allowance. Provider rate-limit backoff is respected; account/auth failures stop repeated upstream attempts briefly. Distributed abuse can still exhaust the site budget; disable public forms or require an authenticated, separately reviewed integration when appropriate.
REMOTE_ADDR must reflect the real client as configured by your host. This plugin deliberately does not trust arbitrary forwarded headers. Reverse proxies that leave all visitors on one address will share a visitor bucket. Site administrators should configure their host correctly, not relax the public request limits blindly.
Keep full-page cache lifetimes below twelve hours or exclude the form page. Expired WordPress form tokens require a reload. The lookup REST route must not be cached. On errors the applicant can continue manually; not found does not mean inactive. A missing optional source value is not an error and never erases manual content.
Changing a CF7 field name/type can invalidate its mapping; re-save mappings before exposing the form. No mapped fields should be dynamically removed/replaced by another plugin without retesting.
Deactivation keeps private settings for reactivation. Uninstall removes this plugin’s key, configuration and counters on the current site, but never deletes CF7 forms, submissions or a Saudi CR Pro account/key. Backups have their own retention.
Tested environment
The recorded environment is WordPress 7.1.4, PHP 8.4.27 and Contact Form 7 6.2.4.1, with controlled upstream responses rather than a live customer key. The integration targets WordPress 7.1+, PHP 8.3+ and CF7 6.2.4.1. Other themes, hosts and versions are not certified. Validate an authorized live lookup and your actual hosting setup before customer rollout.
Testing guide: https://saudicrpro.com/downloads/wordpress-testing.md
English and built-in Arabic widget copy are included. PHP text uses WordPress gettext; JavaScript uses the bundled WordPress wp-i18n library. A POT translation template is provided in languages/. No remote translation scripts are loaded.
Screenshots
Installation
- Install and activate Contact Form 7. Install Saudi CR Pro Business Forms from Plugins > Add Plugin, or upload the ZIP, and activate it.
- Create ordinary fields in Contact Form 7 and add [scrpro_business] above them, inside its form template. Do not put that tag directly in the WordPress page.
- Open Settings > Saudi CR Pro as an administrator. Paste a newly issued API key privately, or define SAUDICRPRO_API_KEY in wp-config.php using a private deployment mechanism. The screen never retrieves or prints a stored key. A blank key input retains the current key; Remove deletes the local copy, not the service key.
- Confirm external-service disclosure, select English or Arabic, explicitly enable the form and map fields by selecting their existing names. Use different text targets for CR and unified business numbers. At least one mapping is required; other fields remain manual. Save.
- Embed the normal Contact Form 7 shortcode in a page. Test an identifier you are authorized to use. Review the record and published period before applying it. Check replacement confirmation using a prefilled form. Never test by submitting real customer data unnecessarily.
Example CF7 form template:
[scrpro_business]
<label>Business name [text business-name]</label>
<label>CR number [text business-cr]</label>
<label>Unified business number [text business-unified]</label>
<label>City [text business-city]</label>
<label>Region [text business-region]</label>
[submit "Send application"]
Map nameAr to business-name, crNumber to business-cr, unifiedNumber to business-unified, city to business-city and region to business-region.
FAQ
-
What does this plugin actually do?
-
It adds an optional business-number lookup to selected Contact Form 7 forms. A visitor reviews a published business record, then explicitly chooses to fill the fields the administrator has mapped. It does not automatically approve an application or submit the form.
-
Do I need a Saudi CR Pro account?
-
Yes. A verified account, a private API key and active trial or annual access are required. The plugin itself is GPL-licensed; API access is a separate service. Current details are at https://saudicrpro.com/pricing.
-
Which fields can I fill?
-
The original Arabic legal name, CR number, unified business number, and available city/region. Targets must be ordinary, uniquely named CF7 text, tel or textarea fields. Missing source fields stay manual. A translated English company name, VAT number, address or ownership structure is not supplied by this plugin.
-
Does it verify current official status or ZATCA compliance?
-
No. Results are matched against the service’s active published Ministry of Commerce release and show its data period. Use the Ministry’s services for current official status or a certified extract. This plugin does not issue invoices, verify VAT registration or submit anything to ZATCA.
-
Does it work with WooCommerce or other form builders?
-
This release supports Contact Form 7 only. It does not add fields to WooCommerce checkout or integrate with Elementor, Gravity Forms or WPForms. Developers can use the separate Saudi CR Pro REST API for custom integrations.
-
The visitor can continue entering details manually. The lookup does not overwrite existing information without confirmation and does not submit the form. A record not found is not a statement that the business is inactive.
-
Where is my API key stored, and what data is sent?
-
The key stays on your WordPress server, encrypted using WordPress salts or supplied through a private configuration constant. A lookup sends the business identifier and API authorization server-to-server. Other form fields and the visitor’s IP address are not forwarded by this plugin. See External service and privacy below for storage, counter and retention details.
-
Are English and Arabic supported?
-
Yes. The administrator can choose English or Arabic widget text. The company’s legal name remains the original Arabic name supplied by the registry; the plugin does not invent a translation.
-
Can I limit public-form usage?
-
Yes. The plugin includes local per-minute limits and a configurable daily site budget, in addition to your Saudi CR Pro account limits. These are abuse protections, not visitor authentication. See Reliability and operating limits for defaults and hosting considerations.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Saudi CR Pro Business Forms” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Saudi CR Pro Business Forms” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
0.1.2
Align the installation folder, main filename, PHP and JavaScript translation domains, and translation template with the WordPress.org-assigned slug saudi-cr-pro-business-forms. Confirm contributor abdullahalmulhim1. No lookup, credential-storage or quota behavior changes.
0.1.1
WordPress.org submission preparation: remove custom Update URI; validate visitor IP before hashing; user-bound settings success notice; translated PHP and JavaScript text; production-only packaging and translation template. Preserve atomic concurrent request limits with documented database-query exceptions.
0.1.0
Initial private pilot: exact business lookup, admin-only per-form configuration, encrypted server key, English/Arabic review controls, deliberate replacement and bounded public access.