Tiger Elements Forms – Drag & Drop Contact Form Builder

Changelog

2.0.2

• Preview now shows the real form. It used to be a separate drawing of your
  form, and the two drifted: a Name field appeared as First and Last in the
  editor and as a single box in the preview, Address did the same, and the
  slider and signature fields were not drawn at all. The preview opens the
  actual published form, so what you see is what visitors get — including your
  theme’s fonts and colours, and the real date picker and file uploader.
• Preview is safe to submit. Pressing Send in it checks the form exactly as a
  visitor would and then stops: no entry is saved, no email is sent, and nothing
  is passed to any connected service.
• You can size the preview for desktop, tablet and mobile, and close it with Esc.
• Fixed: Name and Address fields now stack when there is not room for their
  parts side by side — in a phone, and equally in a narrow column or sidebar on a
  full-size screen.
• Fixed: the “We saved your progress. Restore?” bar had no styling at all. It
  looked like a fault, and on a phone its two buttons fell onto separate lines.
• Notifications: the merge-tag buttons appeared twice, under the subject and
  again under the body, and only ever offered the first six fields of your form.
  There is now one Insert tag button per box, listing every field, grouped
  and searchable — and the tag is inserted where your cursor is instead of at the
  end.
• Bookings moved to Tiger Elements Forms Pro. This plugin no longer registers a
  Bookings post type it has no feature for. A form that was set up on a Pro site
  keeps its booking settings untouched and starts working again there.
• New: Settings ▸ Storage now lists only the places this plugin can actually
  put files, and explains each one. It used to offer S3, R2 and Bunny in every
  copy; picking one here saved the choice and then quietly went on writing to
  your own server, because that code is not part of this download.
• Fixed: saving the Storage tab no longer discards settings it does not show.
• Fixed: a file download that failed at the storage layer returned a server
  error instead of a message. It now says the file could not be retrieved.
• New: a notification email that mentions an uploaded file now gives you a link
  to open it, not just the filename. Attaching the file itself is still a
  separate option — this works whether or not you use it, and for files kept on
  cloud storage where attaching is not possible. The link does not expire and
  carries no secret in it: it opens for anyone allowed to read your submissions,
  and sends everyone else to the login screen.
• The disposable-email blocklist now ships with the plugin instead of being
  downloaded when you press a button. Nothing about blocking changes; the list
  is refreshed with each release rather than on demand, and the plugin makes one
  fewer connection to the outside world.
• Fixed: installing Pro used to switch the free plugin off for you. It no longer
  touches it — which plugins are active is your decision, and the two have
  always coexisted without it.
• Fixed: the documented command for rebuilding the front-end bundle did not run
  (esbuild could not be resolved from that folder). It works now, and the source
  every built file comes from is described at the top of the plugin’s page.
• Hardening: several admin screens now escape their output at the point it is
  printed rather than earlier, so the safety is visible in the code that prints.
• Fixed: an optional part of the form runtime failing to load no longer stops
  the whole form from working — you lose that one behaviour, not the form.
• The admin menu now reads “TE Forms”. The full name was wider than the space
  WordPress gives a sidebar entry, so it wrapped onto two lines. Only the label
  is shorter — the plugin, its screens and everything you have saved are the
  same, and the screen heading still shows the full name.
• New: radio and checkbox fields can offer an “Other” choice with a text box,
  so someone can answer with something that is not on your list. What they type
  is stored as the answer itself, so exports and notifications read normally.
• New: choice layout. Radio and checkbox choices can flow across the row
  instead of stacking one per line; they still wrap on small screens.
• Fixed: in the form builder, checkboxes, radio buttons, NPS boxes and the
  repeater panel were drawn without their outline, so they appeared as blank
  space. The Field ID box also drew a heavy 3D border instead of a thin line.
• New fields now get a readable ID — radio_1 instead of radio_mtljotzi4 — so
  the merge tags and conditional rules you write by hand are legible. Existing
  fields keep the ID they already have, because your rules refer to it.
• Fixed: leaving a form with unsaved changes now always asks first. The
  Submissions button and your browser’s Back button used to discard unsaved
  edits without a word; both now offer to save, discard, or stay.
• Removed three settings from the GDPR tab that never did anything. One of them
  was an anonymisation schedule that looked like it worked: it wrote to a place
  nothing read, so anyone who set it there believed personal data was being
  scrubbed while nothing ran. Deletion and anonymisation are set on the General
  tab, as they always were, and the GDPR tab now points there.
• New: the plugin now contributes suggested wording to Settings → Privacy →
  Policy Guide, covering what a submission stores — answers, timestamp, hashed
  IP, and any file or signature attached — so your privacy policy can describe it
  accurately.
• The two remaining GDPR settings now say where they take effect, under Tools →
  Export Personal Data and Tools → Erase Personal Data.

2.0.1

• The plugin is now Tiger Elements Forms. The old name was close enough to an
  unrelated plugin to be confusing, so the display name, the slug, the text
  domain and the Gutenberg block all lead with our own brand instead. The block
  is registered as tiger-elements-forms/form.
• Fixed: the block editor’s own strings were registered under the previous text
  domain, so none of them could ever be translated. They now use the plugin’s
  domain, and the editor script loads its translations like every other script.
• Fixed: the “Build one in Tiger Elements Forms” link shown in the Elementor
  styler when a site has no forms yet pointed at an admin page that does not
  exist, so it landed on a permissions error. It now opens the form builder.
• Fixed: the bundled translation template was missing 108 strings and carried a
  malformed header that gettext tools refused to read. It is now regenerated
  from the packaged files on every build, so it cannot drift again.
• The Upgrade Notice shown on the update screen still described a release from
  long before this one; it now describes what you are actually updating to.
• Internal: releases are checked against the zip that ships rather than the
  source it was built from, and the same commit now always produces the same
  package.

2.0.0

• Compatibility: tested against WordPress 7.1.
• Hardening: error messages raised as exceptions are now escaped at the point
  they are built, so the whole plugin reads clean under WordPress’s output
  escaping standard. These strings were never rendered unescaped, so nothing
  about what you see changes — the code now proves that to a static scanner
  instead of leaving a reviewer to trace it by hand.

1.14.7

• Hardening: every database query now binds its table and column names through
  WordPress’s own identifier placeholder instead of building the SQL by string
  interpolation. No behaviour changes — the same rows are read and written —
  but the query layer is now clean under WordPress’s coding standards, with the
  handful of unavoidable dynamic IN() lists documented in place.

1.14.6

• Change: the plugin now ships the non-compiled source for its bundled assets —
  the React/TypeScript form builder and the front-end ES modules — alongside the
  compiled output, with build instructions under “Source code” in this readme.
  Nothing about running the plugin changes; the compiled assets are still
  included and no build step is needed to use it.

1.14.5

• Fix: if your site’s security keys change (a wp-config regeneration, a host
  security-key reset, or a restore from a backup made under different keys),
  saved payment credentials can no longer be decrypted. The screen still showed
  them as configured while the gateway received an empty key, so checkout failed
  with no visible cause. Tiger Elements Forms now detects this, names the affected
  credentials on Settings -> Payments, and tells you to enter them again.

1.14.4

• Change: the free build no longer contains any licensing code. The License
  screen, the licence key form and the Plugins-list “Upgrade” link are Pro-build
  only, so the free plugin ships nothing that could look like a locked feature.
• Fix: the Tiger Elements Forms admin menu sat among the WordPress core menus and pushed
  them down. It now sits with the other plugin menus.
• Fix: corrected the plan comparison text, which described multi-step forms as a
  Pro feature. Multi-step forms are free.
• Hardening: values embedded in inline admin scripts are now escaped for a
  script context.

1.14.3

• Fix: the From email box on Settings → Mail showed your WordPress admin address
  even when no sender was configured, while emails actually went out from your
  server default. Saving the page then committed that address for real — usually
  a Gmail or Outlook one, which is exactly the sender mismatch the delivery check
  warns about. The box now shows only what you have saved, with the real default
  as a greyed-out hint.

1.14.2

• Fix: download links for uploaded files did not work on most servers — clicking
  a file on a submission returned “not found”. The link encoded the folder
  separators in a way Apache rejects by default. Affects every uploaded file, and
  signature previews on the submission screen.

1.13.0

• New: Delivery check. Settings → Mail now tells you whether your form emails will
  actually arrive — it inspects SPF, DKIM, DMARC and sender alignment for the
  domain you send from, and shows the exact DNS record to add when something is
  missing. It also catches the most common mistake of all: sending as a Gmail,
  Outlook or Yahoo address you do not control, which providers reject.
• The check reads public DNS only. No third-party service, no key to configure,
  and nothing about your setup leaves your site.

1.12.0

• Fix: activating with WP-CLI or a deployment script granted no Tiger Elements Forms
  capabilities until someone opened the admin. Administrators were unaffected,
  but other roles silently had none.
• Internal: shared merge-tag and submission-context handling was consolidated so
  every feature resolves the same tags the same way. No change to your forms.

1.11.1

• Signatures are now stored as private files instead of being embedded in the
  submission record. Existing submissions are unaffected and keep displaying as
  before; new ones store a much smaller record and a signature file that carries
  its own checksum. Deleting a submission deletes its signature with it.

1.11.0

• The field catalogue now has a Pro tier: Product, Calculation, Signature, Image
  choice, Likert matrix, NPS score and Repeater are part of Tiger Elements Forms Pro. The
  free plugin keeps 33 field types, including every layout block, consent,
  country/state and multi-step forms.
• A form created with those Pro fields stays intact on this build — the fields
  are preserved exactly as saved, they simply are not displayed.
• Fix: a Heading field with no explicit level produced invalid markup (“< >”)
  instead of a heading, and a PHP warning on every page view.

1.10.3

• Fix: a Name or Address field marked OPTIONAL could not be left blank — the form
  answered “First is required” for a field the visitor was never obliged to fill,
  so the form could not be submitted at all without completing it. The parts of an
  optional field are now optional; a required field is still enforced exactly as
  before. Forms already saved with this problem are repaired automatically on
  update.
• Fix: activating the plugin with WP-CLI or a deployment script created no
  database tables until someone opened wp-admin. In that window a page showed no
  form at all and submissions were rejected as an unknown form. Activation now
  builds the schema itself.
• Fix: importing from Fluent Forms dropped the “required” rule on a Name or
  Address field, because Fluent stores that rule on the individual parts. An
  imported form no longer silently accepts a blank name it used to reject.

1.10.2

• Fix: the Submissions screen showed “HTTP 404” and no entries on any site using
  plain permalinks. The builder appended its paging parameters with “?” to a REST
  root that already contained one, so the request never matched a route. Both
  permalink styles now work.
• Fix: opening a form whose stored field options were not in the expected list
  shape left the builder on a blank white screen with no message — a JavaScript
  error unmounted the whole editor. A malformed field now degrades to an empty
  option list and the rest of the form still opens.
• Fix: choice fields (select, radio, checkbox) whose options were written as a
  simple value => label map were silently dropped, producing a dropdown with no
  choices and radio buttons with no labels. Those options are now read correctly.

1.10.1

• The free build no longer ships any Pro module at all. The payment engine
  (gateway drivers, orchestrator, repository, webhook endpoint and the Payments
  settings screen), the integrations relay, the cloud storage drivers, the
  Build-with-AI connector and the licensing client are all excluded from it
  rather than shipped-but-inactive. Every call site checks whether the module is
  installed, so a form carrying payment settings — imported, or built on a Pro
  site — degrades to a normal submission instead of erroring, and the Payments
  and Integrations tabs simply do not appear.
• Security: saving an internal note on a submission required only the “view
  submissions” capability, so a read-only reviewer could edit stored submission
  data. It now requires the manage capability, matching every other write.
• Hardening: the visitor IP used for rate limiting and for the stored submission
  hash is now resolved and validated in one place instead of three copies, and is
  checked with FILTER_VALIDATE_IP before use. A malformed proxy header can no
  longer reach the rate-limit key. X-Forwarded-For remains opt-in via the
  TIGFORM_TRUST_PROXY constant, so it is still ignored by default.
• Confirmation prompts in wp-admin no longer use the browser’s window.confirm().
  Deleting a submission, following a delete link and issuing a refund now open the
  plugin’s own accessible dialog, with Escape and focus handling.
• Fix: admin CSS and JavaScript were versioned by a constant that only changes at
  release time, so browsers kept serving a cached copy after an update. They are
  now versioned by file modification time and refresh as soon as they change.

1.10.0

• wordpress.org compliance pass. The free build no longer contains any locked or
  license-gated feature: the Pro modules (payment gateways, cloud storage drivers,
  integrations relay, the Build-with-AI connector and the licensing client) are not
  shipped in it at all, and every remaining availability check now asks whether the
  code is installed rather than whether a licence is present.
• Multi-step forms are now part of the free plugin. Page breaks were always a free
  builder field and the free importers already preserved imported pages, so the
  feature shipped in full and was disabled only at the final render step — which
  silently flattened multi-page forms that had just been imported intact.
• All inline CSS and JavaScript now goes through wp_add_inline_style() and
  wp_add_inline_script(); no raw or tags are emitted anywhere, on
  the front end or in wp-admin.
• Runtime configuration printed into a script context is now encoded with the full
  JSON_HEX_* flag set, so no form content can terminate the surrounding tag.
• The free build makes no outbound request unless you enable one of the optional
  services now documented under “External services” in this readme. The daily
  licensing heartbeat is gone from the free build entirely.
• Everything the plugin stores moved from the tigelef_ prefix to tigform_ —
  tables, options, capabilities, cron events and hook names. Existing installs are
  migrated automatically on update, and the previous REST namespace and hook names
  keep working so cached pages and any custom code continue to function.

1.9.2

• Fix: a Fluent Forms form that uses column layouts (fields arranged in a two- or three-column row) imported as empty. Those fields are now read correctly, so the whole form comes across.

1.9.1

• Improved: importing a multi-page WPForms or Gravity Forms form now keeps its pages as a multi-step Tiger form. (Free shows it as a single page until you upgrade; no fields are lost.)

1.9.0

• New: the form importer now covers Forminator as well — fields, options and stored entries.
• New: Import all — migrate every form from a source plugin in one click.
• Improved: imported forms arrive with an email notification already set up, so a migrated form emails on submission without extra setup.
• Improved: Contact Form 7 imports keep your real field labels, read from the form markup.

1.8.1

• New: the form importer now supports Fluent Forms too — its fields, options and stored entries import the same way as the other sources.

1.8.0

• New: Import forms from other plugins. A new Tiger Elements Forms → Import screen migrates your existing forms in from Contact Form 7, WPForms, Gravity Forms and Ninja Forms — fields, options and settings — and, where the source plugin stores them, your past submissions too. Imported forms are created as drafts for review, and your other plugin is only read from — nothing in it is changed or deleted. Included free.

1.7.1

• Maintenance: removed the retired pre-Styler inline form widget and its internal settings-to-schema translator. Both were off by default and never shipped in a public release, so no saved form or page depends on them. The Styler widget, the [tiger_form] shortcode, the block and the Elementor widget are unaffected.

1.7.0

• New: set how wide a form is. There’s a Form width box in the builder (Form settings → General) for the form’s own default, and every placement can override it — [tiger_form id="1" width="800px"], the block’s Form width control, or Elementor → Style → Form container. Leave it empty and the form fills its container as before, so nothing changes until you ask for it.
• New: give a form your own CSS class, in Form settings → General, so you can style one particular form from your theme’s stylesheet without having to target it by id. Several classes can be separated with spaces.
• Fix: the Rating field showed an empty text box on the published form. The builder showed stars and the preview showed stars, but the live form shipped a plain text input, and whatever a visitor typed into it was stored as their rating. It now renders real stars — keyboard- and screen-reader-accessible — and an out-of-range value is rejected instead of being accepted.
• Fix: the Likert matrix side-scrolled inside its own box on phones, with nothing to indicate there was more to the right. On narrow screens each question is now its own labelled group with full-width options.
• Fix: dragging a field from the panel now drops it where you release it, including on a form long enough to scroll and on rows with two fields side by side.
• Fix: Form settings was cramped on a phone — the tab rail took up so much of the panel that every box in it was squeezed to roughly a third of the screen. The rail now collapses to icons on narrow screens and the panel uses the full width.
• Fix: the Form width box in the builder was rendering about 26px wide, with its unit dropdown taking the rest of the row.
• Fix: Elementor’s “Rating (selected)” style control had never done anything — it was pointing at markup this plugin doesn’t produce. It now styles the selected stars, and there’s a matching control for the empty ones.

1.6.3

• Fix: submissions could fail with “Cookie check failed”. The form sent WordPress’s page nonce along with the submission, and WordPress rejects the whole request when that nonce no longer matches the current session — which happens routinely on cached pages, on a tab left open for hours, or after logging in or out. The nonce was never used to authorise submissions (the form’s own signed token does that), so it is no longer sent and this error cannot occur.
• Fix: a payment-enabled form no longer shows “We could not start the payment” when the amount works out to zero — for example a price calculation whose paid option wasn’t chosen. Those submissions now complete normally instead of being stranded awaiting payment. Forms with a real amount are unaffected.
• Fix: the calendar icon now always sits at the right-hand edge of a date field. Themes and the Elementor Styler could override the field’s layout, which let the icon drift next to the text and move as the date changed.

1.6.2

• Fix: a Date, Time or Date/Time field added inside a Repeater row after the page loaded kept the old browser control instead of the new picker. Every row now gets the picker.
• Fix: when a required date field failed validation the page no longer moved focus to it, so keyboard and screen-reader users were left where they were. Focus now lands on the field that needs attention.

1.6.1

• Fix: dragging a field from the panel now really does drop it where you release it. The 1.6.0 fix only applied when the drop landed on a field’s own drop zone, which almost never happened for a new field dragged in from the panel — so it still fell to the end of the form.

1.6.0

• New: Date, Time and Date/Time fields now use a built-in picker instead of the browser’s native control. It opens from anywhere on the field (the native one only responded to its small calendar icon), looks the same in every browser, and follows your form’s colours in both light and dark styling. Date ranges set on the field are now actually enforced, and the calendar respects your site’s “week starts on” setting.
• New: the builder Preview renders that same picker, so what you see while building matches the published form.
• Fix: dropdown placeholders were never shown — a Select always displayed its first option instead, making the field look pre-answered. The placeholder now appears as an empty leading option, and can still be re-selected to clear the answer.
• Fix: the Preview’s Tablet and Mobile buttons had no effect on layout. Fields now stack exactly as they do on a real phone.
• Fix: Calculation fields and conditional logic that read a Multiselect or Checkboxes field now work on the published form. Previously a rule like “show when the multi-select is X” never triggered and a Calculation referencing a multi-select returned 0, because the front-end read those multi-value fields under the wrong key. Single-value fields (Select, Radio, Text, etc.) were unaffected.
• Fix: the builder Preview now evaluates Calculation fields. Every calculation previously rendered an empty value there, and per-option amounts from choice fields were ignored, so the preview total could not match the real one. Preview results now follow the same rules as the published form and the payment amount.
• Fix: fields dragged from the panel now drop where you release them instead of always landing at the end of the form, and every field gained up/down arrows for reordering without dragging.

1.5.1

• New: Calculation / payment values on choice fields — turn on “Use as calculation / payment value” on a Select, Radio, Checkbox, Checkboxes, Multiselect, Image choice or Toggle to give each option a number a Calculation field (and payments) can read. Submissions still store the readable option label.
• New: Matrix (Likert) columns can carry a numeric score that sums across rows into calculations.
• Fix: HTML, Heading, Divider and Consent fields could be saved as a plain text input (and rendered as one). They are now preserved correctly, get a Conditional-logic tab, and render properly in the builder Preview.

1.5.0

• New: Tiger Elements Forms Styler — a dedicated Elementor widget that renders a form you built in the Tiger Elements Forms builder and gives you the full set of style controls, just like the CF7 and Gravity Forms stylers. The older inline “Tiger Elements Forms Pro” builder widget is kept as a legacy option you can switch back on from Tiger Elements → Modules & Widgets.
• New: Multiple file uploads — turn on “Allow multiple files” (with a max-files limit) on any File field. Visitors can attach several files and remove any of them with a one-click bin that asks for confirmation first. The upload control is now a single button with the icon inside it.
• Fix: removing an uploaded file now actually drops it from the submission, drag-dropped files upload correctly, and the max-files limit is enforced.
• Fix: the Elementor Height and Textarea height style controls now resize fields properly (previously they could only grow, never shrink), and select/input text no longer clips at small heights.

1.3.0

• New: 12 more field types — Repeater (add/remove repeating rows of sub-fields), Likert matrix, NPS 0–10 scale, Section, Spacer, Image, Toggle switch, Colour picker, Country dropdown, State/Province dropdown, Whole number, and combined Date & time.
• New: Password field — masked input whose value is stored as a mask, never as plaintext.
• Fix: form styles now cache-bust automatically when the stylesheet changes (versioned by file mtime), so new field styling always ships.

1.1.0

• New: structural & trust fields — Heading, Divider (with or without a label), HTML block, and a GDPR Consent checkbox.
• New: Settings → General is fully wired — submission storage, retention & auto-anonymize, admin-email fallback, and detailed logging.
• Improve: builder polish — centered panel tabs and field-width controls.

1.0.13

• Fix: Outgoing email now authenticates reliably on any host. Tiger Elements Forms sets the SMTP envelope sender so SPF passes even under WP-Cron, defaults the From name to your site title (never “WordPress”), and stops an unauthenticated free-mail From address (e.g. a Gmail address) from silently blocking delivery when SMTP is off — the intended address is preserved as Reply-To. Native PHP mail stays the default; SMTP remains optional.

1.0.2

• Security: Form-builder access now requires a dedicated administrator capability instead of edit_posts.
• Security: Calculation fields are recomputed server-side; CSV exports neutralise spreadsheet formula injection.
• New: Tools → Server health card with recommended PHP limits, copy-paste fix snippets, SMTP detection and a one-click REST/WAF self-test.

1.0.1

• New: Optional built-in SMTP transport, disposable-email blocklist, polished admin UI.
• Fix: Text-domain corrected so translations load; refreshed accessible front-end styles.

1.0.0

• Initial release: visual builder, all field types, conditional logic, email notifications (with optional SMTP), local storage, anti-spam, submissions dashboard, GDPR tools, Elementor widget.