UltimaTour Contact Forms gives WordPress sites a complete form workflow: build forms visually, publish them anywhere, receive email notifications, keep submissions organized in WordPress, accept protected file uploads, and give visitors a clean, professional experience.<\/p>\n\n
And underneath the form is something different:<\/p>\n\n
Polymorphic Semantic Canary (PSC).<\/strong><\/p>\n\n PSC adds a concealed, signed request-integrity challenge that changes its behavior instead of relying on one predictable empty honeypot. Legitimate visitors never need to see it, solve it, click it, or interact with it.<\/p>\n\n PSC works alongside the plugin's other protection layers, including honeypot techniques, signed timing, rate limiting, duplicate detection, server-side validation, and optional CAPTCHA providers.<\/p>\n\n No single trick is treated as magic. The layers work together.<\/p>\n\n Contact Forms uses layered protection rather than betting everything on one mechanism.<\/p>\n\n Depending on your configuration, protection can include:<\/p>\n\n PSC is designed to detect unexpected mutation of concealed, signed form state. Its challenge can vary across several harmless patterns, making the hidden request state less predictable to automated systems while remaining invisible to ordinary visitors.<\/p>\n\n PSC is not marketed as a replacement for every other security control. It is another independent signal in the anti-spam decision process.<\/p>\n\n An important enquiry should not disappear simply because somebody missed an email.<\/p>\n\n Contact Forms can store legitimate submissions in WordPress, giving administrators a practical inbox for reviewing submitted information.<\/p>\n\n Need the data elsewhere?<\/p>\n\n Export it to CSV.<\/p>\n\n Need to handle a privacy request?<\/p>\n\n Contact Forms integrates with WordPress personal-data export and erasure mechanisms.<\/p>\n\n Configure administrator notifications and optional visitor confirmations.<\/p>\n\n Contact Forms supports reusable email variables so messages can include submitted information and business details without manually rewriting every notification.<\/p>\n\n When supported UltimaTour Operator shared services are available, Contact Forms can reuse appropriate Operator-owned configuration instead of unnecessarily creating duplicate infrastructure.<\/p>\n\n UltimaTour Operator is not required to use Contact Forms.<\/strong><\/p>\n\n Forms may include file uploads when your workflow requires them.<\/p>\n\n Uploaded files are handled as protected submission data and administrator downloads are subject to the plugin's access controls.<\/p>\n\n UltimaTour Contact Forms is useful as a contact-form plugin on its own.<\/p>\n\n It can also participate in the wider UltimaTour ecosystem.<\/p>\n\n When supported ecosystem services are available, Contact Forms can integrate with capabilities such as UltimaTour Operator and optional TrustEmporium functionality.<\/p>\n\n Those integrations do not replace the core purpose of the plugin:<\/p>\n\n Your forms must continue doing their job.<\/strong><\/p>\n\n Contact Forms is a complete standalone plugin, but it can also be your first step into a wider set of tools for operators and WordPress businesses.<\/p>\n\n Visit UltimaTour:<\/strong> https:\/\/www.ultimatour.com\/<\/p>\n\n Explore compatible products, documentation, downloads, and support:<\/strong> https:\/\/partner.ultimatour.com\/<\/p>\n\n These resources are optional. You do not need to register, purchase anything, or visit an external website to build, publish, receive, store, or export forms.<\/p>\n\n Because a contact form should not make you choose between:<\/p>\n\n easy for visitors<\/strong><\/p>\n\n and<\/p>\n\n harder for automation.<\/strong><\/p>\n\n Build the form.<\/p>\n\n Publish it.<\/p>\n\n Receive the enquiry.<\/p>\n\n Keep the record.<\/p>\n\n Let the protection layers work underneath it.<\/p>\n\n UltimaTour Contact Forms may communicate with external services for specific disclosed purposes. The plugin does not send ordinary form-submission contents to an external service merely because Contact Forms is installed.<\/p>\n\n If an administrator configures Cloudflare Turnstile, pages containing protected forms may load the provider's challenge resources and submit the resulting verification token for server-side validation.<\/p>\n\n Cloudflare's terms and privacy practices apply.<\/p>\n\n Privacy policy: https:\/\/www.cloudflare.com\/privacypolicy\/\nTerms: https:\/\/www.cloudflare.com\/website-terms\/<\/p>\n\n If an administrator configures Google reCAPTCHA, pages containing protected forms may load Google's challenge resources and submit the resulting verification token for server-side validation.<\/p>\n\n Google's terms and privacy practices apply.<\/p>\n\n Privacy policy: https:\/\/policies.google.com\/privacy\nTerms: https:\/\/policies.google.com\/terms<\/p>\n\n TrustEmporium enrichment is optional and advisory. It does not replace form validation, PSC, CAPTCHA, honeypot protection, rate limiting, upload validation, duplicate detection, notification delivery, or administrator review. A TrustEmporium warning does not automatically delete or reject an otherwise legitimate submission.<\/p>\n\n When UltimaTour Operator exposes a supported TrustEmporium service, Contact Forms reuses that Operator-owned service and does not request duplicate credentials or create a parallel TrustEmporium configuration.<\/p>\n\n In standalone mode, an administrator can deliberately select Connect and Provision TrustEmporium<\/strong> inside Contact Forms to create or recover the site-specific TrustEmporium partner contract and business account. Manual partner-key and shared-secret entry remains available only as an advanced recovery path.<\/p>\n\n Standalone setup calls The standalone connection test calls Submission enrichment is lookup-only and calls The administrator-initiated setup action above is the only Contact Forms workflow that asks TrustEmporium to create or recover a business account. After setup, remote submission enrichment is lookup-only. It does not send CAPTCHA secrets, TrustEmporium access keys, passwords, raw PSC values, PSC source words, uploaded-file contents, complete submission payloads, or private plugin credentials, and it does not ask TrustEmporium to create customer, lifecycle, event, advisory-write, or additional business-provisioning records.<\/p>\n\n In Operator mode, Contact Forms may resolve a local Operator customer context and record local Operator audit or customer-timeline events for the submission workflow. Those local integrated records are separate from TrustEmporium advisory lookup data. Remote enrichment is skipped when Contact Forms health, integrity, compatibility, or local PSC state requires review; the underlying submission continues through its normal storage and notification workflow.<\/p>\n\n Service operator: TE Systems LLC<\/p>\n\n Connected-service privacy and terms: https:\/\/partner.ultimatour.com\/privacy-terms\/<\/p>\n\n When UltimaTour Operator is active and communication-capable, Contact Forms adds its module status to the existing Operator-owned heartbeat. It does not create a second Operator heartbeat or a parallel direct Mothership client.<\/p>\n\n When Operator is absent or not communication-capable, Contact Forms may use its disclosed standalone control-plane route for Contact Forms integrity and connected-service health reporting when that route is configured or required by an enabled connected service.<\/p>\n\n The Contact Forms heartbeat block may report the module slug, module version, compatibility state, integration mode, reporting reason, health status, non-secret protected-file hashes, PSC package fingerprint, PSC generation and status, TrustEmporium enabled\/configured status, and timestamp.<\/p>\n\n Heartbeat reporting does not include form-submission values, visitor messages, uploaded files, CAPTCHA tokens, secrets, passwords, raw PSC values, or PSC source words.<\/p>\n\n Service operator: TE Systems LLC<\/p>\n\n Connected-service privacy and terms: https:\/\/partner.ultimatour.com\/privacy-terms\/<\/p>\n\n PSC is a concealed request-integrity layer. It renders three signed hidden integrity fields from an active package and can detect malformed, expired, duplicated, replayed, copied, swapped, or rewritten integrity evidence. Legitimate visitors do not need to see, solve, click, or interact with it.<\/p>\n\n Every installation retains three persistent 32-word local PSC artifacts outside the plugin folder so local form protection continues during remote-service failure. Standalone installations use the included local PSC capability.<\/p>\n\n Operator-connected installations may receive signed, installation-bound PSC data through the existing Operator heartbeat. Contact Forms verifies the Ed25519 signature, trusted key ID, fingerprint, installation UUID, version, issue and expiry state, exact package shape, replay state, and delivery route before atomic activation. An invalid package never replaces the active package.<\/p>\n\n PSC packages contain data only. Contact Forms does not download remote PHP or JavaScript as part of PSC, and visitor submission contents are not transmitted to obtain a PSC package.<\/p>\n\n Service operator: TE Systems LLC<\/p>\n\n Connected-service privacy and terms: https:\/\/partner.ultimatour.com\/privacy-terms\/<\/p>\n\n Contact Forms may store information submitted through forms, including personal information selected by the site administrator when designing those forms.<\/p>\n\n Site administrators are responsible for configuring their forms and privacy notices appropriately for their own use.<\/p>\n\n Contact Forms integrates with WordPress personal-data export and erasure mechanisms for relevant stored plugin data.<\/p>\n\n Administrators should review the External Services section above when enabling third-party or ecosystem integrations.<\/p>\n\n Sensitive credentials and private authentication material should not be exposed through ordinary diagnostics.<\/p>\n\n\n For a clean-install functional test, steps 1 through 6 are sufficient. No external account or remote-service connection is required.<\/p>\n\n\n No. UltimaTour Contact Forms can operate as a standalone contact-form plugin.<\/p>\n\n When a compatible UltimaTour Operator installation is available, Contact Forms can reuse supported shared ecosystem services rather than duplicating them.<\/p><\/dd>\n PSC stands for Polymorphic Semantic Canary.<\/p>\n\n It is a concealed request-integrity layer used as part of Contact Forms' anti-spam system. The browser receives signed hidden state that legitimate visitors do not need to see or interact with. Unexpected changes to that state can become a spam or automation signal.<\/p>\n\n PSC works alongside the plugin's other protection mechanisms rather than replacing them.<\/p><\/dd>\n No. PSC is not a visible puzzle or checkbox that a legitimate visitor needs to solve.<\/p><\/dd>\n No. PSC is one layer in a broader anti-spam system. Administrators may also configure supported CAPTCHA providers where appropriate.<\/p><\/dd>\n Yes, where those providers are configured in Contact Forms or made available through a supported shared integration.<\/p>\n\n Use of those services is subject to the respective provider's terms and privacy practices.<\/p><\/dd>\n Yes. Contact Forms includes submission management so legitimate enquiries can be retained and reviewed from the WordPress administration area.<\/p><\/dd>\n Yes. Forms can include supported file uploads, with protected administrator-side retrieval.<\/p><\/dd>\n Yes. Submission data can be exported to CSV.<\/p><\/dd>\n Yes. Contact Forms integrates with WordPress personal-data export and erasure workflows for relevant stored personal data.<\/p><\/dd>\n Yes. Visitor confirmation emails can be configured separately from administrator notifications.<\/p><\/dd>\n No. TrustEmporium functionality is separate from the normal form-validation and anti-spam controls. Where supported TrustEmporium capabilities are enabled, they are used according to the integration's disclosed purpose and do not replace ordinary form validation.<\/p><\/dd>\nEverything you actually need from a contact form<\/h4>\n\n
\n
Spam protection that does more than add another checkbox<\/h4>\n\n
\n
Your submissions belong in WordPress<\/h4>\n\n
Professional email without rebuilding everything twice<\/h4>\n\n
Secure uploads<\/h4>\n\n
Start standalone. Connect when it is useful.<\/h4>\n\n
Ready to explore more?<\/h4>\n\n
Why UltimaTour Contact Forms?<\/h4>\n\n
External Services<\/h3>\n\n
Cloudflare Turnstile<\/h4>\n\n
Google reCAPTCHA<\/h4>\n\n
TrustEmporium<\/h4>\n\n
\/te\/v1\/partner\/contact-forms\/self-issue-contract<\/code>. TrustEmporium verifies setup by requesting \/wp-json\/ultimatour-contact-forms\/v1\/trustemporium\/onboarding-verification\/{token}<\/code> from the installing site before issuing credentials or provisioning the business account. Setup may transmit the site URL, home URL, canonical domain, installation ID, plugin version, business name, primary contact email, locale, timezone, generated external business ID, verification URL, and verification-token hash.<\/p>\n\n\/te\/v1\/partner\/ping<\/code> only to confirm authentication. It does not create or refresh TrustEmporium records.<\/p>\n\n\/te\/v1\/partner\/lookup<\/code>. A lookup may include the form ID, form name, submission ID, submitted contact name, submitted email address, submitted phone number, source URL, site identifier, request ID, correlation ID, idempotency key, and timing metadata.<\/p>\n\nUltimaTour Contact Forms heartbeat<\/h4>\n\n
PSC managed data<\/h4>\n\n
Privacy<\/h3>\n\n
\n
\n
Is UltimaTour Operator required?<\/h3><\/dt>\n
What is PSC?<\/h3><\/dt>\n
Will visitors see a PSC challenge?<\/h3><\/dt>\n
Does PSC replace CAPTCHA?<\/h3><\/dt>\n
Can I use Cloudflare Turnstile or Google reCAPTCHA?<\/h3><\/dt>\n
Are submissions stored in WordPress?<\/h3><\/dt>\n
Can visitors upload files?<\/h3><\/dt>\n
Can I export submissions?<\/h3><\/dt>\n
Does the plugin support WordPress privacy requests?<\/h3><\/dt>\n
Can I send a confirmation to the person who submitted the form?<\/h3><\/dt>\n
Does TrustEmporium decide whether a contact form submission is accepted?<\/h3><\/dt>\n