{"id":350893,"date":"2026-08-12T06:36:30","date_gmt":"2026-08-12T06:36:30","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/quarivo-form-shield\/"},"modified":"2026-08-12T06:35:50","modified_gmt":"2026-08-12T06:35:50","slug":"quarivo-form-shield","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/quarivo-form-shield\/","author":20704823,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.1","stable_tag":"1.0.1","tested":"7.0.4","requires":"6.7","requires_php":"7.4","requires_plugins":null,"header_name":"Quarivo Form Shield","header_author":"\u83c5\u539f\u9686\u5fd7","header_description":"A local Contact Form 7 inbox that preserves inquiries, records mail handoff results, and quietly quarantines only high-confidence spam.","assets_banners_color":"f9f6ef","last_updated":"2026-08-12 06:35:50","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"","header_author_uri":"","rating":0,"author_block_rating":0,"active_installs":0,"downloads":27,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.1":{"tag":"1.0.1","author":"taka235345","date":"2026-08-12 06:35:50"}},"upgrade_notice":[],"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3642921,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3642921,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3642921,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3642921,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.1"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[358,1152,267,4040,599],"plugin_category":[41,54],"plugin_contributors":[254022],"plugin_business_model":[],"class_list":["post-350893","plugin","type-plugin","status-publish","hentry","plugin_tags-contact-form","plugin_tags-contact-form-7","plugin_tags-email","plugin_tags-inbox","plugin_tags-spam","plugin_category-communication","plugin_category-security-and-spam-protection","plugin_contributors-taka235345","plugin_committers-taka235345"],"banners":{"banner":"https:\/\/ps.w.org\/quarivo-form-shield\/assets\/banner-772x250.png?rev=3642921","banner_2x":"https:\/\/ps.w.org\/quarivo-form-shield\/assets\/banner-1544x500.png?rev=3642921","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/quarivo-form-shield\/assets\/icon-128x128.png?rev=3642921","icon_2x":"https:\/\/ps.w.org\/quarivo-form-shield\/assets\/icon-256x256.png?rev=3642921","generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p>Quarivo Form Shield adds an independent, local inbox for Contact Form 7. It stores a reviewable record before Contact Form 7 attempts email, so a local mail error does not make the original inquiry disappear.<\/p>\n\n<h4>The important distinction<\/h4>\n\n<p>WordPress can report that its mail method processed a request without an error. That is not a mailbox delivery receipt. Quarivo Form Shield therefore shows <strong>Mail handoff accepted \u2014 delivery not verified<\/strong> separately from a mail error, skipped spam mail, and mail that was not attempted.<\/p>\n\n<h4>Conservative spam handling<\/h4>\n\n<ul>\n<li>Balanced mode is the default and treats every language equally.<\/li>\n<li>Japanese-site enhanced and Strict Japanese modes are explicit administrator choices.<\/li>\n<li>One URL, one foreign-language message, missing JavaScript, or a public email address does not cause automatic quarantine by itself.<\/li>\n<li>Compound signals include URL\/link structure, a honeypot, browser-observed timing, local rate evidence, repeated promotion structure, executable markup, and bounded local moderator feedback.<\/li>\n<li>Only high-confidence Quarivo results are quietly quarantined. Lower evidence stays visible as <strong>Needs review<\/strong> and ordinary mail remains available.<\/li>\n<li>Akismet, reCAPTCHA, Cloudflare Turnstile, Flamingo, and other Contact Form 7 decisions are not disabled or overwritten. An existing spam result remains spam.<\/li>\n<li>No message is automatically deleted.<\/li>\n<\/ul>\n\n<h4>Local inbox<\/h4>\n\n<p>The responsive WordPress administration inbox provides:<\/p>\n\n<ul>\n<li>All, unread, read, important, normal, needs review, auto-quarantined, spam, mail-error, and invalid counts.<\/li>\n<li>Search, form filtering, 25\/50\/100-row pagination, and bounded per-page bulk actions.<\/li>\n<li>Full submitted fields, source form\/page, sender information, score\/reasons, Contact Form 7 status, and mail-processing status.<\/li>\n<li>Reversible normal\/review\/spam decisions and local learning from explicit moderator choices.<\/li>\n<li>A deliberate plain-text resend to the validated site administrator address. Submitted data is never reused as an email header and attachments are not automatically resent.<\/li>\n<li>Private JSON and formula-safe CSV export.<\/li>\n<\/ul>\n\n<h4>Failure-safe storage<\/h4>\n\n<p>The first database insert occurs before validation, spam handling, upload processing, and email. Later Contact Form 7 hooks enrich the same unique row, preventing duplicate records from one request.<\/p>\n\n<p>If a database write fails, Quarivo retries before mail, writes an authenticated-encrypted local recovery record, shows an administrator health warning, and processes a small recovery batch when the database becomes available. The original mail path is left available. A simultaneous database, private-filesystem, and mail outage cannot be made loss-free by an in-process plugin; Quarivo reports that failure instead of silently claiming success.<\/p>\n\n<h4>Protected attachments<\/h4>\n\n<p>Validated Contact Form 7 temporary uploads are copied before Contact Form 7 removes them. Quarivo enforces a 25 MB default storage limit and stores each file as AES-256-GCM authenticated ciphertext under a random opaque name in a protected plugin directory inside the site's configured WordPress uploads directory. It does not create a public attachment URL. A capability and nonce checked administrator request verifies and decrypts a download. If authenticated encryption or private storage is unavailable, Quarivo does not retain the attachment and displays a storage warning.<\/p>\n\n<h4>Privacy and retention<\/h4>\n\n<ul>\n<li>No API key, CAPTCHA, remote request, telemetry, external font, or third-party asset is required by Quarivo Form Shield.<\/li>\n<li>Password, token, API-key, PIN, CVV, and card-number-like field names are redacted automatically. Administrators can add exact excluded field names.<\/li>\n<li>Contact Form 7 do-not-store and storage-consent metadata is respected: operational metadata may remain, but submitted field values are not copied when the form prohibits storage.<\/li>\n<li>Visible IP storage defaults to anonymized. Full IP display is opt-in; a keyed local hash supports rate checks.<\/li>\n<li>Read, non-important entries and encrypted attachments have separate retention controls. Unread and important entries are not removed by scheduled entry retention.<\/li>\n<li>WordPress personal-data export and erasure tools include exact sender-email matches.<\/li>\n<li>Plugin deletion retains data by default. Permanent removal must first be selected in settings and confirmed by typing DELETE.<\/li>\n<\/ul>\n\n<h4>Contact Form 7 dependency<\/h4>\n\n<p>Contact Form 7 is not bundled. If it is absent or inactive, Quarivo Form Shield does not cause a fatal error. The existing inbox remains available and a clear administrator notice explains that new capture is paused.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Install and activate Contact Form 7.<\/li>\n<li>Upload the <code>quarivo-form-shield<\/code> folder to <code>\/wp-content\/plugins\/<\/code>, or install its ZIP from <strong>Plugins &gt; Add New &gt; Upload Plugin<\/strong>.<\/li>\n<li>Activate <strong>Quarivo Form Shield<\/strong>.<\/li>\n<li>Open <strong>Form Shield &gt; Inbox<\/strong>. Balanced protection and local capture require no API key or external account.<\/li>\n<li>Review <strong>Form Shield &gt; Settings<\/strong> for retention, field exclusions, and your privacy notice.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20%E2%80%9Cmail%20handoff%20accepted%E2%80%9D%20mean%20the%20inquiry%20reached%20the%20recipient%3F\"><h3>Does \u201cmail handoff accepted\u201d mean the inquiry reached the recipient?<\/h3><\/dt>\n<dd><p>No. It means the local WordPress mail method processed the request without reporting an error. A downstream mail server can still reject, quarantine, delay, or misroute it. The saved inbox record is the reliable local copy.<\/p><\/dd>\n<dt id=\"does%20the%20plugin%20require%20flamingo%3F\"><h3>Does the plugin require Flamingo?<\/h3><\/dt>\n<dd><p>No. Quarivo Form Shield has its own tables and inbox. If Flamingo is active, Quarivo does not change or delete Flamingo records.<\/p><\/dd>\n<dt id=\"does%20it%20send%20inquiry%20data%20to%20an%20ai%20or%20external%20api%3F\"><h3>Does it send inquiry data to an AI or external API?<\/h3><\/dt>\n<dd><p>No. Scoring, storage, learning, and review stay on the WordPress site.<\/p><\/dd>\n<dt id=\"can%20i%20restore%20a%20false%20positive%3F\"><h3>Can I restore a false positive?<\/h3><\/dt>\n<dd><p>Yes. Mark it Normal or Needs review in the inbox. The record is never automatically deleted, and explicit Normal feedback can slightly reduce matching soft structural evidence in the future.<\/p><\/dd>\n<dt id=\"what%20happens%20to%20data%20when%20i%20delete%20the%20plugin%3F\"><h3>What happens to data when I delete the plugin?<\/h3><\/dt>\n<dd><p>It is retained by default. To remove Quarivo tables, settings, encrypted attachments, fail-safe files, and learning data during plugin deletion, first open <strong>Form Shield &gt; Settings<\/strong>, select permanent deletion, type DELETE, and save. Contact Form 7 forms and Flamingo data are never deleted by this option.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.1<\/h4>\n\n<ul>\n<li>Uses the configured WordPress uploads directory for encrypted private storage and fail-safe recovery files.<\/li>\n<li>Uses WordPress.org language packs instead of bundled translation files.<\/li>\n<li>Limits activation and operational notices to the Plugins screen and Quarivo Form Shield screens.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>First public-review candidate focused on deep Contact Form 7 capture.<\/li>\n<li>Adds server-bound request identity, bounded hostile-input processing, guarded private-storage roots, attachment memory checks, resend throttling, and concurrency-safe fail-safe recovery.<\/li>\n<li>Passes the official Plugin Check with no reported errors or warnings.<\/li>\n<\/ul>\n\n<h4>0.1.0<\/h4>\n\n<ul>\n<li>Initial private local-test build.<\/li>\n<li>Adds pre-mail inbox persistence, final mail-result tracking, conservative compound scoring, protected attachments, encrypted database-failure recovery, privacy tools, retention, review, resend, export, and explicit uninstall controls.<\/li>\n<\/ul>","raw_excerpt":"Keep Contact Form 7 inquiries in a local review inbox, even when mail sending fails, and quietly quarantine only high-confidence spam.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/350893","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=350893"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/taka235345"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=350893"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=350893"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=350893"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=350893"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=350893"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=350893"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}