LocalForm – Form Builder for Contact Forms, Surveys & Event Registration

Ŝanĝprotokolo

2.7.0

• A form can now count down its remaining places out loud. Tick “Show how many places are left” under Registration Limits and the form prints “12 places left” with the event facts, dropping as registrations arrive. It is off unless you ask for it, because on an event with two hundred seats and three registrations, saying so in public advertises how empty it is – and it counts exactly what your maximum counts, so a form set to count only paid registrations does not take a place off the number for a checkout somebody walked away from.
• Events can now say when they end, and where they are joined. The Event Details panel has an Ends date and time – for a school running over three days, or an evening that finishes at half nine – and an Online link for a meeting or a stream. The end is what the calendar file attached to a confirmation now runs until, instead of the hour it used to assume. The joining link is deliberately not printed on the form page: a meeting link on a public page is a meeting anybody can walk into, so it goes to the people who registered, in their confirmation email and in their calendar entry, where it becomes the location their calendar puts a join button on. Emails can use it as {event_url}, along with {event_when}, {event_time} and {event_location}.
• A form with an event date now describes that event to search engines, in the head of its own page: what it is called, when it runs, where, who is organising it, what it costs and whether it is still open or sold out. This is what lets a registration form be listed as an event rather than as an ordinary page – the facts were always on the page, and until now only a person could read them. It is written on the form’s own page and nowhere else, so a form you embedded in a page of your own is left to that page; unticking “Show event card on form page” switches it off along with the card, because it is the same facts in another format; and the joining link of an online event is never part of it. A price is published only when your currency symbol names one currency for certain – “kr” is three countries’, so it is left out rather than published as the wrong money.
• The paid add-on’s Pro page now also mentions mailing lists, which it has gained: a form there can add the person who filled it in to a list at Flexmail, Brevo, MailerLite or Mailchimp, gated on a consent question on the form itself. Nothing in the free plugin changed to make room for it – as always, no feature here is limited, disabled or timed, and the free plugin still makes no outbound request of its own beyond the webhook URL you type in yourself.
• The paid add-on is now easier to find, without anything in the free plugin being held back to make you look for it. The pointer that used to appear only on the forms list can now also appear on Responses; the Settings page carries a small card at the foot of its section menu saying what Pro adds; and LocalForm’s own screens end with one line in the WordPress footer instead of the usual “Thank you for creating with WordPress”, with the space under the page it needs so it does not sit against whatever the screen ends with. None of it is a notice you have to close, none of it sits next to a setting you cannot use, and nothing on your site is limited, disabled or timed by any of it – every feature you have stays free and unlimited, as before. The forms-list pointer now also waits its turn when the review request is due, so you are never asked two things on one screen, and all of it still disappears the moment Pro is installed or the localform_show_promotions filter says no.
• The builder can now show you the form itself. A Preview button in the toolbar, next to the diagram, swaps the questions you are editing for the page a visitor gets – your colours, your font, your logo, the event details band, the step-by-step navigation, and every edit on screen at that moment, since nothing has to be saved first. It is the real front end rather than an impression of it: the same rendering your visitors get, in a frame of its own so the WordPress admin’s own styling cannot repaint it, with a Desktop/Mobile switch for checking the width most people will actually be on. Nothing filled in there is sent or stored. And a form that is closed, full, not open yet or still a draft previews as its questions, with a line above saying what visitors would be seeing instead – because building a form ahead of the day it opens is exactly when you need to look at it.
• Spam protection now reads what was actually submitted, not only where it came from. A new content filter rejects a submission carrying more links than you allow (five by default – a number no honest answer reaches), one containing a word or phrase from your own blocklist, or one mentioning an email domain you have had enough of; addresses are found anywhere in a submission, so a bot that buries its address in the middle of a message is caught too. There is an IP blocklist for the client that keeps coming back, checked before anything else. This is the layer that catches spam sent through a real browser, which passes every invisible check because a real browser genuinely did open your form.
• Every rejection is now written down. Forms > Settings > Security > Blocked attempts lists what was turned away, from which form and why, with a summary of the last seven days. Until now every one of these failed silently: you could not tell whether the protection was doing anything, and – more to the point – you could not tell when it was catching a real visitor whose browser blocks the check. No IP addresses are stored; each entry carries a one-way hash of the sender’s address, so repeat attempts group together on screen without your site keeping anyone’s address. Entries are deleted after 30 days.
• An optional challenge for a site under sustained attack: Cloudflare Turnstile or hCaptcha, off until you enter keys for one. It is best used on the recommended setting, where nobody sees a challenge until their own device has already tripped the automated checks a couple of times – an ordinary visitor never meets one, and their page loads nothing from the provider at all. Solving a challenge resends what was already filled in, so nothing is retyped, and one solved challenge stands for half an hour.
• A form can now have its own spam settings instead of the site’s. Switch it on in the builder’s Spam Protection card for the two forms that never fitted one set of numbers: the internal form a whole office fills in from one shared IP address, where the site-wide rate limit locks out the tenth colleague to try, and the one public form being hammered, where you want a challenge without imposing one on everything else. Switching the override on starts from the site’s current values so you can see what you are taking over.
• Answers now have a maximum length. Nothing stopped one request putting megabytes of text into a single answer, which was then stored, emailed and posted to your webhook again on the way out. Long text accepts 5000 characters, short text 1000, and a question can set its own limit in the builder – useful where an answer has to be short, or honestly needs more room. The limit applies on screen as well as on the server, so somebody typing runs out of room rather than being told off after submitting. Oversized and absurdly nested requests are now turned away before they are even read.
• The minimum fill time – how quickly after a form loads a submission is treated as automated – is now a setting rather than something only a developer could change, under Forms > Settings > Security. Raise it for a long form; set it to 0 to accept any speed while keeping the rest of the browser check.
• Forms you built somewhere else can be brought over instead of typed again. A new Forms > Import screen reads the forms Contact Form 7 and WPForms have on this site – neither plugin needs to still be active, because their forms stay in the database after they are switched off, which is exactly the moment you want them – and rebuilds a Google Form from the share link you paste in. The questions come across with their wording, their type, their options and which ones are required; Contact Form 7 keeps its field names, so a webhook built against the old form goes on receiving the same keys. Everything lands as a draft with a page of its own and a report saying plainly what could not be brought across – a file upload question, a Google Forms grid, a Name field that had to become one question instead of two – so you correct it before anyone can fill it in rather than afterwards. Responses already collected are not touched and do not come across; they stay in the plugin that took them. Importing a Google Form is the only time LocalForm fetches anything from the internet, it only happens when you press the button, only Google’s own form addresses are ever fetched, and pasting the page source instead skips the request altogether.
• Forms and their response counts are now read through WordPress’s object cache. On a site running a persistent cache – Redis, Memcached, or what most managed hosts switch on by default – the query behind every page that shows a form is answered from memory instead of the database, and a form with a capacity limit stops counting its responses afresh on every visit. Sites without one still save the repeated lookups a single page load was making. Nothing is cached across a change: saving a form, deleting one, flipping Accepting responses, or a new response arriving all take effect on the very next page view, as before.
• Getting started is now a guided path rather than an empty screen. Activating the plugin takes you straight to Forms, and its row on the Plugins screen has a “Create a form” link. A site with no forms yet is greeted with the starter templates as the screen itself, instead of an empty six-column table under a collapsed panel you had to find and open. And the first form you save now tells you what to do with it: its public link and its shortcode, each with a copy button, plus a prompt to send yourself a test email while it still matters – a form that emails you on every response is worth checking before the first one arrives, because plenty of hosts send no mail at all and nothing says so until somebody’s answer goes missing. All of it appears once, on this plugin’s own screens.
• Screen readers can now make sense of every question on a form. A question built from several inputs – a set of tick boxes or radio buttons, a star rating, a date range – carried a label pointing at an element that did not exist, so the question itself was never read out: somebody on a screen reader heard the options with nothing saying what was being asked. Those questions now name themselves properly, a date range says which box is the start and which is the end, and a consent tick box is read as the statement you are agreeing to rather than that statement run together with the field’s label. Every field is also tied to its own error message, so a question that comes back rejected is read out with the reason attached instead of leaving the visitor to hunt for it, and a failed submission announces itself as an error rather than as a passing status update. Nothing about how a form looks or behaves otherwise has changed.
• The form editor can now be cut down to the features your site actually uses. Forms > Settings > General > Form Builder lists what the editor is able to show – tags, event details, access, registration limits, per-form spam settings, quiz, email notifications and custom fields – and unticking one takes it out of every form editor on the site. It is for the common case where the person setting the site up is not the person building the forms: a colleague who only ever collects sign-ups should not have to read past a quiz answer key and a webhook payload to find the question they came for. Everything starts ticked, so nothing changes until you decide it should. Hiding is not clearing, exactly as with light mode – a form set up while a feature was on keeps everything it stored and goes on working, a registration cap still applies and a confirmation email still goes out, and ticking the feature again brings its settings back untouched. Switching off the per-form spam settings hides only that override; the site-wide protection under Settings > Security keeps running for every form.
• The Access card in the form builder is drawn as the set of choices it is again. Its role tick boxes were stretched to the full width of the card and bordered like text boxes, with each role’s name set underneath as a small bold caption, and the three access modes above them had lost their layout the same way. Settings cards now leave tick boxes and radio buttons their own size, so any card can hold a choice without restating it.
• The pointer to the paid add-on on the forms list now answers the need the site has actually shown, instead of appearing purely because two forms exist. A site with an event date or a price on a form is told that Pro can take the payment along with the registration; a site with a form long enough that conditional fields would shorten it is told about those. Sites with neither signal see the line they saw before, at the same point they saw it before, so nobody is shown more of this than they were – it is the same one notice, on the same one screen, with the same permanent dismissal, saying something the reader has a reason to care about.
• LocalForm Pro can now be tried for 14 days without a card, and the Pro page says so above the link to the price.
• The launch discount is 70% off the first year, and the offer now says so. It previously read as coming off every renewal for the life of the subscription, which was never how the coupon was meant to work.
• The pointer to the paid add-on now recognises three more things a site has already done, so the one sentence it shows is more often the one worth reading: a form nearly at its maximum is told a waiting list exists, a form with a newsletter tick box on it is told about mailing lists, and somebody who has exported responses by hand three times is told those can be emailed out on a schedule instead. All of it is read off your own forms at the moment the notice is considered – nothing is profiled and nothing is reported anywhere – and it is still the same single notice, on the same two screens, with the same permanent “Don’t show this again”.
• The Pro page now shows where the line between free and paid actually falls, job by job, alongside what the add-on adds – including what the free plugin already does about each one, written to be read rather than to look thin. It also answers the four questions people ask before buying, and the launch offer now says how many days of it are left rather than only the date it closes.
• An import that has to leave a question behind now says whether the add-on happens to have it. A Contact Form 7 or WPForms form with a file upload or a payment field has always been reported honestly as something LocalForm cannot ask for; the report now adds one sentence at the end naming where that question does exist. It is a footnote to the report and nothing else – nothing on the Import screen is disabled, the imported form is finished and usable either way, and questions Pro has no answer for either (a signature, a Google Forms grid) are not mentioned at all.
• You can now credit LocalForm under your forms, if you want to. Settings > General > Credit LocalForm under my forms adds a small “Powered by LocalForm” line below every form, linking to localform.dev. It is off unless you switch it on, nothing about the form changes either way, and the link carries nothing about your site – no identifier, no campaign parameter, and nobody who follows it is reported back to you or to us.

2.6.1

• Fixed: saving a form in the editor looked like it had done nothing. The “Form saved.” notice was there, but WordPress moves every admin notice to just below the first heading on the screen, and the only heading the editor has is the one on the diagram panel – which is hidden until you open the diagram. So the confirmation was moved out of sight, and it turned up later on the diagram instead. The editor now says where its notices belong, and the confirmation appears at the top of the page where you saved.

2.6.0

• Fixed: on a site that had never saved its settings before, the first save of Settings > General > Access recorded the roles you ticked but did not actually grant them. The screen came back looking right, yet the permissions themselves were only written the second time you pressed Save – so a colleague you had just given View responses to could still be turned away from the responses screen. The first save now takes effect like any other.
• The developer reference – every hook and filter LocalForm offers an add-on – is now published at docs.localform.dev under Developer, alongside the REST API and MCP pages. It used to live only in the source repository, which nobody outside the team can open, so the pages that pointed at it were pointing at a file the reader could not reach. Nothing in the plugin changed.
• Forms can be restricted to the people who should be filling them in. A new Access card on the form’s Settings tab offers three choices – anyone with the link, anyone signed in to the site, or only the roles you tick – with your own message for whoever is turned away. Somebody who is merely signed out gets a sign-in button that brings them back to the form; somebody signed in with the wrong role does not, since it would only return them to the same page. The refusal is enforced on the server rather than merely hidden in the page, and the shortcode, the block and the form’s own page are all covered, because the check sits in the same place the closing dates and the capacity limit do. A restricted form is kept out of page caches, so a cache cannot serve it to the wrong person, and its description and event card are held back along with the questions – only the title is shown, so a members-only form does not publish what it is about to everyone with the link. Anyone who can manage forms is let through any restriction, so a form can be previewed without keeping a test account, with a notice above it saying plainly that everybody else is being turned away. The forms list marks restricted forms, and the editor warns you if a form is limited to a role that no longer exists – which would otherwise stop it collecting anything without saying so.
• Responses now record which account left them, whenever somebody was signed in. A “Submitted by” column appears in the responses list, in the Excel and CSV exports and on the printout – but only on a form that actually has one, so nothing changes for a public form, and switching a login gate off later does not hide the names already collected. It is a name to read and nothing more: no permission anywhere is decided by it. The webhook payload carries the account’s ID as user_id (null when nobody was signed in), Tools > Export Personal Data and Tools > Erase Personal Data find responses by the account as well as by an address written in an answer – which is the only way to reach a response to a form that never asked for one – and an AI assistant connected over MCP can set all three settings, as access, access_roles and access_message.
• Fixed: the FAQ in this readme still said LocalForm could not do scored or graded quizzes, and sent anyone who wanted one elsewhere. Quiz mode has been in the plugin since it was described three sections further up; the answer was simply never rewritten.
• Fixed: the section menu down the side of a form’s Settings tab highlighted the wrong entry. Custom Fields is hidden while a form is in light mode, and a hidden card measures as sitting above everything on the page, so the menu marked a section nobody could see as the one being read – and left it marked however far you scrolled. Hidden sections are now left out of the menu altogether, the entry you land on at the bottom of the page is the one that lights up, and flipping the light mode switch updates the menu straight away.
• Fixed: the Stop accepting link on the forms list read its parameter from the URL without unslashing it first. Harmless in practice – the value is compared against “1” and the action is nonce-checked – but it is the kind of shortcut that stops being harmless when the code around it changes.
• Roles and permissions. Until now every LocalForm screen required a site administrator, so the colleague who reads the registrations had to be given the run of the whole site to do it. LocalForm now has two permissions of its own – View responses, and Manage forms – and Settings > General > Access gives either to any role. Someone with View responses gets the responses screen in full (filters, summary, exports, printouts) and a read-only forms list to reach it by; they cannot build, delete or configure anything. Managing forms includes viewing responses. They are ordinary WordPress capabilities, so Members, User Role Editor and the like list them too. Nothing changes for existing sites: anyone who could administer the site keeps both.
• The admin menu now carries a count of the responses that arrived since you last looked, the way WordPress counts pending comments, and the forms list marks which form they came in on. Opening a form’s responses clears its share of the count. It is per person rather than per site, and it starts from zero on an existing site: installing this does not report ten years of history as new.
• An Accepting responses switch per form, under Registration Limits and as a Stop accepting link on the forms list. It closes the form on the spot – visitors see the closed message – whatever its opening and closing dates say, and switching it back on picks up where you left off. Nothing already collected is touched. An AI assistant connected over MCP can set it too.
• Email now has a delivery log, the way webhooks always have. Every notification and confirmation LocalForm sends is recorded under Settings > Email > Delivery log with the recipient, the subject and whether the mailer accepted it – and the mailer’s own error when it did not. There is a Send test email button beside it, and the first time a message fails, LocalForm says so on its own screens instead of letting a site that silently drops mail look like a site nobody is registering for. Message bodies are never stored, and entries are deleted after 30 days (adjustable under Settings > Data).
• Quiz mode. Any form can now be marked: switch on Quiz under the form’s Settings, tick the correct option on each question – or type the answers you accept – and every response is scored. Set what each question is worth, a pass mark, and a sentence of explanation to show with the answer. The person who submitted sees their score, which questions they got right, and the correct answer where they did not; you see a Score column in the responses list, score columns in every export and on the printout, and a Quiz results block in the summary that says how the group did and which question everybody got wrong. Scores are worked out from the answer key each time they are read rather than stored, so correcting a key you got wrong re-marks every response you have already collected – and switching grading on for the first time scores the answers a form collected before it was a quiz. There is a Quiz starter template, and an AI assistant connected over MCP can write the whole quiz, answer key included.
• The LocalForm block now shows the real form while you are editing, instead of a grey placeholder that told you nothing about how the form would sit in the page. The form can also be swapped from a Form panel in the sidebar once one is picked, and the block understands wide and full width plus the usual margin and padding controls.
• New QR Code block. Drop a scannable code for any form onto a page – the poster you are laying out, the last slide of a talk, a flyer you print from the browser. Pick the form, set how big the code should be, and optionally print the form’s title underneath. As with the Share button’s QR code, it is drawn on your own site: the form’s address is never sent to an outside QR service.
• LocalForm’s blocks now sit together in a LocalForm category in the block inserter rather than being scattered through Widgets.
• Fixed: the block’s own wording in the editor now follows the site’s language. The strings were prepared for translation but never handed to WordPress, so the block appeared in English whatever the site was set to.
• Settings now opens on General rather than Webhooks. General is where the settings most people came for sit; webhooks are for the handful of sites that wire LocalForm into something else, and they had no reason to be the first thing everybody saw.
• The LocalForm menu now ends with a Documentation entry, which opens the manual at docs.localform.dev in a new tab so you do not lose the screen you were on. Anyone who can read responses gets it, not only administrators. It is an ordinary link and nothing more – nothing is fetched from that site, and no visit to your admin is reported anywhere, unless you click it.