is not empty<\/code><\/td>| <\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n Show “Which other service?” when Service is equal to Other.<\/em> Show the shipping block when Delivery is not empty.<\/em> Show the discount question when Quantity is greater than or equal to 10.<\/em><\/p>\n\n\n\nTwo details that matter more than the feature list:<\/p>\n\n\n\n \n- A field nobody can see is never made to be required.<\/strong> Mark a hidden-by-rule
field as required and it will not block a submission it was never shown for.<\/li>\n\n\n\n- The rules are honoured on the server too.<\/strong> The browser evaluates them live
as somebody types; the server revalidates the whole submission and is told
which fields were out of sight, so neither end can be talked into the wrong
answer.<\/li>\n<\/ul>\n\n\n\nIf you have used HDForms before 1.7, this replaces the old single trigger-and-
toggle arrangement, with the id[4]<\/code> option-index syntax that was documented but
never actually worked. Existing forms are brought across.<\/p>\n\n\n\n
\n\n\n\nForms that are in the page<\/h2>\n\n\n\nHDForms renders on the server. The form’s markup is in the HTML before a single
line of JavaScript runs.<\/p>\n\n\n\n That is not a purity argument. It means:<\/p>\n\n\n\n \n- Search engines and screen readers see a form<\/strong>, not an empty div waiting for
a script.<\/li>\n\n\n\n- It draws with the page<\/strong>, so there is no flash of nothing where the form goes.<\/li>\n\n\n\n
- It degrades honestly.<\/strong> The markup is real inputs with real labels.<\/li>\n<\/ul>\n\n\n\n
The JavaScript that follows binds to what is already there: it validates, it
shows and hides on your rules, it collects and posts. It is vanilla \u2014 no jQuery
on the front end since 1.6.<\/p>\n\n\n\n Accessibility is built into the fields, not bolted on<\/h3>\n\n\n\nRadio groups get role=\"radiogroup\"<\/code> with aria-checked<\/code> on the options. Toggles
get role=\"switch\"<\/code>. The success message is an aria-live<\/code> region, so it is
announced rather than silently painted. Custom controls \u2014 the colour picker, the
search list, the image tiles, the repeater row handles \u2014 are focusable and
keyboard-operable with the labels to match.<\/p>\n\n\n\n
\n\n\n\nSpam protection with nothing to sign up for<\/h2>\n\n\n\nNo captcha. No reCAPTCHA key. No third-party service, and nothing about your
visitors sent anywhere. Four layers, all on your own server:<\/p>\n\n\n\n A nonce.<\/strong> WordPress’s own, checked on every submission.<\/p>\n\n\n\nA honeypot.<\/strong> An empty box no visitor sees. Note that it is positioned off
screen rather than display: none<\/code> \u2014 a bot that skips hidden fields is not the
one this catches; a bot that fills in everything it can find is, and it fills
this in.<\/p>\n\n\n\nA signed token.<\/strong> Each rendered form carries an HMAC-signed timestamp. It
proves the form was actually rendered by this site, for this form, at a moment
the server can verify without storing anything. It is good for 12 hours. It is
also refused if the form comes back in under three seconds \u2014 nobody fills in a
form that fast, and a bot that loads and posts in the same breath does.<\/p>\n\n\n\nFlood protection.<\/strong> One submission per address per 30 seconds, held as a
self-expiring transient. It is recorded once a message has actually been sent,
so a submission that failed validation does not cost a real visitor their next
turn.<\/p>\n\n\n\nPlus a replay guard: once a message goes out, that submission is spent, so a
double-click, a back button or a restored tab cannot send it twice.<\/p>\n\n\n\n The visitor’s address is read from HTTP_CF_CONNECTING_IP<\/code>, X-Forwarded-For<\/code>
and X-Real-IP<\/code> before falling back to REMOTE_ADDR<\/code>, because behind a CDN the
latter is the proxy and every visitor on the site would share one rate limit.
That trade is documented in the code and reversible with a one-line filter if
your site would rather have it the other way round.<\/p>\n\n\n\n
\n\n\n\nIt works behind a full page cache<\/h2>\n\n\n\nThis is the unglamorous feature that quietly decides whether a contact form works
on a real, fast site.<\/p>\n\n\n\n A nonce and an anti-spam token are minted when a page is rendered. On a site with
full page caching \u2014 which is most sites worth having \u2014 a page is rendered once
and then served to everybody. So everybody gets the same nonce and the same
token. The first submission spends them; every visitor after that is told the
form has expired, on a page that can only ever come from the cache. Reloading
does not help, because the reload is the same cache entry.<\/p>\n\n\n\n HDForms fixes this properly rather than by telling you to exclude the page from
caching:<\/p>\n\n\n\n \n- Nothing is written when a form is rendered.<\/strong> The token is signed, not
stored, so a page view costs no database row.<\/li>\n\n\n\n- Fresh credentials are fetched immediately before posting.<\/strong> One small request
per submission attempt, none per page view.<\/li>\n\n\n\n- The page stays cacheable.<\/strong> Which was the point.<\/li>\n<\/ul>\n\n\n\n
The replay guard is keyed to the submission \u2014 the visitor’s address and the
answers they gave \u2014 rather than to the token, so two people sharing a cached page
are two submissions, and one person double-clicking is one.<\/p>\n\n\n\n
\n\n\n\nWhere the email goes<\/h2>\n\n\n\nThe Form<\/strong> tab holds everything about what happens after Send:<\/p>\n\n\n\nSend to.<\/strong> One address per line or separated by commas. It arrives already
filled in with your site’s admin address, until you type over it. And a form
will not save with a typo in it<\/strong> \u2014 the bad address is named under the box.
The alternative, which is what most builders do, is to quietly drop the
unparseable address when the email goes out, so the form looks perfectly set up
right until a submission goes nowhere.<\/p>\n\n\n\nReply-to name and Reply-to address.<\/strong> Name the fields that ask for them and
replies go back to the person who wrote in, rather than to your own site
address. Point one at a field that answers with a list \u2014 a checkbox group, say \u2014
and the form refuses to save, for the same reason.<\/p>\n\n\n\nSubmit button text<\/strong> and Success message<\/strong>, both with sensible defaults.<\/p>\n\n\n\nThe email itself is built for you: an HTML message with every answer under its
label, checkboxes joined up, toggles printed as Yes and No, and the honeypot and
token left out. The subject is the form’s title unless you change it.<\/p>\n\n\n\n
\n\n\n\nAn optional log of what was sent<\/h2>\n\n\n\nUnder About \/ Options<\/strong> there is a Log Sent Forms<\/strong> setting. Turn it on and
every form the mail server accepts is recorded on your own site: when it was
sent, which form, the subject, who it went to, the visitor’s IP, and everything
that was filled in. The most recent are listed on the same screen with a button
to empty the log.<\/p>\n\n\n\nIt is off out of the box, and the plugin says why rather than presenting it as a
free feature you would be silly not to enable:<\/p>\n\n\n\n \nA form that is emailed and forgotten leaves nothing behind, and a logged one is
a copy of what your visitors typed sat in your database until you clear it.<\/p>\n<\/blockquote>\n\n\n\n Turn it on to work out where a missing email went, or to keep a record \u2014 and know
that you are then looking after that record. The log keeps its most recent 250
entries and deletes the rest as new ones arrive; hdf_log_max<\/code> changes the number
or returns 0<\/code> to keep everything. Entries live in a post type with no UI, no
archive, no REST, and no query var \u2014 nothing but the options screen can read them.<\/p>\n\n\n\n
\n\n\n\nPutting a form on a page<\/h2>\n\n\n\nThree ways, all of them the same rendering path:<\/p>\n\n\n\n A block.<\/strong> The HDForms block, with a dropdown of your forms. It is a dynamic<\/em>
block \u2014 it stores the form ID and nothing else, so a form you edit next month
shows its changes on every post it is on, without reopening any of them.<\/p>\n\n\n\nA shortcode.<\/strong> [hdf form=\"1702\"]<\/code>, listed in a Shortcode column on the forms
list so you can copy it.<\/p>\n\n\n\nIn a template.<\/strong> <?php echo do_shortcode('[hdf form=\"1702\"]'); ?><\/code><\/p>\n\n\n\n
\n\n\n\nTwo ways to look<\/h2>\n\n\n\nOne site-wide setting decides how forms are styled:<\/p>\n\n\n\n Hybrid<\/strong> (the default) loads only the layout, grid, toggles and error states \u2014
the things a theme has no rules for \u2014 and lets your theme’s own typography,
borders and focus rings show through. Forms look like they belong to your site.<\/p>\n\n\n\nFull<\/strong> keeps HDForms’ own input styling throughout, for a theme that has no
opinion worth inheriting.<\/p>\n\n\n\nEither way the assets are enqueued early enough that the stylesheet lands in the
head, and only on pages that actually carry a form.<\/p>\n\n\n\n
\n\n\n\nFor developers<\/h2>\n\n\n\nHDForms is written to be extended by somebody who knows PHP, without a plugin
API to learn first.<\/p>\n\n\n\n Reading a form<\/h3>\n\n\n\nhdf_get_form_fields( $form_id ); \/\/ the field definition\nhdf_get_form_settings( $form_id ); \/\/ where submissions go, button text and so on<\/code><\/pre>\n\n\n\nChanging the email on the server<\/h3>\n\n\n\nTwo filters run after validation and before the message is built:<\/p>\n\n\n\n \/\/ change what is in the message\nadd_filter( 'hdf_after_server', function ( $values, $form_id, $settings ) {\n return $values;\n}, 10, 3 );\n\n\/\/ change everything around it: subject, recipients, reply-to, success message\nadd_filter( 'hdf_settings_before_send', function ( $settings, $form_id, $values ) {\n $settings['title'] = 'Enquiry from ' . $values['hdf_text_ab12cd']['value'];\n return $settings;\n}, 10, 3 );<\/code><\/pre>\n\n\n\nOnly this submission’s copy of the settings is filtered, so the form itself is
unchanged and the next submission starts clean. Anything you leave out keeps the
saved value.<\/p>\n\n\n\n After it has gone<\/h3>\n\n\n\nadd_action( 'hdf_after_send', function ( $form_id, $values, $settings, $mail ) {\n \/\/ $mail holds to, subject, body and headers, as sent\n}, 10, 4 );<\/code><\/pre>\n\n\n\nIt fires only on messages the mail server took, so it runs on sent forms and no
others. Record it, forward it, push it into your CRM. The submission log is
written off this hook, which is the best evidence that it is enough to build on.<\/p>\n\n\n\n JavaScript at three stages<\/h3>\n\n\n\nPrint a function into the page with hdf_before<\/code> or hdf_after<\/code>, then name it in
one of the three Custom actions<\/strong> boxes on the form’s settings: On load<\/strong>,
Before submit<\/strong>, After submit<\/strong>. Each is called as fn( formId, data )<\/code>,
where data<\/code> holds every collected value keyed by field ID, each carrying
value<\/code>, type<\/code>, valid<\/code> and hidden<\/code>.<\/p>\n\n\n\nA Before submit function runs after<\/em> the form has validated and before<\/em> it is
posted, so it only ever sees a submission that was about to go. Return false<\/code>,
or set HDF.VARS['hdf-' + formId].email = false<\/code>, and nothing is sent, nothing is
logged, and no server hook fires.<\/p>\n\n\n\nAdding your own field types<\/h3>\n\n\n\nRegister a type with the hd_add_new_field_types<\/code> filter and a matching
render_<type><\/code> function, then add it to the builder’s palette with
hdf_form_field_types<\/code>. The same filter also un-hides types the underlying field
library already knows how to render but that the contact-form palette leaves out
by default \u2014 repeatable rows being the notable one, for the times a form needs
“add another guest”.<\/p>\n\n\n\nOther filters<\/h3>\n\n\n\nhdf_default_send_to<\/code>, hdf_log_max<\/code>, hdf_ip_headers<\/code>, hdf_actions<\/code>,
hdf_before<\/code> \/ hdf_after<\/code>.<\/p>\n\n\n\n
\n\n\n\nUpgrading is handled for you<\/h2>\n\n\n\nVersion 1.7 changed how forms are stored. Rather than asking anybody to rebuild
anything:<\/p>\n\n\n\n \n- Existing forms are converted on update<\/strong>, not the first time each one is
opened.<\/li>\n\n\n\n- The old data is left exactly where it was<\/strong>. Nothing writes to
form_blocks<\/code>
or form_data<\/code> again, and nothing is deleted.<\/li>\n\n\n\n- An Update saved forms<\/strong> screen lists every form, shows which storage shape it
is in, previews a conversion without writing anything, and converts one form
per request so a site with fifty forms cannot time out.<\/li>\n\n\n\n- Forms keep working throughout, because reading one converts it.<\/li>\n<\/ul>\n\n\n\n
The plugin’s own changelog names the bugs it fixed, including its own \u2014 the
trigger syntax that was documented but never worked, the flood protection that
cleared the wrong addresses, the screen layout filters keyed to the wrong post
type. That is a reasonable thing to look for in something you are about to hang
your enquiries on.<\/p>\n\n\n\n
\n\n\n\nSo why choose it<\/h2>\n\n\n\nIt is free, and that is the whole business model.<\/strong> No Pro tier, no add-ons, no
feature you will hit a wall on in month three. Conditional logic, multiple
recipients, custom hooks and a submission log are all just in it.<\/p>\n\n\n\nNothing leaves your site.<\/strong> No captcha service, no external API, no analytics on
your visitors, no account. Submissions go from your server to your inbox. If you
turn the log on, it is your database.<\/p>\n\n\n\nIt is fast, and it is honest about caching.<\/strong> Server-rendered markup, no jQuery,
two small assets loaded only on pages with a form, and a submission path designed
around full page caching instead of in spite of it.<\/p>\n\n\n\nIt is built for the person filling the form in.<\/strong> Real typed inputs, validation
that says what is wrong before Send, conditional fields that never demand an
answer to a question nobody saw, and accessibility in the markup rather than in
the marketing.<\/p>\n\n\n\nIt is built for the person building the form, too.<\/strong> Every setting explains
itself. The builder tells you what is broken before you save. A bad Send-to
address is refused rather than swallowed. Columns arrive with their columns.<\/p>\n\n\n\nAnd it is built for you, if you write PHP.<\/strong> Three server hooks, three
JavaScript stages, your own field types, and a documented, supported way to read
a form back out.<\/p>\n\n\n\nIt is made by one developer, for their own client work, and maintained because
they use it. That is a smaller promise than most plugins make and a more reliable
one than most plugins keep.<\/p>\n\n\n\n <\/p>\n","protected":false},"excerpt":{"rendered":" Every WordPress site needs a form. Most of them need one form \u2014 a name, an emailaddress, a message, and a button. The plugins on offer for that job have growninto marketing platforms with entry-level tiers, add-on marketplaces and adashboard that wants to tell you about your conversion rate. HDForms is the other thing. It […]<\/p>\n","protected":false},"author":1,"featured_media":1092,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[89],"tags":[],"class_list":["post-1076","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-product"],"_links":{"self":[{"href":"https:\/\/harmonicdesign.ca\/hdapi\/wp\/v2\/posts\/1076","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/harmonicdesign.ca\/hdapi\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/harmonicdesign.ca\/hdapi\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/harmonicdesign.ca\/hdapi\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/harmonicdesign.ca\/hdapi\/wp\/v2\/comments?post=1076"}],"version-history":[{"count":14,"href":"https:\/\/harmonicdesign.ca\/hdapi\/wp\/v2\/posts\/1076\/revisions"}],"predecessor-version":[{"id":1091,"href":"https:\/\/harmonicdesign.ca\/hdapi\/wp\/v2\/posts\/1076\/revisions\/1091"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/harmonicdesign.ca\/hdapi\/wp\/v2\/media\/1092"}],"wp:attachment":[{"href":"https:\/\/harmonicdesign.ca\/hdapi\/wp\/v2\/media?parent=1076"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/harmonicdesign.ca\/hdapi\/wp\/v2\/categories?post=1076"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/harmonicdesign.ca\/hdapi\/wp\/v2\/tags?post=1076"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
|