Linux 软件免费装

在这里免费安装WordPress以及其他软件

Banner图

FW Tools for Elementor Forms

开发者 finalwebsites
更新时间 2026年10月4日 02:36
PHP版本: 8.0 及以上
WordPress版本: 7.1
版权: GPLv3
版权网址: 版权信息

标签

forms anti-spam spam protection rate limiting

下载

0.3.1

详情介绍:

Keep building your forms in Elementor and manage their protection from one settings page. The plugin checks submissions in the background without asking visitors to solve a CAPTCHA. You can enable or disable individual checks to suit your site. When a submission is rejected, the spam log helps you understand why. Use it to investigate repeated attempts or troubleshoot problems reported by visitors. The optional confirmation step serves two purposes: visitors can review their details before sending, and the additional interaction creates another hurdle for automated submissions. The form's configured actions, such as sending an email, run only after confirmation. You choose which forms use this step. The plugin requires Elementor and Elementor Pro with the Form widget. It is not a standalone form builder. Features Spam log Logging is enabled by default and can be switched off independently of rate limiting. Disabling logging does not delete existing entries. Entries can contain the submission time, form name, name, email address, IP address, country code, a message excerpt, and the rejection reason. The message excerpt is limited to 125 characters, with whitespace and line breaks combined for easier reading. The log keeps the latest 500 entries by default. Older entries are removed when the limit is exceeded; entries do not expire based on their age. Developers can change the maximum number of entries with the fw_tfe_spam_log_limit filter. The log is stored as a JSON Lines file in the fw-tfe-logs directory inside the WordPress uploads directory. Spam log entries are not stored in the WordPress database. IP and email rate limiting Rate limiting can be enabled or disabled in the plugin settings. Save your chosen setting before using it. When enabled, it uses a separate table in the existing WordPress database. The table stores separate counters for IP addresses and hashes of normalized email addresses, together with the start of each counting period and the end of any block. Email addresses are not stored as plain text in this table. Names and messages are not stored in it. Three suspicious attempts from the same IP address, or five using the same email address, within five minutes trigger a block lasting one hour. Further attempts during that block do not extend it. Ordinary field validation errors and expired verification tokens do not count towards the limit. Expired records are removed in batches during subsequent form requests. Cleanup does not rely on WP-Cron. Disabling rate limiting stops enforcement but leaves the table in place. Confirmation before sending Enable "Require confirmation before sending" in an Elementor form's options to let visitors review their details before the configured form actions run. You can customize the confirmation title for each form. This feature is off by default. This is an on-page review step, not email address verification. Forms with upload fields skip this step and continue through the normal Elementor submission flow. Pending submissions are stored temporarily in a separate database table, including form field data, form and page identifiers, and form metadata. A confirmation is valid for 15 minutes and can be used only once. Confirmed records remain stored until cleanup; cancelling an unclaimed confirmation deletes its pending record. Expired records are removed by an hourly WP-Cron task. Actual deletion can occur later, depending on when WordPress runs scheduled tasks. Temporary confirmation storage is independent of spam logging. WP Armour integration When WP Armour is active and the integration is enabled, its Elementor form rejections can be included in this plugin's spam log and rate limiting. Logging and rate limiting must each be enabled for their respective functions to apply. WP Armour is optional and is not bundled with this plugin. Disabling the integration does not disable WP Armour's own protection.

安装:

This plugin requires both Elementor and Elementor Pro to be installed and active.
  1. Upload the plugin directory to /wp-content/plugins/ and activate FW Tools for Elementor Forms in WordPress.
  2. Open Tools > Elementor Forms and select the Settings tab.
  3. Review the protection settings and save your choices for spam logging, IP and email rate limiting, and country detection.
  4. Check browser verification on the Information tab and use "Test endpoint" or "Test again" if needed.
  5. Optionally enable "Require confirmation before sending" in the options of individual Elementor forms.
  6. Submit a test through your Elementor form and check that normal submissions still work.
Country detection is optional and disabled by default. The confirmation step is disabled until enabled for an individual form.

常见问题:

Does this work with the free version of Elementor?

The plugin works with the Form widget provided by Elementor Pro. Elementor Pro is required in addition to Elementor.

Do I need to change my form fields?

For the spam log to capture a name, set that field's ID to name in Elementor. This refers to the field ID, not its visible label. The plugin uses the first populated email field and the first populated textarea field for the logged email address and message. Their field IDs can be different. Forms without those fields can still be used; the corresponding log values remain empty.

Does the plugin log every form submission?

No. When enabled, the spam log records rejections from this plugin's page information, submit control, honeypot, browser verification, and temporary email field checks. It can also record WP Armour rejections when the integration is enabled. Successful submissions are not added to the spam log. Requests rejected because an IP address or email address is already blocked do not create additional entries. The optional confirmation step stores pending form data separately, even when spam logging is disabled.

What happens if someone leaves a form open for a long time?

Browser verification tokens expire after two hours. An expired token causes the submission to be rejected with a form error. These rejections can be logged but do not count towards a rate limit block. The optional confirmation step has a separate 15-minute validity period.

Does rate limiting block every visitor using that IP address?

Yes. IP limits apply across forms on the site, so visitors sharing a connection can share a block. Email limits also apply across forms, using the submitted email address independently of the IP address. A block on either identifier prevents submission.

Can I use rate limiting without the spam log?

Yes. Rate limiting has its own database table and works independently of spam logging.

Does country detection block countries?

No. It adds a country code to spam log entries to help you analyse rejected submissions. Country-based blocking is not included.

What happens when the token endpoint is unavailable?

Token verification is enforced only when the plugin's REST endpoint check reports that the endpoint is available. Other enabled checks, including the missing page information check, honeypot, submit control, and rate limiting, can still apply. Temporary email field names depend on browser verification.

What happens when I delete the plugin?

By default, stored settings and data are retained. Enable the option to delete all plugin settings and the spam log before deleting the plugin if you want uninstall to remove them. This also removes the rate limit and confirmation tables and their related settings. Deactivating the plugin or switching off a feature does not uninstall its stored data. Deactivation stops the scheduled confirmation cleanup.

更新日志:

0.3.0 0.2.0