LW Simple Forms

LW Simple Forms is a versatile WordPress form plugin that allows you to create customizable forms. It supports the Japanese-style workflow of a complete form submission process:

1. Input screen - Users enter their information
2. Confirmation screen - Users review their input before submitting
3. Completion screen - Thank you message after successful submission

The plugin also supports a simpler one-step submission process when confirmation is not needed. A sample form with all supported field types is automatically created on first activation, so you can get started right away. Important: Page Cache and CDN Compatibility Form pages must not be served from a page cache. A cached input page keeps a security token that expires after 12 to 24 hours, so submissions start failing. A cached completion page can show one visitor's submitted details to other visitors. Since version 1.3.0, every page whose content contains a form shortcode is automatically marked as non-cacheable: the plugin sends no-cache HTTP headers and defines the DONOTCACHEPAGE constant, which caching plugins such as WP Super Cache, W3 Total Cache, WP Rocket, and LiteSpeed Cache respect. Some caches ignore these signals. Examples are a CDN rule that overrides the origin's cache headers (such as a Cloudflare Edge TTL setting that ignores the Cache-Control header), nginx FastCGI Cache or Varnish when configured to ignore them, and a hosting company's own page cache. If you use one of these, please exclude the form page URLs (input, confirmation, completion, error) from caching. If you place a form outside the page content (in a widget, a synced pattern, or a theme template), caching plugins still skip the page, but the HTTP headers may already have been sent. In that case, exclude those URLs from CDN and server-level caches manually. After updating to 1.3.0, please purge your page cache and CDN cache once so that previously cached copies of your form pages are removed. CSS Styling This plugin does not include any frontend CSS for form display. You are expected to style the forms using your own theme's stylesheet. HTML/CSS samples are available for reference on the plugin's website.

1.3.0 Improvements:

• Pages that contain a form shortcode are now automatically excluded from page caching. The plugin sends no-cache HTTP headers and defines the DONOTCACHEPAGE constant (respected by WP Super Cache, W3 Total Cache, WP Rocket, LiteSpeed Cache, and others), and also notifies LiteSpeed Cache through its API. This prevents submissions from failing because a cached input page kept an expired security token, and stops cached completion pages from showing one visitor's data to others.
• The no-store directive is left out of the no-cache headers so that browsers can still restore typed values when a visitor presses Back on the confirmation screen. private already keeps CDNs and other shared caches from storing the page. For logged-in users, no-store is kept as WordPress sends it.
• New lwsf_prevent_page_cache filter. Return false to turn off the automatic cache exclusion.
• After updating, purge your page cache and CDN cache once to remove copies of form pages that were cached before.

Bug Fixes:

• When a visitor pressed the browser's Back button on the confirmation screen and the input screen was restored from the browser's back/forward cache, the submit button stayed disabled and the form could not be submitted again. The buttons are now re-enabled when the page is restored. If the form had already been sent (forms without a confirmation screen), the page is reloaded instead, so the same entry is not sent twice by accident.

Documentation:

• Rewrote the cache compatibility note: explains why form pages must not be cached and which caches still need manual exclusion
• Fixed a non-existent plugin name ("WP Total Cache") in the cache compatibility note
• Added an FAQ entry about excluding form pages from caching
• Tested up to WordPress 7.1

1.2.0 New Features:

• IP-based rate limiting - Prevents the same IP address from submitting forms excessively within a configurable time window. Default: 5 submissions per hour. Configurable in Settings.
• Honeypot field - An invisible form field that catches automated bots. Bots that fill all fields are silently rejected. Enabled by default, can be toggled in Settings.
• Confirmation screen enforcement - When a confirmation screen is configured, the server now verifies that the confirmation screen was actually displayed before allowing completion. Prevents bots from bypassing the confirmation step.

Improvements:

• reCAPTCHA v3 score threshold increased from 0.3 to 0.5 (Google's recommended default) for better spam detection
• New "Spam Protection" settings section in the admin panel for configuring rate limiting and honeypot options
• Rate limit records are automatically cleaned up after 24 hours

Security:

• Added protection against automated SQL injection scanning attacks
• Bots that trigger the honeypot receive a fake success response to prevent detection of the security measure

1.1.1 New Features:

• Sample form with all supported field types (text, tel, email, radio, checkbox, textarea, select, select multiple) is automatically created on first activation for easy reference

Documentation:

• Added cache plugin/CDN compatibility warning
• Added CSS styling note (no frontend CSS included)
• Marked optional shortcodes in Installation section
• Clarified PHP version compatibility (tested on PHP 8.3)
• Updated WordPress compatibility to 6.9

1.1.0 New Features:

• reCAPTCHA v3 integration - Configure Site Key and Secret Key in LW Simple Forms > Settings. When enabled, reCAPTCHA tokens are automatically generated and verified on form submission. Fails open on API communication errors to avoid blocking legitimate users. Score threshold: 0.5.
• PRG (Post-Redirect-Get) pattern for duplicate submission prevention - After form completion, a cookie-based session key is stored and the browser is redirected to a clean URL via 302 redirect. The completion screen is displayed once, and page reload redirects back to the input page.

Improvements:

• WordPress reserved word validation now blocks saving (previously only warned) when form field names use reserved query variables (e.g., name, p, s, page). Case-sensitive comparison: Name is allowed, name is blocked.
• Extended wp_kses allowed HTML tags to include <form>, <button>, and <textarea> with their common attributes. This ensures confirmation screen buttons and form elements retain their HTML attributes (e.g., class, id).
• Frontend CSS externalized - The plugin no longer outputs inline CSS. Error messages and button styles should be defined in your site's stylesheet.
• POST data now properly handled with wp_unslash() to prevent double-escaping issues caused by WordPress wp_magic_quotes() (e.g., I'm no longer becomes I\'m).
• Improved HTML sanitization warnings - Normalized comparison to avoid false positives from wp_kses removing trailing semicolons in style attributes. Warning messages now show the actual changed lines instead of a generic message.
• Updated admin notes to clarify that style attributes are allowed (only script tags are blocked for security).
• Confirmation button default label changed from "Confirm Input" to "Confirm".

Bug Fixes:

• Fixed direct submission mode (without confirmation screen) - Replaced query parameter approach (?lwsf_complete=1&key=...) which caused 404 errors due to WordPress interpreting query parameters. Email is now sent within the REST API call, and a flag is returned to JavaScript.
• Fixed reCAPTCHA token regeneration - Tokens are now regenerated before the final form submission since reCAPTCHA tokens can only be used once.
• Documented incompatibility with async-javascript plugin - The plugin adding async attribute to lwsf.js breaks form functionality. Workaround: exclude lwsf-form-handler in the async-javascript plugin settings.

1.0.0

• Initial release