SMiLE Basic Web

A feature-rich plugin with a modular system for Contact Form, sitemaps, and email customization.

Navigate to the "Custom Fields" section under the "Contact Form" tab. Use the admin interface to add, edit, delete, and reorder fields.

If enabled, users receive an HTML email containing their submitted data, a custom message, your logo, and a link to your company. If the internal message is accepted but the user copy fails, the form reports a partial-success warning and does not request a resubmission. Its JSON response keeps success: true and a string data, with additional warning: true and delivery statuses. The form resets because the internal request was accepted. The sbwscf_contact_form_delivery_result action exposes internal/copy statuses without addresses or message content; no automatic retry or persistent mail log is added. Transport acceptance does not guarantee inbox delivery.

The server validates the configured fields independently of browser constraints. Text, textarea, email, number, URL and phone limits are 250, 1000, 70, 100, 250 and 30 characters respectively, matching the existing HTML limits. Length uses HTML UTF-16 units, including emoji, and textarea line endings are normalized. Required zero values are valid; required values empty after cleaning, unexpected arrays and excessive input are rejected. Selection values must exactly match the configured options; nested arrays, duplicates and unknown choices are rejected. Unconfigured POST keys are not emailed. Email addresses must be valid, numbers must be finite, URLs must use HTTP/HTTPS, and phone values must use digits with common international/extension punctuation rather than arbitrary text. Privacy/legal/terms checkboxes must submit their actual checked value. No new country-specific telephone rules or business number ranges are introduced.

When enabled, incomplete keys or malformed/failed verification never bypass protection. A successful HTTP/JSON response must have boolean success, action submit, the canonical home_url() hostname and a numeric score from 0.5 to 1. Browser code waits for grecaptcha.ready; unavailable/rejected CAPTCHA does not submit an unprotected fallback request. Invalid fields are rejected before calling Google. Sites intentionally serving multiple verified hostnames may use the sbwscf_recaptcha_allowed_hostnames filter to explicitly add trusted aliases. Incoming Host or forwarded headers never extend that allowlist automatically. Keep Google's key/domain configuration aligned with the public site URL. Verification uses HTTPS with a 10-second timeout, no redirects and a bounded response; Google handles token expiry and reuse.

Open Contact Form > Form protection to set the maximum attempts per IP address (1 to 100), the period (1 to 1440 minutes), and the minimum completion time (1 to 60 seconds). Defaults are 5 attempts per 60 minutes and 3 seconds. These protections and the hidden honeypot are always applied. Attempts with a valid nonce count even when validation or delivery fails; loading the form does not count. Rate limiting uses a salted IP hash and temporary counters rather than storing raw IP addresses. If the site is behind a proxy, configure the server to provide the actual visitor IP address. Forwarded headers are not automatically trusted. An integration for a specifically trusted proxy can use the sbwscf_contact_form_client_ip filter. Clear page and asset caches after updating so cached forms load the current script.

The public /llms.txt endpoint always returns Markdown with a site-name H1, a short summary, and grouped Markdown links. /llms.json provides the existing structured metadata format. Select the JSON export in Sitemaps to also show its generated URL. Integrations that previously read JSON from /llms.txt must switch to /llms.json. This content guide helps agents find information; it does not enforce crawling or training permissions.

Only selected content types are queried. Empty or taxonomy-only selections do not implicitly include posts. The XML sitemap retains support for explicitly selected public products; the image and LLM feeds support posts/pages as before. Password-protected, non-published and explicitly _sbwscf_meta_index=noindex publications are excluded from all three content listings, including image discovery and the XML static homepage. Stored noindex exclusions are honored even if the metadata editor is disabled. This does not replace access control or integrate every third-party SEO exclusion. Object-cache entries use a versioned generation invalidated by changes to posts, attachments, post metadata, terms, relationships and relevant site/plugin options. The invalidation hooks load on AJAX and REST writes too. Old generation entries expire within one hour without a global cache flush. robots.txt is built on every request so native robots_txt and existing plugin extension filters remain current. When WordPress Reading visibility is disabled, the plugin emits a generic Disallow: / without its own Allow exceptions or sitemap advertisements. Trusted native filters can still customize that output. This is crawler guidance, not authentication; the public feed URLs are not made private. Physical files and external page/CDN caches can override dynamic endpoints; purge those caches after updating.

The existing /sitemap.xml URL now returns a sitemap index instead of one unbounded URL list. It links to selected, nonempty post/page/product and category/tag children, plus the homepage when explicitly selected and eligible. Each child holds up to 500 entries by default. The sbwscf_sitemap_page_size filter may change this within 1–2000. Post and term IDs provide stable ordering; counts retrieve only a single post ID or a term aggregate, never all content. Counts and individual child lists use the existing content/settings cache generation. Changes during a crawl can move page boundaries; this is not a frozen export. Children reuse /sitemap.xml?sbwscf_sitemap_type=post&sbwscf_sitemap_page=1 (or the root query route with sbwscf_sitemap=1 for plain permalinks). No new rewrite rules, activation or permalink reset is required. Keep submitting the original index URL. Caches/CDNs must preserve these query parameters or bypass sitemap caching. Public robots output has specific permissions for these routes, without removing the generic block for other query URLs. Reading visibility still takes precedence. The static homepage is not repeated in the pages child. Terms use native non-hierarchical SQL pagination with hide_empty: empty parent categories are not added solely because a descendant contains posts. Unknown/disabled sections, missing or invalid child parameters, out-of-range pages, empty indexes and children with no valid URLs return 404. A failed term query, index beyond 50000 children, or an index exceeding the 50 MB protocol limit or the available PHP memory budget returns 503 without a partial document. The index size is conservatively checked before allocation, leaving room for string copies and shutdown hooks. Post/static-home timestamps remain real modification dates; term archives and the index do not invent lastmod dates. This change paginates the normal content sitemap only. The image sitemap and LLM exports retain their existing format and batching. Bounded responses do not eliminate expensive database counts or deep OFFSET queries: benchmark very large real sites and persistent caches before publishing.

The image sitemap endpoint returns HTTP 404 instead of advertising an empty sitemap as successful. robots.txt only lists the image sitemap when an eligible public post/page has a resolvable HTTP(S) image URL. Invalid or missing attachment URLs do not create empty entries. The availability probe stops after the first valid entry and caches its result for up to one hour, including on sites without a persistent object cache. Content, attachment, metadata and relevant settings changes invalidate this per-site transient; uninstall removes it. On an empty large site, the first probe after invalidation may still scan all eligible batches. Enabled feed endpoints run before WordPress canonical redirects, keeping the advertised sitemap child URLs directly accessible without an added trailing slash that would evade their specific robots Allow rule. Ordinary pages and disabled feed routes retain WordPress behavior. No permalink reset or reactivation is needed; purge external page/XML/robots caches after updating.

Yes, go to "Customize" > "Email Preview" in the WordPress Customizer to see how the email will look.

Yes. You can enable privacy and legal notice checkboxes and add a marketing opt-in field with custom text.

This version introduces a dedicated “Sitemaps” tab where you can generate llms.txt, sitemap.xml, robots.txt, and images sitemap dynamically.

Yes. Scripts are injected only after the user gives consent, and only those matching accepted categories.

The plugin provides configurable consent controls, not a compliance certification. Its behavior depends on your site's settings and integrations; it does not automatically control scripts loaded outside this plugin or erase arbitrary third-party cookies.

If an affected category has already run, the plugin saves the new choice and reloads the current page. This stops that document's timers and listeners; the new document loads only still-accepted categories. Saving unchanged preferences does not reinitialize scripts or reload the page. Choices withdrawn in another tab are also applied. A reload can discard unsaved page input, so consider this when integrating checkout or other interactive workflows. Provider cookies and other persistent identifiers are not automatically erased: implement provider-specific cleanup where needed. The sbwscf:consentchange document event exposes detail.status and detail.prefs for integrations. Code loaded independently by other plugins is outside this manager's control.

SVG uploads use bundled enshrined/svg-sanitize 1.1.1 under a plugin-specific namespace. PHP DOM/libxml are required; SVGZ also requires zlib. Both the uploaded file and the decompressed document are limited to 2 MB. Uploads and sideloads are sanitized without trusting the client MIME, and rejected if parsing, reading or writing fails. Remote references are removed; a logo depending on external resources may need a self-contained export. The library is included in the plugin package; site administrators do not need Composer. Already uploaded SVG files are not rewritten automatically: review and, where appropriate, re-upload them. Large JPEG/PNG scaling is not disabled by enabling SVG support.

Users with both manage_options and unfiltered_html can register code with a name and purpose. WordPress multisite and DISALLOW_UNFILTERED_HTML restrictions are respected; users without executable-content permission cannot change the saved list, including while saving other cookie settings. Script names must be unique; Functional is reserved. Invalid submissions preserve the previous list atomically. Use either plain JavaScript or an HTML fragment containing script tags, up to 128 KB per entry. Do not mix bare JavaScript with HTML. Code is preserved without HTML filtering or a second unslash pass, while names/descriptions remain restricted HTML and admin textareas/configuration are escaped. Classic external scripts without async finish before subsequent inline code. Explicit async, modules, nested scripts and loader attributes are preserved; data scripts such as application/ld+json remain inert. A failed blocking loader stops dependent code in its category and emits sbwscf:scripterror with detail.category. Snippets must support insertion after page load; legacy document.write integrations are not supported. Only approved categories are loaded, and unchanged preferences do not reload SDKs. Snippets previously stripped by older sanitization cannot be reconstructed automatically: paste the complete provider snippet again with an authorized account. Existing data is not migrated or rewritten by this update.

Yes. In Cookies > Accordion Colors, configure the header background, content background, title color, and text color. The title color also applies to enable controls on the header. Existing installations receive light accordion backgrounds with dark text even when the main panel uses a dark background and light text.

Yes. Each rendered instance has independent field IDs, labels, textarea counter descriptions and live feedback. POST field names and the nonce action are unchanged. The first instance retains legacy IDs; use .sbwscf-contact-form, form.sbwscf-form, field names or classes for custom CSS/JavaScript that must target every instance. The updated script also accepts old cached markup; refresh page and asset caches together so repeated forms receive the current script.

The Cookies editor warns about nine text/background combinations, including buttons, links, minimized label and accordions. The form Customizer warns about submit button text against normal and hover backgrounds. Checks update as colors change, use the unrounded sRGB contrast ratio against a conservative 4.5:1 normal-text threshold, and never change colors or block saving. They require JavaScript and do not certify the whole page: theme styles, gradients, opacity, font sizes and other content still require accessibility review. New/unset defaults use darker blue submit backgrounds and darker green/red cookie buttons with readable white text; existing saved colors are retained. Cookie hover underlines the label instead of reducing opacity, preserving the chosen contrast. Keyboard focus indicators are added without changing dimensions. Existing low-contrast saved colors must be adjusted explicitly by the site owner.

Deactivation does not run this cleanup. Deleting the plugin through WordPress removes its registered configuration, its keys inside current/inactive theme-mod options, temporary database counters/locks and the known cron hook on each site. Networks are processed in batches of 100 sites. Only the saved preview page that still has the expected identity, exact preview shortcode and draft/trash status is permanently removed. Published, edited, missing or unrelated targets are retained. No global object-cache flush is performed. Known keys and supported plugin-only cache groups are cleared; feed generations are invalidated. Unenumerable expiring entries in persistent caches expire naturally (feed entries within one hour, rate counters within their configured period). Uploaded images, legal/privacy pages, other content, unrelated theme settings and editorial SEO metadata are retained. Browser consent records on visitors' devices and third-party provider data cannot be deleted by server-side uninstall. Back up configuration before uninstalling; reinstalling does not restore deleted settings or the preview draft.