=== Flexible Forms — Custom Form Builder ===
Contributors: muddasirali
Donate link: https://muddasirali.com
Tags: form builder, contact form, multi-step form, digital signature, pdf form, elementor form, conditional logic, recaptcha
Requires at least: 5.8
Tested up to: 6.7
Requires PHP: 7.4
Stable tag: 2.0.8
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Create modern, feature-complete forms with drag-and-drop builder, digital signatures, multi-step navigation, conditional logic, reCAPTCHA, customizable styling, and EHR-ready PDF generation.

== Description ==

Flexible Forms is a powerful yet lightweight form builder for WordPress. Design professional forms with a modern drag-and-drop interface, capture submissions securely, and automatically generate branded PDF sheets ready for EHR/EMR systems or digital archives.

**Key Features**

* **Drag-and-drop form builder** – Intuitive admin interface to build forms quickly.
* **Wide range of field types** – Text, email, number, phone, URL, password, textarea, select, radio, checkbox, date, time, range slider, color picker, file upload, digital signature, hidden fields, section dividers, custom HTML, and page breaks.
* **Multi-step forms** – Break long forms into clear steps with progress indicators and Next/Previous navigation.
* **Conditional logic** – Show or hide fields based on user input.
* **Digital signatures** – HTML5 canvas signature pads with mouse and touch support.
* **File uploads** – Secure private storage outside the public uploads tree with .htaccess protection.
* **Spam protection** – Honeypot + optional Google reCAPTCHA (v2 or v3).
* **Email notifications** – Admin alerts and optional user confirmation emails with PDF and file attachments.
* **EHR-ready PDF generation** – Pure-PHP PDF engine that creates clean, branded PDF sheets of every submission (no external libraries required).
* **Custom styling** – Theme presets, colors, border radius, shadows, and button alignment.
* **Elementor widget** – Drop forms into Elementor pages with a dedicated widget.
* **Submission management** – View, search, export, and manage entries from the WordPress admin.
* **Privacy-focused** – Private file storage, optional data retention on uninstall, and no external tracking.

Perfect for contact forms, patient intake, applications, surveys, registrations, and any workflow that needs reliable data capture plus PDF documentation.

== Installation ==

1. Upload the `flexible-forms` folder to the `/wp-content/plugins/` directory, or install the plugin through the WordPress plugins screen.
2. Activate the plugin through the 'Plugins' menu in WordPress.
3. Go to **Flexible Forms** in the admin menu to create your first form.
4. Copy the shortcode `[flexible_form id="X"]` (or use the Elementor widget) and place it on any page or post.
5. (Optional) Configure global settings: reCAPTCHA keys, default PDF branding, and default admin email under Flexible Forms → Settings.

== Frequently Asked Questions ==

= Does it work with Elementor? =

Yes. A dedicated Elementor widget is included so you can insert any published form directly into Elementor pages.

= Are uploaded files secure? =

Yes. Files are stored in a private directory outside the public web root where possible, protected by .htaccess rules, and only accessible to administrators via authenticated download links.

= Can I generate PDFs of submissions? =

Yes. Every submission can automatically produce a clean, branded PDF sheet that is attached to the admin notification email and available for download from the submissions list.

= Is Google reCAPTCHA required? =

No. A honeypot is always active. Google reCAPTCHA (v2 checkbox or v3 invisible) is optional and can be enabled per form or globally.

= What happens to data when I uninstall the plugin? =

By default, form definitions and submissions are kept so accidental deletion does not destroy important records. You can enable full data removal by setting the option `fforms_delete_data_on_uninstall` to 1 before uninstalling.

= Does it require any external services or API keys? =

Only if you choose to enable Google reCAPTCHA. All other features (including PDF generation) work entirely on your server.

= Is the plugin translation-ready? =

Yes. It uses the text domain `flexible-forms` and includes a `/languages` folder for translation files.

== Screenshots ==

1. Form builder interface with field palette and live canvas.
2. Multi-step form with progress indicator on the frontend.
3. Digital signature pad and file upload fields.
4. Submission list and entry detail view in the admin.
5. Generated branded PDF sheet example.
6. Elementor widget in action.

== Changelog ==

= 2.0.8 =
* Fix: PDF field labels and heading text no longer truncated — full text wraps in the column.
* PDF table rows grow in height to fit long labels and values.

= 2.0.7 =
* New: Heading Styles section in Style & Design (color, weight, alignment, underline).
* Fix: PDF and email now render Heading/Section fields as section separators instead of empty table columns.
* PDF: Headings appear as tinted full-width banners that group fields by section.

= 2.0.6 =
* Fix: Forms with Custom HTML / Section fields failed to submit (JS validation crashed on layout fields).
* New: Heading field type for safe custom headings (H2–H4) without writing HTML.
* Hardening: Layout fields (heading, section, HTML, pagebreak) are always skipped during client validation.

= 2.0.5 =
* Fix: Critical error when duplicating a form (missing $ on variable check in duplicate_form).

= 2.0.4 =
* Security: Strict validation of digital signature data URLs (rejects non-base64 / XSS payloads).
* Security: Escape signature image src in admin entry viewer (defense-in-depth against stored XSS).
* Security: CSV export now prefixes formula-like values (=, +, -, @, tab, CR) to prevent Excel/Sheets injection.
* Hardening: Cap signature payload size (~1.5 MB) and tighten PDF data-URL parsing to png/jpeg only.

= 2.0.3 =
* Improved private file handling and rate limiting.
* Enhanced PDF generation and email templates.
* Security and sanitization refinements.
* Compatibility updates.

= 2.0.0 =
* Major rewrite with modular class architecture.
* Added multi-step forms, conditional logic, and digital signatures.
* Pure-PHP PDF engine and private upload storage.
* Elementor integration.
* reCAPTCHA support and improved spam protection.

= 1.0.0 =
* Initial release.

== Upgrade Notice ==

= 2.0.4 =
Important security update. Fixes stored XSS via the digital signature field and adds CSV formula-injection protection. Update immediately on any site accepting public form submissions.

= 2.0.3 =
Recommended update with security improvements and PDF/email refinements. No breaking changes expected for existing forms.

== Privacy Policy ==

Flexible Forms stores form definitions and submission data in your WordPress database. Uploaded files are stored in a private directory under your uploads folder. IP addresses and user agents are recorded with submissions for spam analysis. The plugin does not send data to third-party services except when Google reCAPTCHA is explicitly enabled by the site administrator. No analytics or tracking scripts are included.