
內容簡介
LW Simple Forms 是一款多功能的 WordPress 表單外掛,允許用戶創建可自訂的表單,支持完整的表單提交流程,並提供簡單的一步提交選項,適合各類網站需求。
【主要功能】
• 完整的表單工作流程:輸入、確認、完成三個步驟
• 彈性設計:可自訂每個畫面的 HTML
• 表單驗證:伺服器端與客戶端的驗證功能
• 電子郵件通知:發送確認郵件給管理員與用戶
• 安全功能:CSRF 保護與數據驗證
• 多種欄位類型:支持文本框、選擇框等
外掛標籤
開發者團隊
原文外掛簡介
LW Simple Forms is a versatile WordPress form plugin that allows you to create customizable forms. It supports the Japanese-style workflow of a complete form submission process:
Input screen – Users enter their information
Confirmation screen – Users review their input before submitting
Completion screen – Thank you message after successful submission
The plugin also supports a simpler one-step submission process when confirmation is not needed.
A sample form with all supported field types is automatically created on first activation, so you can get started right away.
Important: Page Cache and CDN Compatibility
Form pages must not be served from a page cache. A cached input page keeps a security token that expires after 12 to 24 hours, so submissions start failing. A cached completion page can show one visitor’s submitted details to other visitors.
Since version 1.3.0, every page whose content contains a form shortcode is automatically marked as non-cacheable: the plugin sends no-cache HTTP headers and defines the DONOTCACHEPAGE constant, which caching plugins such as WP Super Cache, W3 Total Cache, WP Rocket, and LiteSpeed Cache respect.
Some caches ignore these signals. Examples are a CDN rule that overrides the origin’s cache headers (such as a Cloudflare Edge TTL setting that ignores the Cache-Control header), nginx FastCGI Cache or Varnish when configured to ignore them, and a hosting company’s own page cache. If you use one of these, please exclude the form page URLs (input, confirmation, completion, error) from caching.
If you place a form outside the page content (in a widget, a synced pattern, or a theme template), caching plugins still skip the page, but the HTTP headers may already have been sent. In that case, exclude those URLs from CDN and server-level caches manually.
After updating to 1.3.0, please purge your page cache and CDN cache once so that previously cached copies of your form pages are removed.
CSS Styling
This plugin does not include any frontend CSS for form display. You are expected to style the forms using your own theme’s stylesheet. HTML/CSS samples are available for reference on the plugin’s website.
Development Concept
HTML-First Approach: This plugin is designed to faithfully reproduce your designed HTML forms, confirmation screens, and error screens without forcing you to adapt to plugin limitations. The forms conform to your design, not the other way around.
Built for Web Professionals: LW Simple Forms does not provide CSS or HTML templates for the frontend. It’s specifically created for web designers and developers who already have designed their form screens and need a way to implement the functionality. (HTML/CSS samples are available for reference.)
Minimalist Philosophy: This plugin intentionally maintains a minimalist approach, focusing on core functionality rather than excessive features. We prioritize site speed and minimal data usage to keep your websites running efficiently.
Key Features
Complete Form Workflow: Create forms with input screen, error screen, confirmation screen, and completion screen
Flexible Design: Customize each screen with your own HTML
Form Validation: Server-side and client-side validation for each input field (required fields, email format, phone number validation)
Email Notifications: Send confirmation emails to both administrators and users
Security Features: CSRF protection, data sanitization, input validation, and secure data handling
Multiple Field Types: Support for text fields, text areas, checkboxes, radio buttons, select menus, and multi-select menus
Shortcode Support: Easy integration into WordPress pages via shortcodes
Custom HTML: Design your forms with complete HTML freedom
Multi-Form Support: Create and manage multiple forms on a single site
Database Storage: Form data is temporarily stored in the database rather than in sessions or cookies, allowing for unlimited submission data
JavaScript/No-JavaScript Support: Forms work properly even in environments where JavaScript is disabled (e.g., screen readers)
Field Validation: Extensive validation system with customizable error messages
Spam Protection Services: Optional Google reCAPTCHA v3 or Cloudflare Turnstile (since 1.4.0), besides the honeypot and the rate limit
Duplicate Submission Prevention: PRG (Post-Redirect-Get) pattern prevents duplicate form submissions on page reload
Security Measures: Protection against common vulnerabilities including CSRF attacks and header injection
Usage Guide
Design and create the HTML for input screen, confirmation screen, and completion screen
Register each screen as a WordPress page
Create a new form from “Forms” in the WordPress admin panel
Configure each section. You can configure the following:
HTML for each screen (input, confirmation, completion)
URL for each screen
Administrator email settings
User email settings
Validation settings (required fields, email format, phone number validation)
Use the “Parse HTML” button to automatically extract form fields from your input screen HTML
Add the appropriate shortcodes to your pages
Test the form operation before going live
Note: This plugin is designed to give you maximum freedom in writing form HTML, so you need to write the HTML for your form pages yourself. The plugin does not provide CSS or images for form display. HTML samples are available for reference.
Supported Input Fields
Form Screen Placeholders
Input Screen:
* Use [lwsf_value_fieldname] to display previously entered values
* Use [lwsf_error_fieldname] to display validation error messages
* Use [lwsf_send] for the submit button
* Optional: [lwsf_turnstile] puts Cloudflare Turnstile’s checkbox (shown only when Cloudflare asks for one) where you write it; without it, it goes just before the submit button (since 1.4.0)
Confirmation Screen:
* Use [lwsf_confirm_fieldname] to display submitted values
* Use [lwsf_back] for the back button
* Use [lwsf_send] for the submit button
The button tags [lwsf_send] and [lwsf_back] take an optional class attribute so that your theme’s button styles apply, for example [lwsf_send class="button primary"] (since 1.3.4).
Radio buttons, checkboxes and select menus keep their selected state by themselves: do not write [lwsf_value_fieldname] inside their tags (since 1.3.5 such a placeholder is removed on saving, with a note).
Completion Screen:
* Use [lwsf_field_fieldname] to display submitted values
Email Settings
Available placeholders for email templates:
* [lwsf_field_fieldname] – Display submitted form data
* [lwsf_site_admin_email] – Display site admin email
* [lwsf_site_name] – Display site name
* [lwsf_site_home_url] – Display site URL
Additional Information
For items that allow multiple selections (,
Example:
For checkboxes: Service A Service B
For select multiple:
Works in environments where JavaScript is disabled, such as screen readers
The outputted source code uses entity references for security measures and stable operation
Includes Japanese language files (UTF-8 only)
Avoids using reserved WordPress query variable names for form fields to prevent conflicts
PHP Compatibility: Requires PHP 7.4 or higher. Tested on PHP 7.4 through PHP 8.5.
Data Storage and Security
Form submissions are temporarily stored in the WordPress database (prefix_lwsf_form_data table)
Data is automatically cleaned up after 1 hour
All user inputs are sanitized before processing
CSRF protection is implemented on all form submissions
Email headers are validated to prevent header injection
Why This Plugin Was Created
This plugin was created because MW WP Form, which had been used for client work for many years, ended development. There was a need for a form plugin with confirmation screens that operated cleanly. The plugin was created primarily for web development work, and we thought many web development companies might have similar needs.
Future Implementation Plans
The ability to change validation error messages
PHP-based validation hooks that operate before and after form submission
Additional validation types (URL, numeric values, custom regex patterns)
Hooks to trigger at important timings such as just before and just after email sending
File upload handling
External services
This plugin can connect to one spam protection service, chosen in Settings > Spam Protection Service. Nothing is sent while “None” is chosen.
Google reCAPTCHA v3 – used to tell people from bots. On pages with a form, the visitor’s browser loads https://www.google.com/recaptcha/api.js, which sends Google information about the browser and the visit. When the form is sent, the plugin sends the token from the browser and the secret key to https://www.google.com/recaptcha/api/siteverify. Terms: https://policies.google.com/terms – Privacy: https://policies.google.com/privacy
Cloudflare Turnstile – used to tell people from bots. On pages with a form, the visitor’s browser loads https://challenges.cloudflare.com/turnstile/v0/api.js, which sends Cloudflare information about the browser and the visit (Cloudflare says Turnstile does not read the form’s contents). When the form is sent, the plugin sends the token and the secret key to https://challenges.cloudflare.com/turnstile/v0/siteverify. Terms: https://www.cloudflare.com/website-terms/ – Privacy: https://www.cloudflare.com/privacypolicy/ – Turnstile privacy addendum: https://www.cloudflare.com/turnstile-privacy-policy/
When you save the settings, the plugin also sends the secret key of the chosen service (reCAPTCHA or Turnstile) once, with a dummy token, to that service’s siteverify URL above, to tell you whether the key is accepted.
Mention the service you use in your site’s privacy policy (Cloudflare asks for this when the Invisible widget type is used). A Content Security Policy must allow the service’s domain for scripts and frames.
Privacy Policy
This plugin stores form submission data in the WordPress database (prefix_lwsf_form_data table) for the purpose of displaying confirmation and completion screens. Data is automatically deleted after 1 hour.
To recognise the same entry being submitted again, a hash of the submitted values and the visitor’s IP address is used as the key of a stored entry (forms without a confirmation screen) or of a separate record of sent entries (forms with a confirmation screen, while “Send Only Once” is on). The IP address itself is not stored. Rate limiting stores IP addresses separately and deletes them after 24 hours.
When enabled, user email addresses may be used to send confirmation emails to form submitters.
When reCAPTCHA v3 or Turnstile is enabled, see “External services” above. The plugin itself sends the service only the token from the visitor’s browser and the secret key; no form contents and no IP address. No other data is shared with external services.
With spam protection on, the form contains the time it was shown, signed with a key of the site (no personal data). Submissions that the service did not confirm are counted per IP address for the stricter limit; these records are deleted after 24 hours like the other rate-limit records.
