=== KillerConversions – Contact Form Builder ===
Contributors: pluginsshop
Tags: contact form, form builder, conditional logic, lead generation, csv export
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.2.3
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Build contact and enquiry forms with conditional fields. Save entries in WordPress, send email notifications and export CSV.

== Description ==

KillerConversions is a WordPress form builder for contact forms, customer enquiries and quote requests. Build a form visually, publish it with a block or shortcode, and manage submitted entries in your WordPress dashboard. Free works without a vendor account, paid licence or marketing signup.

**[Try the Free demo](https://www.killerconversions.com/demo/?edition=free) | [Try the Pro demo](https://www.killerconversions.com/demo/?edition=pro) | [Compare Free and Pro](https://killerconversions.com/features/)**

The demo pages let you start temporary, isolated WordPress workspaces with fictional examples. No signup is required. Choose Free to build an enquiry form, or Pro to explore estimates and applications. Outgoing email and external connections are blocked in the demo. Use sample information only; demo work is temporary.

= What you can do with Free =

* **Build contact and enquiry forms:** start with a contact form, agency brief, quote enquiry, consultation request, feedback, newsletter interest, service enquiry or callback request.
* **Show relevant questions:** use basic conditional fields to show or hide ordinary enquiry questions based on previous answers.
* **Preview before publishing:** edit visually, reorder fields with the keyboard, save a private design draft and publish when ready. Use the WordPress block or a shortcode to display your form.
* **Keep enquiries in WordPress:** search, filter, star and assign entries, update their status, and export wide or long CSV files.
* **Send ordinary notifications:** choose a staff recipient or use Inbox only; queue configured emails and separately requested visitor confirmations, review failures and deliberately resend. Delivery depends on your site's mail provider.
* **Reduce spam:** built-in honeypot and submission rate limiting, plus optional Cloudflare Turnstile included in Free.
* **Collect repeatable details:** add up to three repeated groups with ten rows per group and six text, email, number, date or select fields per row. Groups require JavaScript; nested groups, uploads, consent, pricing and conditional dependencies inside groups are excluded.
* **Recover form designs:** use optional browser recovery, conflicting-save protection and a ten-design history. Credentials and operational settings stay outside that history.
* **Control your data:** choose entry retention, export or erase eligible records, and import/export sanitised form configurations. Entries, credentials, private destinations and live operational state are excluded from configuration exports by default; review local destinations after import. Optional Brevo and MailerLite subscriber actions require separate visitor consent.

Free imposes no artificial form or submission count, trial expiry or forced attribution. Hosting resources, safety limits and retention still apply. Submitted-entry counts are counts, not conversion rates.

= When Pro is useful =

The separately installed Pro add-on is for workflows that need more than an enquiry:

* **Calculate an estimate:** quantity × unit-price rows, fixed extras, advanced pricing and server-calculated itemisation; generate a branded PDF.
* **Collect an application:** multi-step forms and private PDF, PNG, JPEG or UTF-8 TXT uploads within supported hosting limits.
* **Let visitors return later:** explicitly saved, encrypted incomplete applications with private resume links and 1-, 3- or 7-day expiry. Incomplete answers are not captured automatically.
* **Organise follow-up:** advanced conditions, routing, connections and team-review workflows with deliberate setup.

A quote enquiry is included in Free; calculating a quote is Pro. Administrator form-design drafts are included in Free; visitor save-and-resume is Pro. Free does not download or install the Pro add-on.

Install Free first, then a compatible Pro release without uninstalling. The current matched pair is 1.2.3. Pro needs a successful licence activation for this website before its editing tools work. After activation, ordinary licence expiry or a licensing-service outage does not remove earned access. Missing or incompatible Pro pauses dependent workflows while retaining saved data and privacy operations. All Pro plans have the same features and differ by their 1, 3 or 10 website allowance; each distinct WordPress website needs a licence, with no additional staging allowance.

= Preview Pro inside Free =

Open Explore Pro for Quotes & PDFs, Save & resume, and Follow-up & teams. Genuine output and screens use fictional details and explain what Free already includes. Previews do not change forms or send data; editor links open separately to preserve unsaved work. You can hide or restore Pro previews and contextual suggestions for your administrator account on this website. Explore Pro stays available.

The bundled pricing example uses fixed sample rates and does not enable Pro calculations. Its fictional PDF embeds DejaVu Sans; font notices are in assets/pro-estimate-sample-LICENSE.txt. Local preview preferences remain until the documented explicit full uninstall.

Payments, signatures, AI form generation, A/B tests, multisite and a full CRM are outside scope. No conversion-lift, email-delivery, security or universal accessibility guarantee is claimed.

== Installation ==

1. Back up your WordPress files and database. Try the release on staging.
2. Upload killerconversions-1.2.3.zip through Plugins > Add New and activate Free.
3. If you need Pro, upload killerconversions-pro-1.2.3.zip from your customer account and keep Free active. For a fresh installation, activate Free before Pro.
4. First individual activation opens KillerConversions > Start here. Choose Collect enquiries, Request a quote or Collect a project brief. Exit focus mode restores WordPress navigation; Back to WordPress stays visible. Your focus preference is local to your user account on this site. A later individual reactivation opens your forms. Bulk activations and updates do not redirect you.
5. Use Try form, Save draft and Publish form deliberately. Add the KillerConversions block or `[killerconversions id="123"]` with your actual form ID.
6. Review Published settings: staff notifications, spam protection and entry retention reflect the saved public form. Guidance opens after a new publication; after Publish updates, expand Review published settings when needed. Set up email notifications or expand Use Inbox only when staff email is off; neither choice is required. No recipient is selected automatically.
7. Submit a controlled example through your published page, inspect Inbox and verify any intended email/provider receipt separately. Configured email does not mean delivery verified.

After the first successful form save, a short optional invitation lets you independently share the displayed website hostname or request tutorials, product updates and occasional offers at an editable email address. Both choices start unchecked. Continue without sharing preserves all Free features. Email signup requires inbox confirmation. Review these choices at KillerConversions > Privacy & emails. Opening the invitation, skipping it, viewing examples and choosing neither make no publisher request.

WordPress 6.5+ and PHP 7.4+ are required; Pro requires PHP 8.0+. MySQL or MariaDB with InnoDB tables is required for atomic storage. SQLite, including WordPress Playground, is not supported; use a compatible WordPress site. Text validation works without PHP mbstring; itemised estimates require 64-bit PHP integers. Pro visitor drafts require PHP Sodium; integrations require PHP cURL, a working CA bundle and public IPv4 HTTPS. Background cleanup and mail retries require working WordPress cron. The plugin does not alter your hosting limits or configure SMTP.

Form management and the searchable form picker require the WordPress manage_options capability, normally held by administrators. Other users who can edit a post can embed a published form using a form ID supplied by a form administrator. They cannot browse form titles or IDs through the plugin's administrative REST catalogue. Unpublished forms do not render publicly.

== Source code ==

All first-party PHP, JavaScript and CSS source is included in this plugin. The readable files in assets/ and blocks/form/editor.js are the exact editable files WordPress loads; there are no separate minified bundles or required build steps. See SOURCE.txt for the source map, optional formatting instructions and bundled font/PDF attribution. WordPress supplies the declared wp-* JavaScript dependencies through its own script loader; no copies of those libraries are bundled here.

== Privacy, storage and external services ==

Local core form use makes no publisher telemetry, licence or marketing requests. The optional website registration and marketing signup described below make requests only after explicit choices. Assets are bundled locally except the explicitly enabled Turnstile service below. Completed entries, files and provider credentials are private database data, not encrypted at rest by the plugin. Protect database access and backups.

= KillerConversions optional website registration and emails =

After explicit administrator selection, the plugin sends the displayed hostname for website registration, or the selected email address for an independently confirmed request for tutorials, product updates and occasional offers, to https://killerconversions.com/newsletter-api/v1/kc-welcome/. Each request includes its consent wording version, time and a random scoped connection reference. Email-only requests omit the site URL from the body and HTTP headers. Neither purpose sends form answers, customer lists, licence credentials or preview-click history. A voluntarily reported domain is not verified domain ownership or a count of active installations. These choices are independent of Pro licensing and of visitor subscriptions to Brevo or MailerLite.

Privacy & emails lets you stop domain sharing and manage the email request made there. Confirmed email preferences and unsubscribe are available through private email links. An unreachable service leaves a truthful retryable removal state; local sharing stops immediately. Copied or moved sites pause the connection and require fresh choices. Use the original site's controls or private email links to manage its existing relationship. Before explicitly removing all local plugin data, complete remote withdrawal; uninstall alone cannot guarantee it. Privacy: https://killerconversions.com/privacy/#plugin-registration . Terms: https://killerconversions.com/checkout/terms .

Domain reports expire after 90 days without another explicit request; no heartbeat is sent. Initial enrollment retries and pending email confirmations expire after 48 hours. Confirmed subscriptions expire after at most 730 days. The credential and consent attribution needed to stop emails requested here remain while that connected subscription is active. Stopped or unattached opaque controls expire after 90 days; consent and suppression records may remain for 180 days. Scheduled cleanup and backups have separate retention limits. The service receives the connection IP; hosting and email delivery service details are in https://killerconversions.com/newsletter/privacy .

Focus, preview visibility and explicit Remember this workflow choices stay local. A remembered workflow is retained for seven days and rechecks the saved form before continuation. Browsing a preview does not record a workflow choice or grant permission to send data. The optional consent record contains private connection material needed for authenticated withdrawal; privacy exports do not include that credential.

When Pro is active, saved visitor drafts are encrypted using Sodium and WordPress salt-derived keys; changing or losing those salts can make existing drafts unreadable. The plugin reports decryption failure without exposing answers or tokens. Resume tokens are hashed in storage and live in the private link fragment. Anyone holding a valid link can access that draft. Expiry runs from first save; consent/permission choices need a fresh visitor decision. Quota failure preserves an existing saved application. Site backups have their own retention.

Entry retention defaults to 90 days and can be set to 1–3650 days for new entries. Daily cleanup depends on WordPress cron. Pro visitor draft storage is capped at 64 MiB per form and 256 MiB per site; hosting capacity can reduce limits. Completed-entry/file storage has a baseline site budget and a health display. Deleting an entry removes linked files and jobs. Privacy exports/erasure locate entries by submitted email fields; records without one need administrator review. Email/provider copies are outside local erasure.

Optional editor recovery stores a design in that administrator's browser for up to 24 hours, excluding credentials, recipients and nonces. Ten-design history is local. Explicitly remembered workflow links are local per-administrator references with seven-day expiry. These actions make no external request.

New entries retain original field definitions. Same-page browser retries use a random attempt ID held in memory; the database retains its hash and committed entry reference until erasure/expiry. This does not cover a fresh page load, legacy clients or the no-JavaScript fallback. Abuse protection uses short-lived salted rate hashes, not stored raw IPs. Submitted-entry counts require no visitor tracking.

= Transactional email =

When configured, the queue passes the selected staff notification or separately requested visitor confirmation to WordPress wp_mail() and your site's mail provider. A submitted email can become validated Reply-To; it does not replace From. Estimates include their saved breakdown. Confirmation consent, marketing subscription and saved-link purposes remain separate. The plugin provides no SMTP service, bounce tracking or receipt guarantee. Disable a destination to stop future jobs; delivered copies need separate removal.

= Brevo (optional) =

An administrator explicitly enables and acknowledges this connection. With a separately checked optional visitor marketing-consent question, the plugin sends the mapped email, optional FIRSTNAME/LASTNAME and selected list ID to https://api.brevo.com/v3/contacts to create/update a subscriber contact. It does not send unrelated answers or files, force unsubscribe flags, perform double opt-in or send a campaign. Your Brevo list automations may run. Disable the connection to stop future requests; remove its saved credential to forget it locally. Provider copies require separate removal. Terms: https://www.brevo.com/legal/termsofuse/ ; privacy: https://www.brevo.com/legal/privacypolicy/ .

= MailerLite (optional) =

After administrator enablement/acknowledgement and separate optional visitor subscription consent, the plugin sends mapped email, optional name and selected group ID to https://connect.mailerlite.com/api/subscribers to create/update a subscriber. It does not send files or unrelated answers, request forced resubscription, or send a campaign. Group automations may run under your provider settings. Disable and remove credentials to stop future local requests; provider data needs separate removal. Terms: https://www.mailerlite.com/legal/terms-of-service ; privacy: https://www.mailerlite.com/legal/privacy-policy .

Changing a destination, mapping or consent meaning cancels old pending work instead of reinterpreting it. Reviewed resend preserves recorded consent. Copied-site protection pauses outgoing work after a recorded address/environment change; identical-identity copies and pre-baseline copies need operator review.

= Cloudflare Turnstile (optional) =

Turnstile defaults off and needs widget keys plus service acknowledgement. Enabled forms load https://challenges.cloudflare.com/turnstile/v0/api.js; Cloudflare processes browser/network signals. The server sends only the configured secret and challenge token to https://challenges.cloudflare.com/turnstile/v0/siteverify. Form answers are not included. Protected forms require JavaScript; editor preview never loads it. Disable protection to stop requests and remove the saved secret to forget it. Privacy: https://www.cloudflare.com/turnstile-privacy-policy/ ; terms: https://www.cloudflare.com/website-terms/ .

== Frequently Asked Questions ==

= Can I use Free without an account? =

Yes. Create and publish enquiry forms, store entries, export CSV and configure ordinary email notifications without a KillerConversions account or licence. Optional website registration, marketing emails and third-party connections remain separate choices.

= Can Free calculate quotes or accept file uploads? =

Free can collect a quote request. Calculated estimates, multi-step applications, file uploads and visitor save-and-resume require the separate Pro add-on. The Free and Pro demo links above let you try these workflows before installing.

= Why aren't I receiving notification emails? =

The staff notification address starts empty. Entries still appear in Inbox. Open the form's Connect tab, enter a Staff notification email, then Publish form. Or leave it blank to use Inbox only. Visitor confirmations and Pro routing have separate settings. Check any paused-delivery notice, submit a controlled example through the published page and review Inbox and delivery status. Confirm receipt with the intended recipient; WordPress mail acceptance is not proof of inbox delivery. The plugin does not configure SMTP.

= What spam protection is included? =

Free includes a honeypot and submission rate limiting. Optional Cloudflare Turnstile adds a browser challenge and server verification. It starts off: open Settings > Spam protection, add your widget's site key and secret, acknowledge the external service, enable it and publish. Test the published form; the editor preview does not load Turnstile. Protected forms require JavaScript. See the Turnstile privacy disclosure above.

= Are my entries lost if email fails? =

No. A committed entry stays saved when transport or post-save extensions fail. Queue-storage failure rejects the submission before commit so the visitor can retry.

= What happens when Pro is deactivated? =

Basic workflows continue with Free alone. Premium-dependent forms and jobs retain their data and pause with an explanation; they do not calculate a different price or silently choose a fallback recipient. Existing scoped staff restrictions remain enforced. Finish both updates before editing during a mixed-version upgrade.

= Does it work without JavaScript? =

Published forms have a standard server submission fallback. All relevant server validation still applies; enhanced multi-step navigation, save/resume, live estimates and the visual editor require JavaScript. Without it, fields remain readable together. Turnstile-protected forms require JavaScript.

= Where can I get help? =

Use https://killerconversions.com/docs/ and the public support form at https://killerconversions.com/help/ . Public support has no guaranteed response time. No subscription or sister-plugin installation is required for local features.

= How do I recover an upgrade? =

Keep a pre-upgrade database/files backup. Reinstalling an old ZIP does not reverse migrations. Do not overwrite newer submissions with an old database. Follow the matched update and recovery guide and test restoration on a separate copy.

== Data on uninstall ==

Deactivation and normal uninstall preserve forms and entries. Deliberate permanent removal requires `define( 'KCONV_DELETE_DATA_ON_UNINSTALL', true );` in wp-config.php before uninstalling Free. Back up needed data first. This removes plugin-owned data for the current site; it does not retract email/provider copies or release a remote licence seat. Multisite network removal is unsupported.

== Optional plugins from the same publisher ==

These separate plugins handle related jobs. They are optional and are not required for KillerConversions.

Useful alongside forms and enquiries:

* [ClickClue — session recording and replay](https://wordpress.org/plugins/clickclue/) — Review consenting visitors’ navigation, clicks and scrolling around enquiry pages.
* [CatalogFAQ — FAQ accordions and product answers](https://wordpress.org/plugins/catalogfaq-product-answers/) — Publish reusable answers to common questions before visitors contact you.
* [CampaignBars — announcement and notification bars](https://wordpress.org/plugins/campaignbars-announcement-manager/) — Point visitors to an enquiry or application page with a site notice.
* [CustomFields — custom fields and content types](https://wordpress.org/plugins/customfields-com/) — Structure the service, project or event content around your forms.

More tools from Plugins.shop:

* [Logged.ai — WordPress activity log](https://wordpress.org/plugins/logged-ai/) — Review supported site changes and their recorded context.
* [Shieldlume Security by Antivirus.ai — malware scanner](https://wordpress.org/plugins/shieldlume-security/) — Review local malware findings and file-integrity differences.
* [Cartdini — WooCommerce checkout field editor](https://wordpress.org/plugins/cartdini/) — Collect additional order details at checkout.
* [Frictions — WooCommerce checkout session replay](https://wordpress.org/plugins/frictions/) — Investigate eligible checkout visits with configured shopper consent.
* [OrderFloor — WooCommerce minimum order and quantity limits](https://wordpress.org/plugins/orderfloor/) — Set minimum spend, quantity and pack rules.
* [OrderWorth — WooCommerce cost of goods and profit reports](https://wordpress.org/plugins/orderworth/) — Review estimated order profit and missing cost information.
* [StockControls — WooCommerce inventory management](https://wordpress.org/plugins/stockcontrols-inventory-operations/) — Review stock movements, suppliers and purchase orders.

WooCommerce is required for the store-specific plugins listed above. These links do not imply a built-in integration with KillerConversions.

== Screenshots ==

1. Start with an enquiry, quote request or project brief in the Free workspace. Optional Pro previews are switched off.
2. Build a Free enquiry form with the visual editor, field settings and live preview. Fictional example form.
3. Review fictional enquiries in the WordPress inbox, with search, filters and CSV export. Optional Pro previews are switched off.

== Changelog ==

= 1.2.3 =
* Clarify that optional Turnstile requires Cloudflare site and secret keys, without implying saved keys are missing.
* Label the optional update summary Review published settings; new-publication guidance opens and update guidance stays collapsed.
* Keep editor tabs and controls reachable at high browser zoom by letting the toolbar scroll on short windows, and remove its unused admin-bar gap in focus mode.


= 1.2.2 =
* Show the published form's staff notification, spam protection and new-entry retention settings after publishing, including configuration problems and paused delivery.
* Make the default-off staff email choice explicit with Set up email notifications and Use Inbox only, without selecting a recipient automatically.
* Explain Free's honeypot, submission rate limiting and optional Turnstile, and guide a real submission, Inbox and email-receipt check.


= 1.2.1 =
* Preserve form edits and show an accurate unconfirmed-save message when a server response or save finalization fails. Check the latest saved version before retrying.
* Keep confirmed commits separate from unconfirmed results; do not automatically retry an uncertain save.


= 1.2.0 =
* Focused workspace with a shared sidebar, accessible mobile navigation and clear routes back to WordPress.
* Optional Pro preview shortcuts with a saved per-administrator visibility preference; Explore Pro remains available.
* Task-specific Pro examples and accurate Free/Pro comparisons.
* Plugins.shop attribution and a local More Plugins collection with clear external links.


= 1.1.3 =
* Match the Free and Pro release versions and clarify the 1, 3 and 10 website licence plans. Each distinct WordPress website needs a licence, with no extra staging allowance.
* Open Start here after the first successful individual activation and the forms workspace after a returning activation. The redirect stays within that request; bulk activations, updates and background operations do not create a deferred redirect.

Earlier release notes are preserved in CHANGELOG-HISTORY.txt in the plugin package.

== Developer notes ==

All executable source ships in readable form. No compilation is needed. The optional remote services are disclosed above.
