EG Contact Form Privacy

WordPress contact form with built-in anti-spam and no trackers, cookies, CAPTCHA, JavaScript or external services.

Italiano: README.it-IT.md

---

Features

• [eg_contact_form] shortcode: name, email, subject, message and privacy consent checkbox
• Message sent with wp_mail(), through the SMTP plugin already configured on the site
• Settings page: recipient, Subject field, suspect messages, auto-reply, appearance, statistics, test email
• Optional auto-reply to the sender, never repeating what was typed in the form
• Anti-spam without CAPTCHA, JavaScript or external services (see below)
• Messages that look automated are delivered with a "suspect" label instead of being dropped
• Daily counts of sent and blocked messages, with no personal data
• After an error the form keeps what the visitor typed; after a successful send, reloading the page does not send it again
• Error messages announced by screen readers, with the invalid field marked
• Internationalised (Italian included)

---

Usage

[eg_contact_form]
[eg_contact_form recipient="info@example.com" send_confirmation="no"]

The attributes override the settings for that form only.

Attribute	Value	Default
recipient	address that receives the messages	the one in the settings
send_confirmation	no turns off the auto-reply for that form	yes

The field labels are translatable; developers can change them with the eg_contact_form_labels filter (keys name, email, subject, message, submit).

---

Settings

Settings > EG Contact Form.

Tab	Settings
General	recipient, Subject field, suspect messages (labelled or to another address), auto-reply and its text, test email
Appearance	background (white, neutral, gradient, transparent, custom), border, shadow, accent color
Statistics	delivered, delivered as suspect and blocked in the last 30 days, with the reasons

The auto-reply text is plain text with the placeholders {site_name}, {site_url} and {date}. Left empty, the default text is used in the language of the page. A closing note always tells the recipient why they received the email.

---

Anti-spam

Check	What it does
Form token	signed and single-use: the form must stay open at least 5 seconds and be sent within 6 hours
Hidden field	bots fill it in; screen readers ignore it
Rate limiting	3 messages and 10 attempts per hour per IP address
Suspect messages	scored on their content; delivered with [SUSPECT: reasons] in the subject and no auto-reply, to the recipient or to a separate address
Auto-reply	nothing typed in the form; at most once a day per address and 10 per hour site-wide
Page cache	pages with the form are excluded, so every visitor gets their own token

A message is suspect when it scores 2 points or more:

Signal	Points
web address in the name	2
same sequence (5+ characters, with a digit) in name, subject and message	2
message shorter than 3 words	1
message made mostly of random words (9flSKAg, QNUXmxa)	1
@ or 4 digits in a row in the name	1
web address in the subject	1
name or subject made of one long string of letters and digits	1
identical fields	1

Behind a reverse proxy, the web server must pass the real visitor address to WordPress (for example Apache mod_remoteip or nginx real_ip), otherwise all visitors share the same limit.

Daily counts

Shown in Settings > EG Contact Form > Statistics. Kept for 30 days in the eg_contact_form_stats option, without IP addresses or message content:

wp option get eg_contact_form_stats --format=json

Outcomes: sent, quarantined, too_fast, honeypot, token_invalid, token_expired, token_used, nonce, rate_attempts, rate_sends, invalid, mail_error, autoreply_limited.

---

Data handled

• Name, email, subject and message: sent by email, not saved in the database
• SHA-256 hash of the IP address, for rate limiting: deleted after 1 hour
• Hash of the sender address, to limit auto-replies: deleted after 1 day
• Used form tokens: deleted after 6 hours
• Daily counts: no personal data, kept for 30 days

The plugin sets no cookies and contacts no external service. Copies of the emails may be kept by the SMTP plugin, if it logs them.

---

Installation

1. Download the zip of the latest release
2. Plugins > Add New > Upload Plugin, then activate it
3. Check the recipient in Settings > EG Contact Form and send a test email
4. Add [eg_contact_form] to a page

---

File structure

eg-contact-form/
├── eg-contact-form.php             Plugin: form handling, anti-spam, emails
├── includes/                       Settings page (loaded in the admin area only)
├── templates/contact-form.php      Form markup and styles
├── languages/                      Translation template and Italian translation
├── readme.txt                      WordPress readme
└── changelog.txt                   Changelog of earlier versions

---

Changelog

[1.6.0] - 2026-10-06

• Repository moved to https://git.emanuelegori.uno/emanuelegori/eg-contact-form
• Field labels filter renamed to eg_contact_form_labels
• Settings page address: options-general.php?page=eg-contact-form
• Settings and daily counts moved to new option names; the values already set are kept

[1.5.1] - 2026-10-06

• Form fields keep their colors while typing, whatever the theme
• The Privacy Policy link uses the text color and is underlined

[1.5.0] - 2026-10-05

• Settings page under Settings > EG Contact Form: recipient, Subject field, suspect messages, auto-reply, test email
• Suspect messages can be sent to a separate address
• Custom auto-reply text, with a closing note that explains why the recipient received the email
• Appearance settings: background, border, shadow and accent color
• Statistics of the last 30 days in the settings page
• eg_contact_form_privacy_labels filter for the field labels
• Reloading the page after a successful send no longer sends the message again
• Error messages announced by screen readers, with the invalid field marked
• The recipient is stored with the other settings; the value already set is kept

[1.4.2] - 2026-10-05

• New plugin description and privacy FAQ
• No emoji in the success message and in the Documentation link

[1.4.1] - 2026-10-05

• Messages with a web address in the name, or made mostly of random words, are marked as suspect

[1.4.0] - 2026-10-03

• Auto-reply with fixed text, at most once a day per address and 10 per hour site-wide
• Signed, single-use form token (5 seconds to 6 hours) instead of the timestamp field
• Suspect messages delivered with [SUSPECT: reasons] in the subject and no auto-reply
• Daily counts in the eg_contact_stats option
• Pages with the form excluded from page caching
• Rate limiting on the connection IP address only, failed attempts included
• An expired form keeps the text instead of showing an error page
• Hidden anti-spam field ignored by screen readers
• Fixed: commas in the name could add an address to the Reply-To header
• Fixed: field lengths counted in characters instead of bytes

Earlier versions are in changelog.txt.

---

License

GPL-2.0-or-later — https://www.gnu.org/licenses/gpl-2.0.html

---

Author

Emanuele Gori — emanuelegori.uno