LW Simple Forms

LW Simple Forms is a versatile WordPress form plugin that allows you to create customizable forms. It supports the Japanese-style workflow of a complete form submission process:

• Input screen – Users enter their information

• Confirmation screen – Users review their input before submitting

• Completion screen – Thank you message after successful submission

The plugin also supports a simpler one-step submission process when confirmation is not needed.

A sample form with all supported field types is automatically created on first activation, so you can get started right away.

jp/

Important: Page Cache and CDN Compatibility

Form pages must not be served from a page cache. A cached input page keeps a security token that expires after 12 to 24 hours, so submissions start failing. A cached completion page can show one visitor’s submitted details to other visitors.

0, every page whose content contains a form shortcode is automatically marked as non-cacheable: the plugin sends no-cache HTTP headers and defines the DONOTCACHEPAGE constant, which caching plugins such as WP Super Cache, W3 Total Cache, WP Rocket, and LiteSpeed Cache respect.

Some caches ignore these signals. Examples are a CDN rule that overrides the origin’s cache headers (such as a Cloudflare Edge TTL setting that ignores the Cache-Control header), nginx FastCGI Cache or Varnish when configured to ignore them, and a hosting company’s own page cache. If you use one of these, please exclude the form page URLs (input, confirmation, completion, error) from caching.

If you place a form outside the page content (in a widget, a synced pattern, or a theme template), caching plugins still skip the page, but the HTTP headers may already have been sent. In that case, exclude those URLs from CDN and server-level caches manually.

0, please purge your page cache and CDN cache once so that previously cached copies of your form pages are removed.

CSS Styling

This plugin does not include any frontend CSS for form display. You are expected to style the forms using your own theme’s stylesheet. jp/html-sample-en/

Development Concept

-

HTML-First Approach: This plugin is designed to faithfully reproduce your designed HTML forms, confirmation screens, and error screens without forcing you to adapt to plugin limitations. The forms conform to your design, not the other way around.

-

Built for Web Professionals: LW Simple Forms does not provide CSS or HTML templates for the frontend. It’s specifically created for web designers and developers who already have designed their form screens and need a way to implement the functionality. )

-

Minimalist Philosophy: This plugin intentionally maintains a minimalist approach, focusing on core functionality rather than excessive features. We prioritize site speed and minimal data usage to keep your websites running efficiently.

Key Features

• Complete Form Workflow: Create forms with input screen, error screen, confirmation screen, and completion screen

• Flexible Design: Customize each screen with your own HTML

• Form Validation: Server-side and client-side validation for each input field (required fields, email format, phone number validation)

• Email Notifications: Send confirmation emails to both administrators and users

• Security Features: CSRF protection, data sanitization, input validation, and secure data handling

• Multiple Field Types: Support for text fields, text areas, checkboxes, radio buttons, select menus, and multi-select menus

• Shortcode Support: Easy integration into WordPress pages via shortcodes

• Custom HTML: Design your forms with complete HTML freedom

• Multi-Form Support: Create and manage multiple forms on a single site

• Database Storage: Form data is temporarily stored in the database rather than in sessions or cookies, allowing for unlimited submission data

• JavaScript/No-JavaScript Support: Forms work properly even in environments where JavaScript is disabled (e.g., screen readers)

• Field Validation: Extensive validation system with standard error messages

• Spam Protection Services: Optional Google reCAPTCHA v3 or Cloudflare Turnstile (since 1.4.0), besides the honeypot and the rate limit

• Duplicate Submission Prevention: PRG (Post-Redirect-Get) pattern prevents duplicate form submissions on page reload

• Security Measures: Protection against common vulnerabilities including CSRF attacks and header injection

Usage Guide

• Design and create the HTML for input screen, confirmation screen, and completion screen

• Register each screen as a WordPress page

• Create a new form from “Forms” in the WordPress admin panel

• Configure each section. You can configure the following:

• HTML for each screen (input, confirmation, completion)

• URL for each screen

• Administrator email settings

• User email settings

• Validation settings (required fields, email format, phone number validation)

• Use the “Parse HTML” button to automatically extract form fields from your input screen HTML

• Add the appropriate shortcodes to your pages

• Test the form operation before going live

Note: This plugin is designed to give you maximum freedom in writing form HTML, so you need to write the HTML for your form pages yourself. The plugin does not provide CSS or images for form display. HTML samples are available for reference.

Supported Input Fields

• <input type="text">

• <input type="tel">

• <input type="email">

• <input type="radio">

• <input type="checkbox">

• <textarea>

• <select>

• <select multiple>

Form Screen Placeholders

Input Screen:

* Use [lwsf_value_fieldname] to display previously entered values

* Use [lwsf_error_fieldname] to display validation error messages

* Use [lwsf_send] for the submit button

0)

Confirmation Screen:

* Use [lwsf_confirm_fieldname] to display submitted values

* Use [lwsf_back] for the back button

* Use [lwsf_send] for the submit button

4).

0 such a placeholder is removed on saving, with a note).

Completion Screen:

* Use [lwsf_field_fieldname] to display submitted values

Email Settings

Available placeholders for email templates:

* [lwsf_field_fieldname] – Display submitted form data

* [lwsf_site_admin_email] – Display site admin email

* [lwsf_site_name] – Display site name

* [lwsf_site_home_url] – Display site URL

Additional Information

-

For items that allow multiple selections ( <input type="checkbox">, <select multiple> ), you need to add [] to the name attribute.

Example:

• For checkboxes: <input type="checkbox" name="services[]" value="ServiceA"> Service A <input type="checkbox" name="services[]" value="ServiceB"> Service B

• For select multiple:

<select id="products" name="products[]" multiple size="4">

<option value="ProductA">Product A</option>

<option value="ProductB">Product B</option>

</select>

-

Works in environments where JavaScript is disabled, such as screen readers

• The outputted source code uses entity references for security measures and stable operation

• Includes Japanese language files (UTF-8 only)

• Avoids using reserved WordPress query variable names for form fields to prevent conflicts

• PHP Compatibility: Requires PHP 7.4 or higher. Tested on PHP 7.4 through PHP 8.5.

Data Storage and Security

• Form submissions are temporarily stored in the WordPress database (prefix_lwsf_form_data table)

• Data is automatically cleaned up after 1 hour

• All user inputs are sanitized before processing

• CSRF protection is implemented on all form submissions

• Email headers are validated to prevent header injection

• Visitor IP address (rate limits, duplicate check): since 1.4.1, CF-Connecting-IP is used only for connections from Cloudflare’s published IP ranges, and X-Forwarded-For (read from the right) / X-Real-IP only from trusted proxies (filter lwsf_trusted_proxies; by default this server (127.0.0.1,::1) and the private ranges 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 and fc00::/7; Cloudflare’s ranges: filter lwsf_cloudflare_ips ). Otherwise the connecting address is used, so a visitor cannot choose the address that the rate limits count, except behind a proxy that passes on a visitor-sent X-Real-IP (see 1.4.1 in the changelog) and where visitors themselves have private addresses (an intranet) or their connections arrive from one (Docker port publishing, a TCP proxy or NAT that does not add X-Forwarded-For); there, list only the real proxies in lwsf_trusted_proxies (with no proxy that passes on the visitor’s address, every visitor then counts as the one connecting address). A proxy with a public address must be named in lwsf_trusted_proxies, or every visitor counts as that proxy.

Why This Plugin Was Created

This plugin was created because MW WP Form, which had been used for client work for many years, ended development. There was a need for a form plugin with confirmation screens that operated cleanly. The plugin was created primarily for web development work, and we thought many web development companies might have similar needs.

Future Implementation Plans

• The ability to change validation error messages

• PHP-based validation hooks that operate before and after form submission

• Additional validation types (URL, numeric values, custom regex patterns)

• Hooks to trigger at important timings such as just before and just after email sending

• File upload handling

External services

This plugin can connect to one spam protection service, chosen in Settings > Spam Protection Service. Nothing is sent while “None” is chosen.

Google reCAPTCHA v3 – used to tell people from bots. js, which sends Google information about the browser and the visit. com/recaptcha/api/siteverify.

com/privacy

Cloudflare Turnstile – used to tell people from bots. js, which sends Cloudflare information about the browser and the visit (Cloudflare says Turnstile does not read the form’s contents). com/turnstile/v0/siteverify.

com/turnstile-privacy-policy/

When you save the settings, the plugin also sends the secret key of the chosen service (reCAPTCHA or Turnstile) once, with a dummy token, to that service’s siteverify URL above, to tell you whether the key is accepted.

Mention the service you use in your site’s privacy policy (Cloudflare asks for this when the Invisible widget type is used). com.

Privacy Policy

This plugin stores form submission data in the WordPress database (prefix_lwsf_form_data table) for the purpose of displaying confirmation and completion screens. Data is automatically deleted after 1 hour.

To recognise the same entry being submitted again, a hash of the submitted values and the visitor’s IP address is used as the key of a stored entry (forms without a confirmation screen) or of a separate record of sent entries (forms with a confirmation screen, while “Send Only Once” is on). The IP address itself is not stored. Rate limiting stores IP addresses separately and deletes them after 24 hours.

When enabled, user email addresses may be used to send confirmation emails to form submitters.

When reCAPTCHA v3 or Turnstile is enabled, see “External services” above. The plugin itself sends the service only the token from the visitor’s browser and the secret key; no form contents and no IP address. No other data is shared with external services.

With spam protection on, the form contains the time it was shown, signed with a key of the site (no personal data). Submissions that the service did not confirm are counted per IP address for the stricter limit; these records are deleted after 24 hours like the other rate-limit records.