=== TW Form Guard ===
Contributors: tianwennetwork
Tags: elementor, spam, contact form, anti-spam, honeypot
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Requires Plugins: elementor-pro
Stable tag: 2.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Multi-layer spam protection for Elementor Pro Forms: honeypot, timing trap, rule engine and sender reputation. No CAPTCHA, nothing for real visitors to solve.

== Description ==

TW Form Guard sits in front of every Elementor Pro form on your site and decides, before Elementor stores or emails a submission, whether it looks like a real inquiry or spam.

**Four local layers, all free:**

* **Honeypot + timing trap** – an invisible field and a browser-side timestamp catch bots that post directly to admin-ajax.
* **Rule engine** – thirteen switchable rules learned from 29,000+ real B2B contact-form submissions: disposable mailbox domains, BBCode, two-or-more links, gambling/adult/forex words, Cyrillic promos with a link, scam phrases, template "wanted to know your price" translations, keyboard gibberish, random strings, bot-style names, empty messages from free mailboxes, invalid email addresses.
* **Sender reputation** – the same email, name or company domain hammering your forms is flagged automatically (8+ / 15+ occurrences, real buying teams stay safe).
* **Custom keywords and allow-lists** – your own hard-block words, plus allowed email addresses and company domains that bypass the soft rules.

**Dry run first.** The plugin starts in Dry run mode: every decision is written to the Log, nothing is rejected. Review the Log for a week, release anything genuine with one click (the sender is allow-listed automatically), then switch to Block. Switching to Block asks for confirmation and tells you how many entries would have been rejected in the last 7 days.

**Log you can actually read.** Verdicts are shown as Passed / Flagged / Blocked / Released badges, reasons as plain words, messages can be expanded in full, and the table has filters with counts, search, pagination and bulk release / delete. Log rows are deleted automatically after the retention period you choose (default 90 days) and are covered by the WordPress privacy export and erase tools.

**Premium: AI judge.** Submissions that pass every local rule can optionally be sent to the TW Form Guard cloud for a spam/ham verdict from a large language model. Off by default; see the Privacy section below. Premium is $79 per site per year or $9 per month and includes 10,000 AI verdicts per site per month. Above the quota the plugin keeps working with the rule layers only – it never stops accepting forms and never charges extra.

**Accuracy, stated honestly.** On our September 2026 benchmark of 88 real submissions collected from a live B2B site (69 spam, 19 genuine inquiries), the AI judge caught 63 of the 69 spam messages and kept all 19 of 19 genuine inquiries. That is one sample from one site; your numbers will differ. The plugin fails open: if the cloud is unreachable, the submission passes and the log says why.

Free build vs. Premium build: the free package ships without the update checker and without the license and AI inputs in Settings, so it never contacts our servers.

== Installation ==

1. Make sure Elementor and Elementor Pro (Forms widget) are installed and active.
2. Upload the `tw-form-guard` folder to `/wp-content/plugins/`, or install the zip through *Plugins → Add New → Upload Plugin*.
3. Activate the plugin. It starts in **Dry run** mode.
4. Open **TW Form Guard → Log** after a few days, release any genuine sender that was flagged, then switch **TW Form Guard → Settings → Mode** to **Block**.
5. Premium only: paste your license key under *Settings → License* and click *Verify & Activate*, then tick *AI judge* in *Privacy & AI*.

No template changes are needed. The traps are injected into every Elementor form on the front end; nothing is shown to visitors and nothing to solve.

== Frequently Asked Questions ==

= Does it work with Contact Form 7, WPForms or Gravity Forms? =

Not yet. Version 2.0 hooks into Elementor Pro Forms only (`elementor_pro/forms/validation`). Other form plugins are on the roadmap.

= Will real customers be blocked? =

Keep Dry run on for a week and read the Log. Every flagged entry shows the plain-language reason; releasing it allow-lists that exact email address (and, if you tick the box, the company domain – public mailboxes such as gmail or mail.ru are never trusted as a whole). Rules were tuned on real B2B traffic where short, imperfect English from a personal mailbox is often a genuine buyer, so those messages are not treated as spam by themselves.

= What is "one AI verdict"? =

One verdict is one submission that passed every local rule and was sent to the cloud for a spam/ham answer. Submissions stopped by local rules, allow-listed senders, and cloud failures (fail-open) do not count towards the 10,000 per month included in Premium.

= What does the free version send to your servers? =

Nothing. The free build ships without the update checker and cannot activate a license or the AI judge, so it never contacts our servers. Only the Premium build, and only with the AI judge switched on, sends submission content to the TW Form Guard cloud.

= Does it need CAPTCHA or reCAPTCHA? =

No. It does not add any challenge for visitors and does not conflict with an existing CAPTCHA if you keep one.

= I moved my site to a new domain. Is my license still valid? =

A Premium license is bound to one site. Deactivate it on the old site (*Settings → License → Deactivate*) and activate it on the new one. If the old site is gone, contact support at https://guard.storefixkit.com/support/.

= Where is the log stored and for how long? =

In your own database, table `{prefix}twfg_log`. Rows older than the retention period (Settings → Logging, default 90 days) are deleted daily. Uninstalling the plugin drops the table and all its options.

== Privacy ==

**Stored on your site.** For every Elementor form submission the plugin writes one log row: time, verdict, matched rules, sender name, email, message (up to 2,000 characters), visitor IP address and the page URL. Rows are deleted after the retention period you set (default 90 days) and the plugin registers exporter and eraser callbacks with the WordPress privacy tools, so *Tools → Export / Erase Personal Data* covers this data. Nothing here leaves your server.

**Sent to TW Form Guard cloud (Premium, AI judge switched on).** When enabled, the sender name, email and message of submissions that pass rule checks are sent over HTTPS to TW Form Guard cloud (guard.storefixkit.com), operated by TianWen Network, and processed by our AI provider (DeepSeek) to return a spam/ham verdict. Content is processed in memory and not stored; the cloud keeps only per-license request counters and rate-limit data (no message content, no visitor IP). The AI provider may be located outside the EU. If your site is subject to the GDPR, add this processor to your records and privacy policy before enabling the AI judge. Full policy: https://guard.storefixkit.com/privacy/

**License check (Premium only).** Activating a license sends the license key and your site URL to guard.storefixkit.com; the status is re-checked at most every 12 hours. The Premium build also asks guard.storefixkit.com for plugin updates the way wordpress.org plugins do, sending the plugin version and site URL.

The free build sends nothing anywhere.

== Screenshots ==

1. Settings – dry-run onboarding notice, mode with Block confirmation, rules with one-line descriptions, allow-lists, Privacy & AI disclosure, license status.
2. Log – verdict badges, plain-language reasons, expandable messages, filters with counts, search, bulk release / delete.

== Changelog ==

= 2.0.0 =
* New admin: WordPress-native settings sections and a WP_List_Table log with badges, plain-language reasons, full-message view, filters with counts, search, pagination, bulk Release / Delete and a mobile layout.
* Release now allow-lists the exact email only; trusting the whole domain is a separate, unchecked choice and public/disposable mailbox domains are refused.
* AI judge moved to the TW Form Guard cloud with a signed relay; no API keys are stored in WordPress any more. Off by default with a full disclosure in Settings.
* Premium licensing verified against the cloud; a formatted key alone no longer unlocks anything.
* Log retention (default 90 days) with a daily cleanup task; WordPress privacy exporter and eraser; visitor IP taken from REMOTE_ADDR unless "behind a trusted proxy" is enabled.
* Timing trap timestamp is now generated in the browser, so full-page caches no longer cause false "stale form" flags.
* Field detection uses Elementor field types first (no more `mailing_address` mistaken for an email).
* Sender reputation now uses the plugin's own indexed log with a 90-day window instead of scanning Elementor's submission tables.
* Clean uninstall: drops the log table and removes all plugin options.

= 1.5 =
* Gambling brands mostbet / olymp / pin-up added to the industry list; throwaway domain list extended.

= 1.1 =
* invalid_email, template_spam and repeat_domain rules from a 29,361-submission fleet replay.

= 1.0.0 =
* Initial release: honeypot, timing trap, rule engine, log and dry-run mode for Elementor Pro Forms.

== Upgrade Notice ==

= 2.0.0 =
Major update. Direct AI API settings were removed; Premium users need to activate a license key under Settings → License to keep the AI judge. Dry run / Block mode and rules are carried over.
