=== AIO LeadDefense for Contact Form 7 ===
Contributors: akshsoel
Tags: contact form 7, cf7, leads, form submissions, spam protection
Requires at least: 6.9
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.3.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html
Requires Plugins: contact-form-7

Never lose a Contact Form 7 lead again — every submission is saved to your database, even when email delivery fails.

== Description ==

**Requires Contact Form 7.** Contact Form 7 only ever tries to email you. If SMTP is down, misconfigured, or just quietly fails, the lead is gone — no record, no way to know. AIO LeadDefense for Contact Form 7 saves every submission straight to your database the moment it's validated, before Contact Form 7 even attempts to send the notification email.

= Key Features (Free) =

* **Database-first storage** — leads are saved independently of email delivery success or failure.
* **Leads dashboard** — searchable, filterable, sortable list of every submission with Name, Email, Phone, Message, Form, and delivery Status at a glance, plus an "Other Fields" preview for any extra custom fields your form has.
* **File upload support** — resumes, images, and other CF7 attachments are preserved with the lead, not lost when Contact Form 7 cleans up its temp files.
* **Built-in spam control** — honeypot field, submission time-trap, and a configurable keyword blocklist, with no external API required.
* **CSV export** and **Clear Log** — export leads respecting your active filters, or wipe the log entirely.
* **Multi-step form support** — works with CF7 multi-step form add-ons.
* **Multisite-aware** and **privacy-conscious** — IP logging can be turned off, and you control whether uninstalling deletes your data.
* **Optional lead geolocation** — see which country a lead came from. Off by default (see Privacy Notices below); turn it on in Settings and it works immediately with no signup, looked up on demand and cached per lead. Add a free [ipinfo.io/lite](https://ipinfo.io/lite) token for higher volume/accuracy.

= Pro Version ($10 one-time) =

LeadDefense Pro adds a full **Connections** system: add multiple SMTP or API-key connections (SMTP2GO, Brevo, SendGrid, and more), assign one as Primary and one as Fallback, and delivery automatically retries through the fallback the instant your primary fails. A dedicated **Alerts** connection and event log keep you informed — with a configurable notification frequency — even if both your main connections go down at once.

== Installation ==

1. Make sure Contact Form 7 is installed and active.
2. Upload the `aio-leaddefense-for-cf7` folder to `/wp-content/plugins/`, or install it from the WordPress Plugins screen.
3. Activate the plugin.
4. Go to **LeadDefense** in your WordPress admin menu to view captured leads and configure spam settings.

No further setup is required — LeadDefense starts capturing leads from every existing Contact Form 7 form automatically.

== Frequently Asked Questions ==

= Does this replace Contact Form 7's email notifications? =

No. Email notifications still work exactly as configured in Contact Form 7. LeadDefense simply also saves a permanent copy of every submission to the database, so nothing is lost if the email fails to send.

= Does this work with other form plugins like WPForms or Gravity Forms? =

No, AIO LeadDefense for Contact Form 7 is built specifically for Contact Form 7 and requires it to be active.

= What happens to my leads if I deactivate or uninstall the plugin? =

Deactivating never deletes data. Uninstalling only deletes data if you explicitly enabled "Delete data on uninstall" under the Settings tab first.

== Privacy Notices ==

AIO LeadDefense for Contact Form 7 stores form submissions (and, optionally, the submitter's IP address) in your own site's database. This data never leaves your server as part of normal operation.

**Optional lead geolocation**: if you turn on "Show Lead Country" in Settings (off by default), a lead's stored IP address is sent to a third-party lookup service to resolve it to a country — [ipwho.is](https://ipwho.is/) by default, or [ipinfo.io](https://ipinfo.io/privacy-policy) if you add your own free API token. This only happens when you view a lead, and each lead is looked up once and cached, never automatically for every submission. If you enable this on a site with EU visitors, review the linked provider's privacy policy against your own site's privacy policy / GDPR obligations.

**Pro (Connections/Alerts)**: if you configure an SMTP or API-based mail connection (e.g. SMTP2GO, Brevo, SendGrid, Mailgun), the email addresses and message content of your CF7 notifications are sent through that provider to deliver mail — the same as configuring any SMTP plugin. This only applies to providers you explicitly set up and does not affect the Free tier.

== Screenshots ==

1. Leads dashboard with stats, filters, and status badges.
2. Lead detail view with attachments.
3. Pro: Connections tab with role assignment.
4. Pro: Alerts tab with delivery log.

== Changelog ==

= 1.3.4 =
* Fixed: an uninstall.php file's mere presence prevents Freemius from reporting uninstall events. Uninstall cleanup logic moved to a shared function, hooked to Freemius's `after_uninstall` action for the WordPress.org/Freemius builds; uninstall.php itself remains only in the CodeCanyon build, which has no Freemius SDK to conflict with.
* Fixed: the CodeCanyon build was not excluding the Freemius SDK folder, unnecessarily bundling ~4MB of unused code.

= 1.3.3 =
* Added: real Pro checkout link on the Upgrade tab, now that Pro is purchasable.

= 1.3.2 =
* Fixed: plugin header "License" field format (now "GPLv2 or later", matching WordPress.org's expected format exactly) so the header validates cleanly on submission.
* Added: Plugin URI header.

= 1.3.1 =
* Fixed: the Lead Details modal and "Other Fields" column could show stale/incorrect data for leads captured through a Contact Form 7 form that was later edited or deleted, since that field mapping was previously re-computed from the live form on every view. Now frozen into each lead's own record at submission time, with a safe fallback for leads captured before this fix.
* Hardened: full security review — confirmed every AJAX endpoint requires a valid nonce and `manage_options`, no unauthenticated (`nopriv`) entry points exist, all database queries are parameterized, and no connection secrets are ever exposed in page markup.

= 1.3.0 =
* Added: "Other Fields" column on the Leads table — a compact preview of any custom form fields (dropdowns, extra text fields, etc.) beyond Name/Email/Phone/Message, without needing to open each lead individually.

= 1.2.0 =
* Added: dedicated, paginated Alert Log tab (Pro) — moved out of the Alerts tab, which now links to it. Log capacity raised from 100 to 500 entries.

= 1.1.0 =
* Added: Edit Connection on the Pro Connections tab.
* Added: configurable notification email on the Pro Alerts tab (separate from the site admin email).
* Added: optional lead geolocation (country), shown in the Leads table and lead detail view — off by default, works with no signup once enabled, or add a free ipinfo.io/lite token for higher volume/accuracy.

= 1.0.0 =
* Initial release.

== Upgrade Notice ==

= 1.1.0 =
Adds optional lead geolocation, Connections editing, and a configurable alert email.

= 1.0.0 =
Initial release.
