RJ App Studio Form Builder is a contact form plugin built from the ground up around a
namespaced, PSR-4, dependency-injected architecture — not a fork or a
quick clone of an existing plugin. It ships with:

A React-based drag-and-drop form builder (Gutenberg-component powered)
29 field types, including Signature, Address, Name, GDPR Checkbox,
and reCAPTCHA/hCaptcha/Cloudflare Turnstile
A layered submission pipeline: honeypot, time-trap, rate limiting,
captcha verification, and spam scoring — all extensible via filters
Hardened file upload handling: MIME sniffing, random filenames, and
execution-blocked storage
A full entry manager: search, filter, spam folder, trash, star, notes,
and CSV/JSON export
Configurable email notifications with an autoresponder, HTML
templates, delivery logs, and automatic retry of failed sends
Conditional logic, multi-step forms with a progress bar, and
Save & Continue Later
An extensible integration framework (no third-party connectors bundled
by default — add your own via pilotform_register_integrations)
Native WordPress Privacy (GDPR) export/erase integration
Shortcode, Gutenberg block, and a pilotform_render_form() theme
function for embedding

Everything above is included and free under the GPL. There are no locked
features, no license keys, and no upsell prompts in the plugin.

Source Code

This plugin’s JavaScript and CSS are built with webpack from human-readable
source, and that source is included in full inside the plugin package
itself (not just linked to) — no separate repository is required to read,
study, or modify it. Each compiled file maps to source as follows:

assets/js/builder.js (admin form builder, entries, settings, design
screens) is built from resources/js/builder/ and resources/css/builder.css
assets/js/block-editor.js (Gutenberg block registration) is built
from resources/js/block-editor/
assets/js/frontend.js (public form submission script) is built from
resources/js/frontend/ and resources/css/frontend.css

webpack.config.js and babel.config.js (also included) define the
build. composer.json and package.json are included for the same
reason on the PHP dependency and JS tooling side respectively. To rebuild
every bundle from source yourself:

composer install && npm install && npm run build

External services

RJ App Studio Form Builder connects to third-party CAPTCHA providers only when a site
administrator enables that provider for a form. No external request is
made otherwise.

When you enable Google reCAPTCHA, hCaptcha, or Cloudflare Turnstile:

The provider’s widget script is loaded in the visitor’s browser on
pages that display the protected form, and the visitor’s interaction
token is generated by that provider.
On submission, RJ App Studio Form Builder sends the token, the visitor’s IP address,
and your site’s secret key to the provider’s verification endpoint to
confirm the submission is not automated:
- Google reCAPTCHA — https://www.google.com/recaptcha/api/siteverify
- hCaptcha — https://hcaptcha.com/siteverify
- Cloudflare Turnstile — https://challenges.cloudflare.com/turnstile/v0/siteverify

Each provider processes this data under its own terms and privacy policy:

Google: https://policies.google.com/terms and https://policies.google.com/privacy
hCaptcha: https://www.hcaptcha.com/terms and https://www.hcaptcha.com/privacy
Cloudflare: https://www.cloudflare.com/website-terms/ and https://www.cloudflare.com/privacypolicy/

All other anti-spam layers (honeypot, time-trap, rate limiting, and spam
scoring) run entirely on your own server and send nothing externally.

RJ App Studio Form Builder

Source Code

External services