I stumbled across the php version after finding the wp version and I am glad I did.
I was considering utilizing WP as a form server. Now I don’t have to. What I’ve found in other mail form solutions leaves me with a wish-list that would make this standalone a standout.
The only thing I’d consider a must is #1. The rest is just wish-list. When you reach 9, you’re well in the fluffier part of the wish-list and submitted to help you with ideas.
Wish-list:
1. Specifically for the standalone version: Instead of completely turning off domain checks when the install is hosted at a different site, would be an option to check for a specific domain or domains per individual form. This would be simple for the user to understand and allow a high level of security for one install that is used for multiple domains. PHP mail scripts I’ve used 10 years ago had this feature and it would be welcome to see implemented here.
2. Change number of CAPTCHA characters per form
3. Where CAPTCHA images don’t work or CAPTCHA is not an option it would be nice to, per form, design questions and answers as check for bots. It’s not quite as effective but questions can be branded towards the text already on the site. Its more appealing to a greater number of users than CAPTCHA images. Additionally the question sets can be randomized.
4. All extra fields must go above or below the message box. It would look better to have the option per field to go above and below.
5. I couldn’t find an easy way to reorder the extra fields.
6. Option to Email backup to admin address.
7. Make phone a standard field instead of an add-on. The regex I found that works well and requires at least 10 numbers is /^(\D*\d){10,}$/
8. I couldn’t find an easy way to reorder forms.
9. Sometimes you just want to be notified by text message that you have an email to go read. Implement a SMS styled notification system. Provide a list of the email to SMS gateway domains.
10. Implement the same as 9 for twitter
11. Time limit multiple completed submissions, another way to spam limit the system. Start a countdown until a second email can be send from the same ip.
12. blacklisting/whitelisting by root domain and by ip and ip block.
13. SMS/Email/Twitter when attack is detected and lockout that ip.
14. Maintain a monthly count successful emails per form and email to site admin. Good for knowing if you’re an unwilling spammer. Great if you charge clients on usage.