RJ App Studio Form Builder

RJ App Studio Form Builder is a contact form plugin built from the ground up around a

namespaced, PSR-4, dependency-injected architecture — not a fork or a

quick clone of an existing plugin. It ships with:

• A React-based drag-and-drop form builder (Gutenberg-component powered)

• 29 field types, including Signature, Address, Name, GDPR Checkbox,

and reCAPTCHA/hCaptcha/Cloudflare Turnstile

• A layered submission pipeline: honeypot, time-trap, rate limiting,

captcha verification, and spam scoring — all extensible via filters

• Hardened file upload handling: MIME sniffing, random filenames, and

execution-blocked storage

• A full entry manager: search, filter, spam folder, trash, star, notes,

and CSV/JSON export

• Configurable email notifications with an autoresponder, HTML

templates, delivery logs, and automatic retry of failed sends

• Conditional logic, multi-step forms with a progress bar, and

Save & Continue Later

• An extensible integration framework (no third-party connectors bundled

by default — add your own via pilotform_register_integrations )

• Native WordPress Privacy (GDPR) export/erase integration

• Shortcode, Gutenberg block, and a pilotform_render_form() theme

function for embedding

Everything above is included and free under the GPL. There are no locked

features, no license keys, and no upsell prompts in the plugin.

Source Code

This plugin’s JavaScript and CSS are built with webpack from human-readable

source, and that source is included in full inside the plugin package

itself (not just linked to) — no separate repository is required to read,

study, or modify it. Each compiled file maps to source as follows:

• assets/js/builder.js (admin form builder, entries, settings, design

css

• assets/js/block-editor.js (Gutenberg block registration) is built

from resources/js/block-editor/

-

js (public form submission script) is built from

css

js (also included) define the

build. json are included for the same

reason on the PHP dependency and JS tooling side respectively. To rebuild

every bundle from source yourself:

composer install && npm install && npm run build

External services

RJ App Studio Form Builder connects to third-party CAPTCHA providers only when a site

administrator enables that provider for a form. No external request is

made otherwise.

When you enable Google reCAPTCHA, hCaptcha, or Cloudflare Turnstile:

• The provider’s widget script is loaded in the visitor’s browser on

pages that display the protected form, and the visitor’s interaction

token is generated by that provider.

• On submission, RJ App Studio Form Builder sends the token, the visitor’s IP address,

and your site’s secret key to the provider’s verification endpoint to

confirm the submission is not automated:

• Google reCAPTCHA — https://www.google.com/recaptcha/api/siteverify

• hCaptcha — https://hcaptcha.com/siteverify

• Cloudflare Turnstile — https://challenges.cloudflare.com/turnstile/v0/siteverify

Each provider processes this data under its own terms and privacy policy:

• Google: https://policies.google.com/terms and https://policies.google.com/privacy

• hCaptcha: https://www.hcaptcha.com/terms and https://www.hcaptcha.com/privacy

• Cloudflare: https://www.cloudflare.com/website-terms/ and https://www.cloudflare.com/privacypolicy/

All other anti-spam layers (honeypot, time-trap, rate limiting, and spam

scoring) run entirely on your own server and send nothing externally.