if ( ! defined( 'ABSPATH' ) ) {
use WPForms\Admin\Notice;
use WPForms\Migrations\Migrations as LiteMigration;
use WPForms\Pro\Migrations\Migrations;
use WPForms\Admin\Settings\Payments;
* The current active tab.
* Primary class constructor.
public function __construct() {
private function hooks() {
// Maybe load settings page.
add_action( 'admin_init', [ $this, 'init' ] );
* Determine if the user is viewing the settings page, if so, party on.
public function init() { // phpcs:ignore WPForms.PHP.HooksMethod.InvalidPlaceForAddingHooks
// Only load if we are actually on the settings page.
if ( ! wpforms_is_admin_page( 'settings' ) ) {
// Include API callbacks and functions.
require_once WPFORMS_PLUGIN_DIR . 'includes/admin/settings-api.php';
// Show downgraded notice.
$this->maybe_display_downgraded_notice();
// Watch for triggered save.
// Determine the current active settings tab.
// phpcs:ignore WordPress.Security.NonceVerification.Recommended
$this->view = isset( $_GET['view'] ) ? sanitize_key( wp_unslash( $_GET['view'] ) ) : 'general';
add_action( 'admin_enqueue_scripts', [ $this, 'enqueues' ] );
add_action( 'wpforms_admin_page', [ $this, 'output' ] );
// Monitor custom tables.
$this->monitor_custom_tables();
do_action( 'wpforms_settings_init', $this );
* Remove `wpforms-integration` query arg from URL.
* The `wpforms-integration` query arg is used to highlight a specific provider on the Integrations page.
private function modify_url() {
if ( $this->view !== 'integrations' ) {
$_SERVER['REQUEST_URI'] = remove_query_arg( 'wpforms-integration' );
* Display admin notice about using a downgraded version of WPForms.
private function maybe_display_downgraded_notice() {
if ( ! $this->is_downgraded_version() ) {
wp_kses( /* translators: %1$s - WPForms.com doc page URL; %2$s - button text. */
'It looks like you\'ve downgraded to an older version of WPForms. We recommend always using the latest version as some features may not function as expected in older versions. <a href="%1$s" target="_blank" rel="noopener">%2$s</a>',
esc_url( wpforms_utm_link( 'https://wpforms.com/docs/why-you-should-always-use-the-latest-version-of-wpforms/', 'Settings', 'Downgrade notice' ) ),
esc_html__( 'Learn More', 'wpforms-lite' )
'dismiss' => Notice::DISMISS_GLOBAL,
'slug' => 'wpforms_is_downgraded',
* Check if plugin was downgraded.
private function is_downgraded_version(): bool {
// Get all installed versions.
$installed_versions = wpforms()->is_pro() ?
(array) get_option( Migrations::MIGRATED_OPTION_NAME, [] ) :
(array) get_option( LiteMigration::MIGRATED_OPTION_NAME, [] );
// Get the most recent installed version.
$db_latest = array_keys( $installed_versions )[ count( $installed_versions ) - 1 ];
// Check if downgrade happened.
return version_compare( $db_latest, WPFORMS_VERSION, '>' );
* Sanitize and save settings.
public function save_settings() { // phpcs:ignore Generic.Metrics.CyclomaticComplexity.MaxExceeded, Generic.Metrics.NestingLevel.MaxExceeded
// Check nonce and other various security checks.
if ( ! isset( $_POST['wpforms-settings-submit'] ) || empty( $_POST['nonce'] ) ) {
if ( ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['nonce'] ) ), 'wpforms-settings-nonce' ) ) {
if ( ! wpforms_current_user_can() ) {
if ( empty( $_POST['view'] ) ) {
$current_view = sanitize_key( $_POST['view'] );
// Get registered fields and current settings.
$fields = $this->get_registered_settings( $current_view );
$settings = get_option( 'wpforms_settings', [] );
$original_settings = $settings;
// Views excluded from saving list.
$exclude_views = apply_filters( 'wpforms_settings_exclude_view', [], $fields, $settings );
if ( is_array( $exclude_views ) && in_array( $current_view, $exclude_views, true ) ) {
// Run a custom save processing for excluded views.
do_action( 'wpforms_settings_custom_process', $current_view, $fields, $settings );
if ( empty( $fields ) || ! is_array( $fields ) ) {
// Sanitize and prep each field.
foreach ( $fields as $id => $field ) {
// Certain field types are not valid for saving and are skipped.
$exclude = apply_filters( 'wpforms_settings_exclude_type', [ 'content', 'license', 'providers' ] );
if ( empty( $field['type'] ) || in_array( $field['type'], $exclude, true ) ) {
// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
$value = isset( $_POST[ $id ] ) ? wp_unslash( $_POST[ $id ] ) : false;
$value_prev = isset( $settings[ $id ] ) ? $settings[ $id ] : false;
// Trim all string values.
if ( is_string( $value ) ) {
// Custom filter can be provided for sanitizing, otherwise use defaults.
if ( ! empty( $field['filter'] ) && is_callable( $field['filter'] ) ) {
$value = call_user_func( $field['filter'], $value, $id, $field, $value_prev );
switch ( $field['type'] ) {
$value = esc_url_raw( $value );
$value = wpforms_sanitize_hex_color( $value );
$value = array_map( 'wpforms_sanitize_hex_color', $value );
$value = $this->validate_field_with_options( $field, $value, $value_prev );
$value = sanitize_text_field( $value );
$settings[ $id ] = $value;
wpforms_update_settings( $settings );
Notice::success( esc_html__( 'Settings were successfully saved.', 'wpforms-lite' ) );
if ( isset( $original_settings['currency'], $settings['currency'] ) && $original_settings['currency'] !== $settings['currency'] ) {
Notice::warning( esc_html__( "You've changed your currency. Please double-check the product prices in your forms and verify that they're correct.", 'wpforms-lite' ) );
* Enqueue assets for the settings page.
public function enqueues() {
do_action( 'wpforms_settings_enqueue' );
* Return registered settings tabs.
public function get_tabs() {
'name' => esc_html__( 'General', 'wpforms-lite' ),
'submit' => esc_html__( 'Save Settings', 'wpforms-lite' ),
'name' => esc_html__( 'Validation', 'wpforms-lite' ),
'submit' => esc_html__( 'Save Settings', 'wpforms-lite' ),
'name' => esc_html__( 'Integrations', 'wpforms-lite' ),
'name' => esc_html__( 'Geolocation', 'wpforms-lite' ),
'name' => esc_html__( 'Misc', 'wpforms-lite' ),
'submit' => esc_html__( 'Save Settings', 'wpforms-lite' ),
return apply_filters( 'wpforms_settings_tabs', $tabs );
* Output tab navigation area.
$tabs = $this->get_tabs();
echo '<ul class="wpforms-admin-tabs">';
foreach ( $tabs as $id => $tab ) {
$active = $id === $this->view ? 'active' : '';
$link = add_query_arg( 'view', $id, admin_url( 'admin.php?page=wpforms-settings' ) );
echo '<li><a href="' . esc_url_raw( $link ) . '" class="' . esc_attr( $active ) . '">' . esc_html( $tab['name'] ) . '</a></li>';
* Return all the default registered settings fields.
* @param string $view The current view (tab) on Settings page.
public function get_registered_settings( $view = '' ) {
'id' => 'license-heading',
'content' => '<h4>' . esc_html__( 'License', 'wpforms-lite' ) . '</h4><p>' . esc_html__( 'Your license key provides access to updates and addons.', 'wpforms-lite' ) . '</p>',
'class' => [ 'section-heading' ],
'name' => esc_html__( 'License Key', 'wpforms-lite' ),
'id' => 'general-heading',
'content' => '<h4>' . esc_html__( 'General', 'wpforms-lite' ) . '</h4>',
'class' => [ 'section-heading', 'no-desc' ],
'name' => esc_html__( 'Include Form Styling', 'wpforms-lite' ),
wp_kses( /* translators: %s - WPForms.com form styling setting URL. */
__( 'Determines which CSS files to load and use for the site. "Base and Form Theme Styling" is recommended, unless you are experienced with CSS or instructed by support to change settings. <a href="%s" target="_blank" rel="noopener noreferrer" class="wpforms-learn-more">Learn More</a>', 'wpforms-lite' ),
esc_url( wpforms_utm_link( 'https://wpforms.com/docs/how-to-choose-an-include-form-styling-setting/', 'settings-license', 'Form Styling Documentation' ) )
1 => esc_html__( 'Base and form theme styling', 'wpforms-lite' ),
2 => esc_html__( 'Base styling only', 'wpforms-lite' ),
3 => esc_html__( 'No styling', 'wpforms-lite' ),
'name' => esc_html__( 'Load Assets Globally', 'wpforms-lite' ),
'desc' => esc_html__( 'Load WPForms assets site-wide. Only check if your site is having compatibility issues or instructed to by support.', 'wpforms-lite' ),
'content' => '<h4>' . esc_html__( 'GDPR', 'wpforms-lite' ) . '</h4>',
'class' => [ 'section-heading', 'no-desc' ],
'name' => esc_html__( 'GDPR Enhancements', 'wpforms-lite' ),
wp_kses( /* translators: %s - WPForms.com GDPR documentation URL. */
__( 'Enable GDPR related features and enhancements. <a href="%s" target="_blank" rel="noopener noreferrer" class="wpforms-learn-more">Learn More</a>', 'wpforms-lite' ),
esc_url( wpforms_utm_link( 'https://wpforms.com/docs/how-to-create-gdpr-compliant-forms/', 'settings-license', 'GDPR Documentation' ) )
// Validation messages settings tab.
'validation-heading' => [
'id' => 'validation-heading',
'content' => sprintf( /* translators: %s - WPForms.com smart tags documentation URL. */
esc_html__( '%1$s These messages are displayed to the users as they fill out a form in real-time. Messages can include plain text and/or %2$sSmart Tags%3$s.', 'wpforms-lite' ),
'<h4>' . esc_html__( 'Validation Messages', 'wpforms-lite' )
'<a href="' . esc_url( wpforms_utm_link( 'https://wpforms.com/docs/how-to-use-smart-tags-in-wpforms/#smart-tags', 'Settings - Validation', 'Smart Tag Documentation' ) ) . '" target="_blank" rel="noopener noreferrer">',
'class' => [ 'section-heading' ],
'validation-required' => [
'id' => 'validation-required',
'name' => esc_html__( 'Required', 'wpforms-lite' ),
'default' => esc_html__( 'This field is required.', 'wpforms-lite' ),
'id' => 'validation-email',
'name' => esc_html__( 'Email', 'wpforms-lite' ),
'default' => esc_html__( 'Please enter a valid email address.', 'wpforms-lite' ),
'validation-email-suggestion' => [
'id' => 'validation-email-suggestion',
'name' => esc_html__( 'Email Suggestion', 'wpforms-lite' ),
'default' => sprintf( /* translators: %s - suggested email address. */
esc_html__( 'Did you mean %s?', 'wpforms-lite' ),
'validation-email-restricted' => [
'id' => 'validation-email-restricted',
'name' => esc_html__( 'Email Restricted', 'wpforms-lite' ),
'default' => esc_html__( 'This email address is not allowed.', 'wpforms-lite' ),
'id' => 'validation-number',
'name' => esc_html__( 'Number', 'wpforms-lite' ),
'default' => esc_html__( 'Please enter a valid number.', 'wpforms-lite' ),
'validation-number-positive' => [
'id' => 'validation-number-positive',
'name' => esc_html__( 'Number Positive', 'wpforms-lite' ),
'default' => esc_html__( 'Please enter a valid positive number.', 'wpforms-lite' ),
'validation-minimum-price' => [
'id' => 'validation-minimum-price',