Smart Form: delivery and spam protection

Submissions can go to several places at once. Everything except email is optional and only runs when you configure it.

Email

• Email delivery is on by default. Set Send email to; if you leave it empty, WordPress’s admin email is used.
• Set the Email subject. You can use tokens such as the visitor’s name.
• Branded HTML email sends a clean responsive email instead of plain text.
• Email uses your site’s own wp_mail. Rawnaq has no mail server of its own. Use Send a test email in the dashboard to check it works.

Confirmation email to the visitor

Turn on Send confirmation email and set the subject, the message and the sender name. You can use {name}, {first_name}, {last_name}, {email} and {site_title}.

Webhook

Turn on Webhook / Slack notify and enter an HTTPS URL, for example a Slack incoming webhook. Rawnaq posts the submission as JSON. You can set a secret, and requests carry an X-Rawnaq-Signature header so your server can verify them. Private network addresses are blocked. Use the test button in the dashboard.

Mailchimp and HubSpot

• Mailchimp: add your own API key in the dashboard, set the Audience ID and choose Pending (double opt-in) or Subscribed. A visitor must give explicit opt-in consent.
• HubSpot: set the portal ID and the form GUID.

Spam protection

• Signed timestamp tokens that stop replayed or bulk posts, valid for 7 days. Cached pages refresh the token on their own.
• Rate limits: 5 submissions per 10 minutes per form and 30 per hour for the whole site, per visitor. Over the limit returns HTTP 429.
• A guard against double clicks: a repeated submission within 60 seconds is ignored.
• Optional Google reCAPTCHA v3: add your site and secret keys in the dashboard, then switch it on for the form.