Email Form 6.0 is out. It's a major release with three goals: keep spam out, make your submissions more useful, and give you more control over privacy. Under the hood, the add-on now runs on ExpressionEngine 7's add-on installer and control panel routes, and it got a full security review.
Stronger spam protection
Email Form already supported the EE Captcha, Google reCAPTCHA and a honeypot. 6.0 adds more layers, and most of them don't bother your visitors at all:
- Cloudflare Turnstile, a privacy-friendly captcha that most visitors never notice.
- Minimum score for the invisible reCAPTCHA modes, so you decide how strict it is.
- Rate limit and minimum submit time, which stop bots without any captcha.
- CSRF protection for submitted forms.
To see what gets stopped, the new spam log lists every submission the spam protection blocked, along with the reason.
Submissions that are actually useful
Every submitted field is now saved with the submission. You see the fields in the control panel, and the CSV export gets a column per field. You can filter the submissions and the export by form, date and keyword. The Submissions page is now the first page you land on in the add-on.
Privacy built in
The new privacy settings delete submissions automatically after a set number of days, and they can anonymize IP addresses. Your form data stays as long as you need it, and no longer.
More power in your templates
A few new template features make complex forms easier to build:
Validation rules per field, using ExpressionEngine's built-in rules:
rules:email="required|email"
rules:email_confirm="matches[email]"Route the email by a submitted value. For example, send it to a different department without exposing email addresses in your form:
{email_template
to:field="department"
to:map:sales="sales@example.com"
to:map:support="support@example.com"
}Ajax submissions now return a JSON response. Also, queue="yes" hands the email to the Email Queue add-on.
Before you upgrade
6.0 has a few breaking changes. Check them before you update:
- It requires ExpressionEngine 7.3+ and PHP 8.2+. For ExpressionEngine 6, use the legacy package that comes with the download.
- An encryption_key must be set in your config, or the form isn't rendered. See Encryption key.
- The invisible reCAPTCHA now rejects scores below 0.5 by default.
- required_fields now also fails for fields that aren't posted at all, such as an unchecked checkbox.
- Using MSM? Forms are now tied to a site. Recreate a form on any other site where you use it.
- Clear your page cache (static cache or CDN) after updating. Forms in an old cache still post to an action that no longer exists.
And much more
This release also includes many security hardening fixes and bugfixes. You'll find the full list in the changelog.