Changelog

6.0.0 (unreleased)

• Added: Cloudflare Turnstile as captcha option, see Control Panel
• Added: Minimum score setting for the invisible (score based) reCAPTCHA modes (Breaking change): submissions with a score below 0.5 are now rejected by default
• Added: the submitted fields are saved with the submission, shown in the CP and exported with a column per field
• Added: filter the submissions and the CSV export by form, date and keyword
• Added: Privacy settings to delete submissions after X days and to anonymize IP addresses
• Added: Rate limit and Minimum submit time settings as spam protection without a captcha
• Added: CSRF protection setting to check the csrf_token of the submitted forms
• Added: spam log in the CP with the submissions that the spam protection blocked, see Control Panel
• Added: filters (severity, date, keyword), bulk delete and a CSV export on the log page in the CP, see Control Panel
• Added: validation rules per field with rules:field_name="required|email", see Form tag
• Added: route the email to a recipient by a submitted value with to:field and to:map:value, see Email template
• Added: JSON response for ajax submissions, see Form tag
• Added: queue="yes" to send the email via the Email Queue add-on (with attachments, reply-to and alt message from Email Queue v1.3.0)
• Updated: required_fields also fails for a field that is not posted at all, such as an unchecked checkbox (Breaking change)
• Updated: the Submissions page is the default page of the add-on in the CP (the Settings page when Save submission is disabled)
• Updated: the invisible reCAPTCHA modes fetch the token on submit instead of on page load, so visitors that take longer than 2 minutes are no longer rejected
• Updated: the submitted values ({field_name:value}) are kept after every error (captcha, reCAPTCHA, honeypot, upload), not only after a validation error
• Updated: the success and error messages are translatable
• Updated: the captcha response fields (e.g. g-recaptcha-response) are no longer available as variables in the {email_template}
• Updated: the installer now uses the ExpressionEngine 7 add-on installer and migrations
• Updated: the control panel pages use the ExpressionEngine 7 control panel routes
• Updated: the form posts to its own send_mail action instead of the generic act_route action. Clear your page cache (e.g. static page caching or a CDN) after updating, cached forms still post to the removed action
• Updated: removed the unused {reinos_email_form_action_url} global variable and the control panel CSS and JavaScript hooks behind it
• Updated: removed the unused {exp:reinos_email_form:test_tag} tag
• Updated: removed the automatic migration from the old (EE2) Email Form module
• Updated: requires ExpressionEngine 7+, for ExpressionEngine 6 use the legacy package (legacy/ee_email_form-v5.6.0.zip) (Breaking change)
• Security: submitted values are HTML-escaped in mailtype="html" emails, and the CP shows the email content in a sandboxed frame, so submitted HTML or scripts are never rendered
• Bugfix: where Delete all logs also deleted the logs of the other sites
• Security: values in the CSV export of the submissions that start with =, +, - or @ are prefixed with a quote, so a spreadsheet does not run them as a formula
• Security: the form is not rendered without an encryption_key in the config, see Encryption key (Breaking change). The add-on no longer falls back to a known key, which allowed forged form data
• Security: submitted values are no longer parsed as ExpressionEngine tags in the {email_template} or the form; { and } are shown as-is
• Security: {field_name:value} is HTML-escaped
• Security: line breaks are stripped from the subject and names in the email headers
• Security: reCAPTCHA (Cloud) accepted the submission when the API call failed or the action did not match, it now rejects it
• Security: the legacy reCAPTCHA is verified with a POST request with a timeout, the secret key is no longer sent in the URL
• Bugfix: where allow_duplicate_email_address="no" only blocked the email from the second duplicate on
• Bugfix: where a submission that no longer exists gave an error in the CP, it now goes back to the submissions with a message
• Bugfix: where concurrent submissions could delete each other's attachments; every submission now gets its own upload dir
• Bugfix: where an upload error redirected to the current url instead of the error_return_url
• Bugfix: where the CSV export failed when there were no submissions
• Bugfix: where some reCAPTCHA error messages showed the raw language key

5.6.0 (02-09-2026)

• Updated: remove custom license check and rely on the built-in license verification of ExpressionEngine

5.5.0 (16-04-2024)

• Updated: reCAPTCHA packages - This fix a lot of protobuf issues.

5.4.0 (19-10-2025)

• Added: re-introduce the legacy V2 and V3 reCAPTCHA
• Bugfix: where the upload could failed

5.3.2 (08-08-2025)

• Bugfix: where reCAPTCHA throws an error

5.3.1 (04-08-2025)

• Bugfix: Check for the existence of service_account.json if reCAPTCHA is enabled
• Update: Updated translations to reflect the reCAPTCHA terminology

5.3.0 (06-11-2025)

• Added: Honeypot
• Updated: Recaptcha uses now the new version, read the blog here

5.2.0 (18-04-2025)

• Added: {email_template allow_duplicate_email_address="yes"} param to allow or disallow duplicate form submissions.

5.1.7 (25-03-2025)

• Bugfix: where the per_page was not working in the submission overview

5.1.5 (05-03-2025)

• Bugfix: remove console.log in the recaptcha code

5.1.4 (06-01-2025)

• Updated: icon
• Added: {email_template send_email="no"} to control if you actual send an email or just save the submission only
• Added: default_from CP setting to set a default from email address in case we could fill this when omitted in the form tag
• Bugfix: where the export was throwing an error

5.1.3 (14-11-2024)

• Added: German language pack (thanks @Werner)
• Added: legacy file for EE3,4,5

5.1.2 (11-10-2024)

• Bugfix: where {email_template} could not be parsed and as a result no email was send

5.1.1 (05-09-2024)

• Remove the debug info as variable
• Updated: better support for the {success} and {error} messages
• Bugfix: when having multiple forms on a page, only the first catch the errors

5.1.0 (02-10-2023)

• Updated: PHP 8.2 support

5.0.0 (24-05-2023)

• Updated: scoped the composer vendor folder to avoid race conditions with other modules
• Bugfix: allowed_types is not merged with the default types
• Bugfix: PHP 8.1 issues

4.7.0 (03-11-2022)

• Updated: min EE version 6.x (or higher)
• Added: bulk deletion for submissions

4.6.0 (18-10-2022)

• Added: the form label when using the saved forms

4.5.3 (09-05-2022)

• Bugfix: issue with the success message where it cannot be fetched

4.5.2 (25-05-2021)

• Bugfix: respect save submission setting

4.5.1 (18-05-2021)

• Bugfix: clear attachments from previous session

4.5.0 (17-02-2021)

• Added: export submissions

4.4.1 (29-12-2020)

• Bugfix: where the license warning was not showed correctly in EE6

4.4.0 (02-12-2020)

• Added: EE6 support

4.3.0 (24-09-2020)

• Added: subject to the submissions log
• Added: direct="yes" for sending directly one email.
• Added: lang="" for the {exp:reinos_email_form:init_recaptcha} tag

4.2.0 (20-08-2020)

• Added: respect_br="yes" to respect line breaks in mailtype="html" mode

4.1.1 (10-08-2020)

• Bugfix: where a custom attribute throws an error

4.1.0 (09-06-2020)

• Added: form_label to identify a submission
• Update: EE3 compatibility

4.0.2 (17-05-2020)

• Added: support for pair values inside templates {<your_field_name>_pair}

4.0.1 (29-07-2019)

• Bugfix: where in some case the update was throwing an error

4.0.0 (27-06-2019)

• Refactor: License settings due the release of the EE store (*Breaking changes)
• Refactor: Rename the module with a prefix of reinos_ due the release of the EE store *(*Breaking changes)

*Note: There is a change you will have to validate the license again

**Note: Because the module has been renamed with a prefix reinos_ there is an update path by simply add the new update to your site and install it. By installing the module, you are disabling the old module that can be deleted afterward. Also note that you have to rename the module calls and hooks with a prefix reinos_

See this article about the rename https://addons.reinos.nl/news/modules-renamed

3.3.0 (11-04-2019)

• Added: Captcha and ReCaptcha support
• Added: form_attr:your-attr="" param for adding custom attributes to the form element

3.2.0 (19-12-2018)

• Added: EE5 support
• Stopped: EE3 feature development. Only bugfixes are done into the EE3 branch.

3.1.1 (08-06-2018)

• Added: license support for MSM

3.1.0 (25-04-2018)

• Added: new license field (*Breaking changes) [EE3, EE4]
• Bugfix: where a form cannot be opened with session_id enabled [EE3, EE4]
• Bugfix: PHP 7.2 issue [EE3, EE4]

***Note: you need to add your license key and license email from addons.reinos.nl in order to validate your license and add a valid domain url in your license field on addons.reinos.nl/profile/licenses or the module will not work on a live site. Also make sure you have read the license section in the documentation **

3.0.0 (04-12-2017)

• Refactor: Module updater
• Added: EE4 support

2.0.4 (01-11-2017)

• Update: EE4 compatible

2.0.3 (01-05-2017)

• Updated: update script (again 😉)

2.0.1 (21-06-2016)

• Updated: update script

2.0.0 (20-06-2016)

• Added: support for EE3

1.8.1

• Bugfix : where there is an PHP error
• Bugfix: in the upload proces

1.8

• Added: the hooks return something now
• Added: options to remove the attachments or not
• Added: email_form_allowed_types param
• Added: email_form_attachment hook to assign extra files via an extension
• Added: name="" to the email_template tags to set the name of an email template for use in extensions
• Moved: upload dir to the cache dir
• Bugfix: where the CP navigation was not working

1.7

• Added: save form in the backend
• Added: new tag

1.6.1

• Bugfix: where the update process goes wrong

1.6

• Added: submission table, save all submission
• Bugfix: when the error_return_url whas empty, the redirect was directing to "/"

1.5.4

• Added : error_return_url="" param

1.5.3

• Added : current_url param to overide the current page
• Bugfix : minor
• Updated : EE 2.9 support

1.5.2

• Bugfix : where the return_url was working instead of the current url on an error
• Removed : secure_forms_check function call to be comaptible with EE 2.8

1.5.1

• Bugfix: where the variables where not correctly parsed on the frontend

1.5

• Added : Enable checkbox compatibility
• Added : parse any other module in the message
• Bugfix : Where to and from where switched
• Bugfix: Where the return url whas not working correctly

1.4.1

• Added : license field
• Bugfix : MSM issue
• Bugfix : install/update issues

1.4

• Added : use of dynamic variables in the params e.g. {email_template to:email="{email_address}"}
• Added : use of attachments
• Added : secure="" param for disable the secure form function
• Added : {validation_errors} variable to show all errors
• Bugfix : small issues

1.3

• updated : the {email_template} to use the email config (e.g. to, cc, bcc etc.)

1.2.1

• Updated : hook return values

1.2

• Updated : better encrypting
• Added : 2 new hooks for the form self

1.1

• Added : encrypted data

1.0

• Init release