Addons by Reinos

Appearance

Control Panel ​

Settings ​

Here you can save the common settings.

Settings

Logging ​

Choose what is written to the log: only errors, everything (also notices like a triggered honeypot or a failed captcha) or nothing. Defaults to only errors. The log can be found on the Logging page of the add-on, see Logs.

Save submissions ​

Save the submissions in the database. Enabled by default. When disabled, the Submissions page is hidden and the add-on opens on the Settings page.

Delete attachments after sending ​

Delete the uploaded attachments of a submission after the email has been sent. Enabled by default. If disabled, the files are kept on the server. The attachments are never saved in the submission in the database.

Attachments dir ​

Set the dir where we save the attachments. Normally the default (the reinos_email_form folder in the cache dir of ExpressionEngine) is fine. Every submission gets its own sub dir, so concurrent submissions never touch each other's files.

Default From ​

The Default From, when no from is set setting: the From email when no from:email is set in the {email_template} and the visitor is not logged in. Defaults to no-reply@ plus the server name.

Rate limit ​

Available from v6.0.0

The max number of submissions per IP address per hour, counted from the first submission. Only submissions that passed the other checks are counted. 0 (the default) disables the limit.

Minimum submit time ​

Available from v6.0.0

The Minimum submit time (seconds) setting: reject forms that are submitted faster than this number of seconds after the page was loaded; a bot fills in a form much faster than a human. 3 is a good value, 0 disables the check. When the page is served from a full page cache, the check is less strict, because the render time is older.

Spam log ​

Available from v6.0.0

Store the submissions that the spam protection blocked in the Spam log. Enabled by default.

CSRF protection ​

Available from v6.0.0

Only accept forms with a valid csrf_token, so another site cannot submit your form on behalf of a visitor. The form tag adds the token automatically. Disabled by default: do not enable it when the pages with a form are served from a full page cache (e.g. a static cache or Varnish), because the cached token is invalid for other visitors. The template caching of ExpressionEngine is fine.

Honeypot ​

Honeypot field to prevent spam bots from submitting the form. This field is hidden from users but visible to bots. If filled out, the submission will be dropped. Disabled by default.

Privacy ​

Available from v6.0.0

Privacy

  • Delete submissions after (days): submissions older than this number of days are deleted automatically, when a new submission is saved or the Submissions page is opened. 0 keeps them forever.
  • Anonymize IP addresses: store the IP address without the last part (e.g. 192.168.1.0), in the submission, the spam log, the log messages and the {ip} variable. For an IPv6 address only the first 48 bits are kept.

Captcha ​

Choose the captcha that protects your forms with the Enabled setting:

Whatever you choose, add {exp:reinos_email_form:init_recaptcha} to the head of your page and {if recaptcha}{recaptcha}{/if} inside your form, see the form tag.

Google reCAPTCHA ​

The Challenge mode shows the "I'm not a robot" checkbox, the Invisible mode scores every submission in the background.

Create a new reCAPTCHA ​

To create a new reCAPTCHA, you need a Google account and access to Google Cloud.
Once logged in, go to the reCAPTCHA Cloud page and create a new key.

recaptcha-create-key

Next, proceed to the "Next step (optional)" section, where you can define whether the reCAPTCHA should be invisible or visible as a challenge.

If you want an Invisible or Challenge reCAPTCHA, you can configure this by setting the value for "Will you use challenges?" accordingly.

recaptcha-create-additional

Once everything is filled out, click Create Key.

Create a service account ​

To authenticate with Google, the new reCAPTCHA uses the default authentication method via a service_account.json file. You can create and download one by following these steps:

  • Navigate to console.cloud.google.com/iam-admin/serviceaccounts and select your project.
  • Click the Create service account button.
  • Fill in the details and ensure the account has sufficient permissions.
  • After creating the account, go to its details page.
  • Navigate to the Keys tab.
  • Click Add key, choose Create key, select JSON as the key type, and click Create.
  • A JSON file will be downloaded automatically. This file is needed for the authentication. Rename the file to service_account.json and store it on a save place on you server.
  • Update the Your Google Cloud Service Account Path setting to reflect the location where you put your service_account.json

Update the Email Form reCAPTCHA settings ​

Once you have your service account and the service_account.json file, go to your ExpressionEngine Email Form control panel.

Fill in the Site-ID (the reCAPTCHA key), the Project (the Google Cloud project ID) and the path to the service_account.json. Make sure to select the same reCAPTCHA type (Invisible or Challenge) that you chose earlier when creating the reCAPTCHA key.

Also, ensure the service_account.json file is uploaded securely—ideally outside the web root—and update the file path accordingly. Do not keep it in the add-on folder (the default path), the update instructions replace that folder.

recaptcha-cp

More info about ReCaptcha can be found in the blog here

Minimum score ​

Available from v6.0.0

Only for the invisible (score based) modes: Invisible and V3 Legacy (Invisible). reCAPTCHA gives every submission a score between 0.0 (very likely a bot) and 1.0 (very likely a human). Submissions with a lower score than this setting are rejected. Default is 0.5. The setting is only shown for those modes.

The token of the invisible modes is requested when the visitor submits the form, so it cannot expire while the visitor is filling in the form.

Google reCAPTCHA (legacy) ​

Beside the newly Cloud reCAPTCHA, we still have support for the old V2 and V3 reCAPTCHA. Simply select the V3 Legacy (Invisible) or V2 Legacy (Challenge) and enter your site key and secret.

Create legacy keys ​

Navigate to https://www.google.com/recaptcha/admin and click on the plus sign. Enter all the detail for your site and copy over the keys.

recaptcha-cp-legacy

Cloudflare Turnstile ​

Available from v6.0.0

Cloudflare Turnstile is a privacy friendly alternative for reCAPTCHA, and does not need a Google Cloud service account.

  • Log in to the Cloudflare dashboard and go to Turnstile.
  • Click Add widget, enter a name and the domain(s) of your site and choose the widget mode.
  • Copy the Site Key and Secret Key into the Turnstile site key and Turnstile secret key settings and select Cloudflare Turnstile.

The token is verified server side, including the widget action (email_form).

Submissions ​

Submissions are saved by default (see the Save submissions setting). The page shows the submissions of the current site. Here you can view and delete them (select them with the checkboxes to delete them at once), and export the filtered submissions to a CSV file (separated by ;) with Export submissions.

Submissions

From v6.0.0 the submitted fields are saved as well: the detail page lists them and the export has a column per field. Use the filters to show (and export) the submissions of one form, a period (e.g. the last 30 days or a custom date) or a keyword; the keyword search looks in the subject, the from name, the from and to email address, the content, the fields and the member (username or screen name). You can also choose how many submissions are shown per page.

From v6.0.0 this is the page you see when you open the add-on. When Save submissions is disabled, the Settings page is shown instead.

Submission detail ​

Click a submission to open it. The subject is shown at the top with the send date, followed by a block with the form, the from name and email address, the To, CC and BCC addresses, the member that sent the form (a link to the member) and the IP address. Only the values that are set are shown.

Below that you find the submitted fields (from v6.0.0) and the content of the email as it was sent. The content is shown in a safe frame (scripts in the content are not run), which you can make taller by dragging its bottom right corner. When the submission has debug information, it is shown under Debug; click it to unfold it.

Submission detail

Spam log ​

Available from v6.0.0

The submissions that were blocked by the honeypot, the EE captcha, reCAPTCHA or Turnstile, the Rate limit, the Minimum submit time or the CSRF protection, with the reason, the detail (e.g. the reCAPTCHA score), the IP address, the user agent and the submitted fields. Use it to check for false positives, e.g. when the Minimum score is too strict. The overview shows the date, form, reason, IP address and detail; open an entry for the user agent and the submitted fields.

Spam log

Filter on the reason and the date, and choose how many entries are shown per page. Delete entries one by one, select them to delete them at once, or use Delete all spam to delete all entries of the current site. The entries are deleted automatically after 30 days.

This page is only shown when the Spam log setting is enabled.

Spam log detail ​

Click an entry to open it. The reason is shown at the top with the date, followed by a block with the form, the reason, the IP address and the user agent. Below that the detail (e.g. the score 0.3 is lower than the minimum score 0.5) and the submitted fields.

Spam log detail

Logs ​

The Logging page shows the log messages of the add-on, e.g. failed emails, a triggered honeypot or a rejected captcha. What is logged depends on the Logging setting.

Filters, bulk delete and export ​

Available from v6.0.0

Filter the logs on the severity (error or notice), a period (e.g. the last 30 days or a custom date) or a keyword in the message, and choose how many logs are shown per page. The filters are kept when you sort or go to another page.

Delete logs one by one, select them with the checkboxes to delete them at once, or use Delete all logs to delete all logs of the current site. Export logs downloads the filtered logs as a CSV file (separated by ;).

Forms ​

Forms added directly in your code can also be saved and managed in the control panel. This feature simplifies the process of editing forms once your site is live.

For example, when your code is version-controlled in Git, deploying minor changes to a form template can become unnecessarily complex. By saving your forms in the control panel, you can make quick edits directly from the interface without touching the codebase.

To display a saved form in your templates, you can use the following tag: {exp:reinos_email_form:get_form name='your_form_name'}

This approach offers both flexibility during development and convenience for ongoing maintenance.

Click Create Form to add a form: the label, the name you use in the get_form tag and the form itself. A form belongs to the site it was created on, get_form only finds the forms of the current site. When updating to v6.0.0, the existing forms are assigned to the first site.

Create a form