Double Opt-In for Contact Form 7 – Secure, GDPR-Compliant Email Verification

5.9.0

Withdrawals, every form plugin in the setup wizard, a confirmation page per outcome

• New: opt-ins withdrawn through the opt-out show as “Revoked” (filter in the list, detail page, its own dashboard card) instead of “Pending”; the original confirmation stays visible.
• New: the setup wizard offers the forms of every installed form plugin (WPForms, Elementor Pro, Gravity Forms and Avada with their add-ons), not only Contact Form 7, and finds the email field by its label.
• New: [doi_if status=”confirmed”]…[/doi_if] shows its content only for the given outcome of the confirmation link, so one page can greet, explain an expired link and offer the form again.
• New: the form settings warn when the stored consent text differs from the text next to the checkbox in the form (Contact Form 7), and take that text over in one click. Developers: FieldTextProviderInterface and the filter f12_doi_form_field_texts.
• Fix: an add-on installed or activated on the Add-ons page works without reloading the page.
• Fix: the audit log showed event types as internal keys and some messages in English; its rate-limit filter found nothing.
• Fix: the WordPress personal data export described the mail status as “sent” instead of in words.
• Fix: the opt-in list showed category numbers instead of names; the forms page said “1 forms”.
• Fix: the credit request, the deactivation survey and the feedback links were not translated; the French translation had no plural rules.

5.8.1

• Fix: on sites in formal German (Sie), a sentence on the user creation page was shown in English, and the role appeared as its internal key (“subscriber”) instead of its name.
• Fix: German admin texts used the English names “Conditional Templates”, “User Creation” and “Unique Email”; they now use the German terms throughout.
• Fix: the breadcrumb on add-on settings pages read “Page”.

5.8.0

Know whether the confirmation email went out

• New: every opt-in records whether its confirmation email was handed to your mail server or failed, and why. Shown in the opt-in list (with a filter), on the detail page and in Site Health; included in the WordPress privacy export and eraser.
• New: after a Contact Form 7 submission, visitors read “please confirm your address” with the sender and subject to look for, instead of “Thank you for your message”. When the email could not be sent, they are told so.
• New: Site Health checks SPF and DMARC of the sender domain, the two most common reasons confirmation emails land in spam.
• New: a dashboard hint when many recent opt-ins stay unconfirmed.
• New: shortcodes [doi_confirmation_status], [doi_error_message] and [doi_field] for the confirmation and error pages, and a readable message when a link is broken or expired.
• New: a hidden honeypot field and a minimum fill time keep simple bots away from Contact Form 7 double opt-in forms.
• New: the forms page suggests add-ons only for form plugins that are installed on the site.
• New: after ten confirmations, a one-time request for a review, only on the plugin’s own pages.
• Changed: the free plugin no longer contains locked Pro features. Email template management and the opt-out page generator now live in their add-ons. If you use them, update the email editor add-on to 1.1.0 and the opt-out add-on to 1.5.0; Site Health reminds you.
• Changed: a renewed consent after an opt-out no longer overwrites the original confirmation; it gets its own entry in the audit log.
• Fix: the Activate button on the Add-ons page and links in REST responses were broken (“&” in the URL).
• Fix: Avada forms without a notification were reported as a failed follow-up action.
• Fix: several admin texts stayed English on translated sites; the breadcrumb read “Page” on detail pages; a waiting button now shows a countdown.
• Developers: Core API 4.6.0 with the filters f12_doi_submit_notice_data and f12_doi_mail_headers, the events f12_doi_optin_opted_out and f12_doi_optin_reopted_in, follow-up adapters for add-ons and a shared resend service.

5.7.0

A setup wizard gets new sites to the first working confirmation email

• New: after installing the plugin, a short wizard sets up the sender, the Contact Form 7 forms that should ask for confirmation, the confirmation email and the page visitors see after clicking the link. Everything is prefilled; it takes about three minutes and can be skipped at any time. A test email to yourself shows the result before visitors see it.
• New: the sender name and address from the wizard are used for every form you switch on later. Confirmation emails without a sender name no longer arrive as “WordPress”.
• New: if you also use Elementor Pro, WPForms, Gravity Forms or Avada Forms, the wizard tells you which add-on protects those forms.
• Improved: forms that already use Double Opt-In are left exactly as they are. Existing sites do not see the wizard unless you start it under Settings.
• Fix: this description listed the visual email editor, saved templates and test emails as free features. They are part of the email editor add-on; the free plugin offers three built-in email designs. Resending a confirmation email from the opt-in details is free.

5.6.3

• Fix: the developer reference this readme points to — docs/hooks-and-events.md and docs/addon-api.md — was never actually included in the plugin. Both files now ship.
• Improved: the notice for major updates on the Plugins screen no longer starts with an emoji; it already sits in a warning box.

5.6.2

A refused consent no longer looks like a successful sign-up

• Fix: when a visitor left the consent checkbox unticked, Contact Form 7 still showed “Thank you for your message. It has been sent.” and emptied the form. The actual reason appeared only in a small notice that disappeared after ten seconds — so the visitor believed they were subscribed and waited for a confirmation mail that never came. The form now stops with “You must agree to the consent statement to continue.” and keeps everything the visitor typed; they only have to tick the box.
• Fix: the same on Elementor, WPForms and Gravity Forms forms — the consent checkbox is now marked the way a missed required field is, and the form stays on the page with the visitor’s input. This needs the Elementor add-on 1.2.1, the WPForms add-on 1.1.1 and the Gravity Forms add-on 1.1.1. With older add-ons the success message is at least hidden and the notice stays until the visitor closes it.
• Developer: new AbstractFormIntegration::refusedConsentBeforeSubmit() for integrations whose submit hook runs after the form plugin has accepted the submission (Core API 4.5.0, additive).
• Note: this applies to the consent checkbox only. Other refusals (rate limits, blocked domains, …) keep their current behaviour and can be shown in the form with the filter f12_cf7_doubleoptin_show_validation_error, which now also receives the error and the form ID.