FormArmor

FormArmor connects existing WordPress contact forms to the FormArmor service for AI-assisted classification of inquiry text and enforcement of your inquiry acceptance policy.

It is not a form builder and does not replace your existing form’s normal notification configuration. Install one supported form plugin, create a normal inquiry form, and choose the specific text fields to protect. Not all four form plugins are required.

Supported adapters:

• Contact Form 7: ordinary contact forms.
• WPForms Lite: ordinary free-version forms. WPForms paid-only features are not supported.
• Fluent Forms free: ordinary forms; tested with 6.2.17. Pro-only features, conversational forms, partial submissions and payment forms are not supported.
• Forminator free: ordinary contact forms; tested with 1.58.4. Payment, registration, login, post creation, quizzes, polls, grouped/repeating fields, save-and-continue and abandonment features are not supported. Pro-only features are not verified.

This candidate declares WordPress 7.1 as its minimum and tested series, based on the existing WordPress 7.1.2 test environment. Earlier WordPress versions have not been verified for this directory candidate. PHP 8.2 or later and an HTTPS website with outbound HTTPS access are required.

FormArmor is an external service. A FormArmor account, a registered site, and site-specific connection credentials are required. Google sign-in is used on the FormArmor website, not inside this plugin. You do not need a separate TypeSafe AI API key.

Free and paid service plans

• Free: one account / one site, up to 150 decisions per calendar month, no credit card required, and no automatic conversion to a paid plan.
• Plus: JPY 300 per month including tax, up to 1,000 decisions per calendar month.
• Pro: JPY 600 per month including tax, up to 3,000 decisions per calendar month.
• Paid service plans offer the same eligible inquiry-text retention and restoration-notification features; the decision quotas differ. Purchase is optional and explicit on the FormArmor website.
• Quota periods reset on the first day of each calendar month in Japan time. Unused decisions do not roll over. No excess-usage charges are applied.

These are external service plans, not payment to unlock hidden local plugin code. Current terms and prices are available at https://jevguard.jp/terms .

Classification and failure behavior

AI can make mistakes. Sales inquiries may be allowed and legitimate inquiries may be rejected. FormArmor does not guarantee detection, message delivery or compatibility with every form configuration.

When FormArmor cannot obtain a usable decision because of an API or infrastructure failure or quota exhaustion, its adapter normally continues the existing form flow. Other installed spam protections and form validation can still reject a submission. The plugin does not bypass those protections.

For Fluent Forms and Forminator, a FormArmor rejection or review decision stops the ordinary entry-storage, notification and subsequent processing path. Restoration sends the retained text to a locally configured administrator email address; it does not recreate the original form entry, replay integrations or send the original submitter’s automatic reply.

External services

FormArmor API

Service website: https://jevguard.jp/
Default API origin: https://api.jevguard.jp
Management console: https://app.jevguard.jp/console
Terms of use: https://jevguard.jp/terms
Privacy policy: https://jevguard.jp/privacy

The plugin uses WordPress HTTP functions to send signed HTTPS POST requests to the following endpoints:

• /v1/connection – when an administrator explicitly clicks the connection/save button. Sends the site’s origin URL, site identifier, enabled form identifiers and the inquiry-policy text entered for those forms, plus a request identifier. This sync also communicates the removal of protected forms when protection is stopped.
• /v1/decisions – when a protected form is submitted with at least one selected field. Sends the site identifier, form identifier, request identifier, protocol information and the selected field names and their text values. The service applies the configured inquiry policy to classification.
• /v1/receipts – after the adapter confirms that an eligible retained submission was suppressed, or during a retry. Sends request identifiers and the site identifier, not the original inquiry text.
• /v1/releases/pull – while protection is enabled, through a WP-Cron task scheduled at a five-minute interval. Sends site/request identifiers to check for administrator-requested restoration notifications. A response can contain retained text for local email delivery. Actual execution depends on WordPress Cron and site traffic.
• /v1/releases/ack – after a restoration notification attempt. Sends site/request/release/lease identifiers and the send outcome. It does not send the recipient’s email address or inquiry text in the acknowledgement payload.

Requests include the connection key identifier, timestamp and HMAC signature. The shared signing secret is stored in the site’s WordPress options and is used locally to sign requests; it is not sent as a request payload. The restoration recipient configured in WordPress is kept locally and is not included in the API request payloads above.

The plugin’s application payloads do not intentionally include the visitor’s IP address, browser user agent, uploaded files, passwords or payment fields. If you select a name or email text field, or a visitor includes personal information in a selected field, that information is sent as part of the selected text. Infrastructure providers can process connection metadata as described in their policies. Do not interpret this as a promise that no personal data is transmitted.

Installing or activating a fresh, unconfigured copy does not contact FormArmor. Connection/save is an administrator-initiated action. Inquiry processing and scheduled service communication start after the site has been connected and protection enabled. A configured site’s saved settings remain available after deactivation; reactivation can resume previously enabled protection. A developer can explicitly opt into adapter registration through the FORMGUARD_ENABLE_ADAPTERS constant; this is not a public settings control.

TypeSafe AI / Jev classification service

FormArmor forwards selected inquiry text and the configured acceptance policy to TypeSafe AI, Inc.’s Jev classification API. The WordPress plugin contacts FormArmor; it does not call TypeSafe AI directly.

Provider website: https://typesafe.ai/
Current provider API host used by FormArmor: api.typesafe.ai
Provider website terms of use: https://typesafe.ai/legal/terms
Provider privacy policy: https://typesafe.ai/legal/privacy-policy

The linked provider terms describe its website and refer to separate agreements for its products/services where applicable. The provider describes storage and processing in the United States. Do not submit confidential information or select unnecessary personal data. The provider’s public privacy policy does not specify a fixed API-input retention period; FormArmor does not promise zero retention at the AI provider. Refer to FormArmor’s privacy policy for the service’s current external-processing explanation.

Retention and local data

FormArmor’s service does not store ordinary inquiry text in its database. Free does not retain rejected inquiry text. On Plus or Pro, sales/uncertain inquiries can be retained or discarded according to the site’s selection. Eligible retained text is encrypted, initially retained for seven days, configurable up to 30 days, and limited to 100 items / 5 MB. Spam/scam-classified text, discarded text, expired text and deleted text cannot be restored.

The plugin stores connection configuration, selected form/field mappings, local status, suppression-confirmation retry identifiers and restoration-delivery outcomes in WordPress options. Its own retry/outcome records do not persist inquiry text. Your form plugin, mail system, backups and other integrations can store information independently. Restored text is sent through wp_mail to the administrator recipient configured locally, so it can remain in that mailbox according to your own retention policy.

Stopping protection or deactivating this plugin stops subsequent inquiry classification by this plugin. It does not delete your FormArmor account, remove previously sent data from external services, delete stored settings, or cancel a paid subscription. Manage a paid subscription in the FormArmor console and request account/site deletion through the contact information in the privacy policy.

Administrator setup and submitter notice

Review the service terms and privacy information before connecting. Select only the inquiry-text fields you actually need. The plugin does not automatically insert a submitter notice or consent checkbox into your existing forms. Site administrators must provide the appropriate explanation and obtain any necessary permissions for their use of the service.