Bodholdt Contact Docs

What Bodholdt Contact is

Bodholdt Contact is a free floating contact widget for WordPress. It asks for an email address, verifies unrecognized visitors with a one-time 6-digit code, and sends the message to you without exposing a public email address. It works by itself; with a compatible Bodholdt Tickets release, Contact attempts to route accepted submissions into trackable support tickets and retains the configured email route as a safe fallback.

Version 5.3.0 requires WordPress 6.4 or newer and PHP 8.0 or newer.

Quick start (about 3 minutes)

1. Install and activate the ZIP from Plugins → Add New Plugin → Upload Plugin. No license key is required.
2. Open Settings → Bodholdt Contact. Fresh installations intentionally keep the public widget hidden until you review the destination email and recognition policy.
3. Confirm Send messages to, choose who (if anyone) may skip the email code, and customize the appearance or wording if desired.
4. Turn on Show the widget, then click Save settings.
5. Open your site in a signed-out/private browser window, send a test message, and confirm that your WordPress mail service delivers both the code and the message.

The Settings page

Everything is on one screen at Settings → Bodholdt Contact. A status card summarizes whether the widget is live, where messages go, how recognition works, and whether Bodholdt Tickets is handling delivery. The live preview lets you step through the Email, Verify, and Message screens before publishing.

• Show the widget publishes or hides the footer launcher. It is off on a fresh installation.
• Brand name appears in the widget and its email messages. It defaults to your site name.
• Accent color, Appearance (Light, Dark, or Auto), and Corner style control the card. Readable foreground and hover colors are derived automatically.
• Header text, Intro line, and Success message control visitor-facing copy. Leaving one blank uses its documented default.
• Send messages to is the notification address. It defaults to the site administrator email.
• Recognize returning customers via controls whether a proven signed-in account may skip the code. The security rules are explained below.
• Weekly activity email sends a seven-day funnel summary only after a week with activity. It is off on fresh installations; existing 4.7 upgrades preserve their previous report behavior.
• Working the Door controls the private Fun Pass report, admin-only celebration sounds, and confetti. The Fun Pass report, confetti, and sound all default to off. Turn on the ones you want from Working the Door.

Current interface

Recognition and email verification

A known email address by itself is never enough to skip verification. The visitor must be signed in to an account whose email exactly matches the address entered. A logged-out customer, a signed-in user entering another address, and every anonymous visitor receive the one-time code.

The recognition setting has three choices:

• No one (everyone verifies by email code). Every visitor completes the one-time code step.
• Logged-in WordPress users. A signed-in WordPress user may skip the code only when the entered email exactly matches that user account.
• Signed-in Licensing customers with a matching email. The exact signed-in email match is still required, and Bodholdt Licensing must also report an active, unexpired entitlement for that email. The option is unavailable when a compatible Bodholdt Licensing installation is not present.

Entitlement and signed-in identity are checked again when the message is submitted. This prevents an anonymous visitor from impersonating a customer or using the form to discover whether an email has a license.

What visitors experience

1. The visitor opens the launcher and enters an email address.
2. A recognized signed-in account goes directly to the message form. Everyone else receives an expiring 6-digit code by email.
3. After the correct code, the visitor writes and sends the message. A completed verification cannot be reused to send another message.
4. The success message appears. “Send another message” starts a clean new flow.

Resending a code has a short cooldown and invalidates the previous code. Repeated incorrect attempts, excessive sends, and malformed requests are limited automatically.

Spam and abuse protection

Protection is built in; there is no CAPTCHA service to configure.

• Email ownership proof uses short-lived, one-time codes for unrecognized visitors.
• A hidden honeypot rejects common automated submissions.
• Database-backed rate limits bound attempts by source address, destination email, and site-wide mail volume.
• Session-bound, one-time delivery state prevents a verified request from being replayed or delivered twice.

If the site is behind a reverse proxy, configure the origin so the real client address reaches REMOTE_ADDR. Bodholdt Contact deliberately ignores spoofable forwarded-address headers.

Message delivery and Bodholdt Tickets

Without Bodholdt Tickets, each accepted submission is emailed to Send messages to, with the visitor address set as Reply-To.

With a compatible Bodholdt Tickets release active, Contact attempts to create a ticket and store the visitor’s first message before reporting success. It also sends the configured notification address a courtesy heads-up. If the compatible API is unavailable or ticket creation cleanly fails, Contact uses its configured email route. If a partial ticket write cannot be safely resolved, Contact prevents an automatic retry from creating a duplicate ticket or email.

Activity reports and Working the Door

The settings page can show a seven-day funnel: widget opens, emails entered, codes sent, verified completions, recognized-account messages, and the overall completion rate. The optional weekly email sends the same kind of summary to the notification address after a week with activity.

Working the Door is a private, operator-only Fun Pass. Its Door Report turns recognized accounts, verified visitors, blocked bots, and received messages into locally stored XP, levels, and trophies. It never appears to visitors, and its data stays in your WordPress database. You can disable Fun Pass, sound, or confetti independently.

Deactivation, uninstall, and multisite

Deactivation removes scheduled Contact tasks and short-lived verification/rate-limit rows, while preserving configuration for a later reactivation. Normal WordPress uninstall removes Contact settings, owned tables, scheduled tasks, legacy verification remnants, and only Contact’s rows from shared Bodholdt Arcade data.

On multisite, network activation provisions current sites and sites created later. Existing sites update their Contact storage safely on their first request instead of forcing one unbounded network-wide migration during an admin page load.

Troubleshooting

The contact button is missing

Open Settings → Bodholdt Contact and confirm Show the widget is enabled. Then clear any page cache. The active theme must also call WordPress’s standard wp_footer() hook.

Codes or messages do not arrive

Confirm the notification address and test your site’s WordPress mail transport. Bodholdt Contact uses wp_mail(); on many hosts, reliable delivery requires an SMTP or transactional-mail plugin/service.

A known customer still receives a code

That is expected unless the visitor is signed in and the entered email exactly matches the signed-in account. In Licensing mode, the matching entitlement must also be active and unexpired.

Getting help

Bodholdt Contact 5.3.0 is free and GPL-licensed, with no license key, paid tier, or time-limited trial. For help, open a ticket on the Support page. Browse all guides at the documentation home.