Bodholdt Contact
A contact widget that knows your customers
Free and open source
Freeforever
No license key, paid tiers, or locked features. Download the ZIP, then install it from your WordPress admin.
Download free →Pairs with a compatible Bodholdt Tickets release to route accepted submissions into trackable support tickets your customers can follow.
See It In Action
Real screens from Bodholdt Contact
These are real admin screens, not mockups. Click any one to view it full size.
A small floating contact widget for WordPress. A signed-in WordPress account can skip the email code only when its email exactly matches; Licensing recognition also requires an active entitlement. Everyone else verifies by email to help reduce automated spam. It emails accepted messages on its own; with a compatible Bodholdt Tickets release, it attempts ticket delivery first and retains the configured email route as a safe fallback.
Floating contact widget for any theme
Exact-email signed-in account recognition, with active-entitlement checks in Licensing mode
Spam-resistant email code, honeypot, and database-backed rate limiting
Optional weekly activity summary after weeks with contact traffic
Themeable brand, accent, and copy, with a live preview
Creates trackable tickets with a compatible Bodholdt Tickets release
Working the Door turns contact activity while you are away into a private Door Report
Translation-ready visitor widget with configurable brand and copy
Free and GPL, with no license key, paid tiers, or locked features
- Floating contact widget for any theme
- Exact-email signed-in account recognition, with active-entitlement checks in Licensing mode
- Spam-resistant email code, honeypot, and database-backed rate limiting
- Optional weekly activity summary after weeks with contact traffic
- Themeable brand, accent, and copy, with a live preview
- Creates trackable tickets with a compatible Bodholdt Tickets release
- Working the Door turns contact activity while you are away into a private Door Report
- Translation-ready visitor widget with configurable brand and copy
- Free and GPL, with no license key, paid tiers, or locked features
Version
5.1.0
PHP Required
8.0+
WordPress
6.5+
License
GPL, no key
v5.1.0 · Jul 19, 2026
- Messages now reach you exactly as they were typed. A link containing encoded characters used to lose part of itself on the way to you, so a pasted address could arrive broken. Quoted markup, such as a customer showing you the HTML on their page, could vanish from the message entirely. Both are fixed. Messages routed into Bodholdt Tickets are now escaped as well, so nothing a visitor sends can render as live content in your Support Desk.
- Asking for a fresh code works again. The hourly limit on codes sent to one address was exactly the number the widget itself could spend, so "start again to request a new code" was always refused. The limit now leaves room to start over, and when a visitor does have to wait, the widget says roughly how long.
- Clearer answers when something is wrong. If the plugin cannot create its database tables, the settings page and an admin notice now say so plainly instead of reporting that the widget is live. If a saved setting had to be shortened, or had formatting removed, the page now names the field that changed instead of only saying "Settings saved".
- Friendlier recovery in the widget. After too many incorrect codes the widget returns the visitor to the email step, rather than offering a Resend button that could never work. The resend countdown now follows real time, so it no longer looks stuck after someone switches to their mail app on a phone.
- Sites behind a proxy or CDN. Added a `bodholdt_contact_client_ip` filter so operators whose web server does not pass through the real visitor address can supply it. Without it, every visitor could end up sharing a single rate limit bucket. Forwarded headers are still never trusted by default.
- Smaller fixes. A three-digit colour such as #0af no longer produces invalid styling. The message box now shows its length limit before you send. The suggested privacy policy wording and the erase result describe the ticket store accurately when Bodholdt Tickets is handling messages. The Licensing note no longer contradicts the status card. Gamification labels can now be translated. A failed table creation no longer repeats a full migration on every page load, and no longer disables the activity report permanently.
v5.0.2 · Jul 19, 2026
- Privacy tools (GDPR export and erase). The plugin now integrates with the built-in WordPress privacy tools. Tools → Export Personal Data returns the verification records held for an email address, and Tools → Erase Personal Data deletes them, so you can answer data subject requests the standard way. The plugin also adds suggested wording to Settings → Privacy for your privacy policy. No change to how the contact form works.
v5.0.1 · Jul 19, 2026
- Accessible contact form (WCAG 2.1 AA). The visitor widget now passes accessibility review: readable success and error text in dark mode, visible field borders and focus outlines, autocomplete on the email and verification-code fields, a properly announced delivery confirmation, and correct focus handling on Resend. This matters if your site serves visitors in the EU, where the European Accessibility Act applies to consumer-facing forms.
- Licensing and packaging. The bundled confetti library now ships its required copyright notice, and the release archive uses correct, non-world-writable file permissions. The readme now names the database tables the plugin creates.
v5.0.0 · Jul 16, 2026
- Stronger verification state. One-time codes and opaque flow tokens are stored as HMAC hashes in plugin-owned per-site tables. Each challenge is bound to its browser flow, expires quickly, enforces exact six-digit input and attempt/resend limits, and can authorize at most one delivered message through atomic state transitions.
- Bounded abuse handling. Atomic database-backed limits now cover source addresses, destination emails, global mail volume, widget opens, and message attempts. An hourly security task removes expired challenges and counters; a failed delivery releases the verified flow for a safe retry instead of silently consuming it.
- Precise customer recognition. Skipping the emailed code requires a signed-in WordPress account whose email exactly matches the address entered. Licensing mode additionally requires a currently active, non-expired Bodholdt license, checked again when the message is submitted. A known email address alone is never proof of identity.
- Safer request boundaries. Each public action has its own nonce, cached pages can refresh the complete nonce set, malformed non-scalar fields are rejected cleanly, and message length is validated rather than silently truncated.
- Safer delivery. A support ticket is considered delivered only after its first message is stored. If that partial write fails, direct-email fallback occurs only after the empty ticket is confirmed removed, preventing duplicate or orphaned customer conversations.
- Deliberate first run and upgrades. Fresh installations start with the widget hidden and weekly summary email off, then show a direct setup notice. Existing installations retain their prior live/hidden behavior and automatic reports even if they never opened the old settings page. In-place and automatic updates create required storage on the first request instead of waiting for an administrator visit.
- Operator controls that match the documentation. The settings page now exposes the weekly activity email and the private Fun Pass, sound, and confetti switches. Blank display copy falls back consistently in both the preview and live accessible dialog.
- Complete lifecycle support. Activation creates or upgrades per-site security storage and schedules cleanup; network activation covers existing sites and sites added later. Deactivation clears short-lived security state and scheduled tasks without deleting configuration. Uninstall removes this plugin's settings, owned tables, legacy verification remnants, scheduled tasks, and only its own rows from shared Bodholdt Arcade tables.
- Requires WordPress 6.5 or newer and PHP 8.0 or newer.
v4.7.4 · Jul 11, 2026
- Sturdier under odd input. The contact endpoints and the settings save now shrug off malformed requests (for example a field sent in the wrong shape) and return a normal validation response instead of erroring. This only ever affected hand crafted requests, never a real visitor or a normal save, but it keeps your error log clean.
- Precise multisite cleanup. On a multisite network, turning the plugin off on a single site now leaves the other sites' weekly report untouched; only a full network deactivation clears them all.
- Housekeeping. Trimmed a few unused entries from the "Working the Door" scoreboard so its catalog only lists rewards you can actually earn.
v4.7.3 · Jul 11, 2026
- Cleaner activity readout. The "last 7 days" line and the weekly email always show sensible figures now. Percentages stay between 0 and 100, the counts never read backwards, and the wording reads correctly even when a number is 1.
- Tidier multisite cleanup. On a multisite network, turning the plugin off now clears its scheduled weekly report on every site, leaving nothing behind.
v4.7.2 · Jul 11, 2026
- True open-rate. The activity summary now also counts how many people opened the widget, so you can see the whole funnel: opened, entered an email, and finished. It reports the overall share of opens that turned into a message, which tells you at a glance whether people are dropping off before they even start.
v4.7.1 · Jul 11, 2026
- See how your contact form is doing. The settings page now shows a short "last 7 days" activity line (how many people started, how many were sent a code, and how many finished after verifying), and you get an optional weekly email summary. This makes it easy to tell whether the email step is turning visitors away, so you can switch recognition mode if it is.
v4.7.0 · Jul 11, 2026
- Stronger proof before the code is skipped. A returning customer now skips the email code only when they are signed in to the matching account. A visitor who simply types a known customer's email address is asked to verify by code like anyone else. This closes a way someone could send you a message posing as one of your customers.
- Tougher on abuse. Verification codes are now capped per destination address as well as per sender, a valid code can be used only once even under a rapid burst of requests, and automated "bot" traffic is rate limited before it can touch anything. Together these bound spam and reduce the widget's usefulness for sending unwanted code emails to other people.
- Off means off. When you switch the widget off, its background endpoints stop responding too, not just the visible button.
- Accurate tallies. The "Working the Door" counts tick over only after a message is actually delivered, so your Door Report reflects reality even when mail is misconfigured.
- Polish. Very long messages are trimmed to a sensible length, the celebration animations stay within the screen, and the arcade labels are translatable (the shared level-up HUD badges stay in English, since a shared component cannot carry a fixed text domain).
v4.6.0 · Jul 11, 2026
- The code is checked the moment you enter it. When a visitor types their verification code and continues, the widget now confirms it right away, so a wrong or mistyped code is caught before they write their whole message instead of after.
- The widget keeps working on cached sites. If your pages are served from a cache and the security token in the page has gone stale, the widget quietly refreshes it and carries on, so the contact form no longer breaks with a "network error" on heavily cached sites.
- You are told when a code cannot be emailed. If your site cannot send the verification email (for example mail is not configured yet), the visitor now sees a clear "please try again in a few minutes" message instead of being stranded on a code screen with no code ever arriving. Submitted messages are handled the same way, so a message is never quietly lost.
- Clean removal. Deleting the plugin now removes its settings, its "Working the Door" tallies, and its rows in the shared arcade tables. The four shared `bod_arcade_*` tables and the `bod_arcade_db_version` option are deliberately left alone, because uninstall has no safe way to tell whether another Bodholdt plugin still needs them. If Contact was the only Bodholdt plugin on the site, those four tables stay behind empty and you can drop them yourself.
- Polish. The notification address now tells you if what you entered was not a valid email instead of silently ignoring it, the header, intro and success text show exactly what you typed, those fields gained sensible length limits, and the "Working the Door" operator text is translatable.
v4.5.1 · Jul 11, 2026
- The widget stays readable with any accent color. Button text and links now choose their color from the accent's real contrast, so a light accent (like a bright cyan) gets dark, legible text instead of washing out on the white card. The admin live preview reflects the same result.
v4.5.0 · Jul 11, 2026
- Working the Door. A calm, optional arcade for you, the operator. Because contact activity happens while you are away, the settings page now greets you with a Door Report of who you waved through, the strangers who verified, the bots you bounced, and the messages handled since your last visit, plus a rank and XP that grow as your door gets busier. It sits behind a Fun Pass switch (on by default, sound off) and stores everything in your own database.
v4.4.0 · Jul 10, 2026
- A clearer settings page and a preview you can walk through. The page now opens with a status card that answers "is my widget live and doing what I set up?" in plain sentences: whether it shows, where messages go, who skips verification, and the address you are notified at. The live preview steps through all three screens a visitor sees (email, then the 6-digit code, then the message and its success note), so the verification flow you configure is no longer invisible. On wide screens the form and preview sit side by side. Accent color gains curated swatches and a readability note, and the appearance and corner-style choices became tidy segmented controls.
- The verification step no longer dead-ends. If a visitor's code does not arrive or they typed the wrong address, they can now "Resend code" (with a short countdown that respects the anti-spam limit) or go back and fix their email. Running out of attempts now says so and offers a fresh code instead of failing silently. The opening line also explains why the email is asked for first.
v4.3.0 · Jul 9, 2026
- Added a dismissible panel on the settings page inviting you to turn contact messages into trackable Bodholdt Tickets when that plugin is not active. This mirrors the confirmation shown when it is active. Nothing about the widget changed.
v4.2.0 · Jun 5, 2026
- White-label appearance. The widget now offers Light, Dark, or Auto (match the visitor's system) display modes plus a corner-style choice, all derived from your single accent color with readable text and contrast shades computed automatically, so it blends into any site. The settings page got a matching refresh and the live preview reflects every change.
v4.1.3 · Jun 4, 2026
- WordPress.org readiness pass: added translator comments for placeholder strings, removed the manual text-domain load (WordPress loads translations automatically), and hardened a server-variable read. No change to how the widget behaves.
v4.1.2 · Jun 3, 2026
- Renamed the Bodholdt Tickets integration to its current name and refined the verification step layout. The email address and the "enter your code" instruction now sit on their own lines.
v4.1.1 · May 22, 2026
- Settings page now shows a live preview of the widget that updates as you change the accent color, header, and intro (§7.4 Steve Jobs pass).
v4.1.0 · May 20, 2026
- Bodholdt Tickets front-door. With a compatible Bodholdt Tickets release active, contact submissions can create a support ticket (and notify you by email) instead of a plain email, so customers can track and reply to them, and you work them in the Support Desk. If Tickets has categories, the widget shows a “What’s this about?” picker. Without a compatible Tickets API, it behaves exactly as before (emails you). All recognition + anti-spam unchanged.
v4.0.0 · May 20, 2026
- Reconfigured for distribution: renamed to Bodholdt Contact, added a multi-tenant settings page (brand name, accent color, copy, notification email, customer-recognition mode), made visitor-facing branding configurable, internationalized the interface (text domain `bodholdt-contact`), and packaged it for release. All anti-spam protections (one-time code, honeypot, rate limiting, brute-force lockout, timing-safe comparison) retained.
Yes. It's completely free and GPL-licensed, with no license key, paid tiers, or locked features. Download it free from bodholdtlabs.com.
Download the ZIP from bodholdtlabs.com, then in your WordPress admin go to Plugins → Add New → Upload Plugin, choose the ZIP, click Install, and Activate. Then open Settings → Bodholdt Contact, review the delivery and recognition settings, turn on “Show the widget,” and save.
Only visitors recognized through the account mode you choose can skip the 6-digit code. In either account mode, the visitor must be signed in and use the exact email on that account; Licensing mode also requires an active, unexpired entitlement. Everyone else verifies once; together with the honeypot and rate limits, this helps block common automated spam.
No. It works on its own and emails you each accepted message. With a compatible Bodholdt Tickets release, Contact attempts ticket delivery first; if the compatible API is unavailable or ticket creation cleanly fails, it uses the configured email route.
To the notification email you set in Settings → Bodholdt Contact (your site admin email by default), with the sender as Reply-To.