Saudi CR Pro Business Forms Wordpress Plugin - Rating, Reviews, Demo & Download
Plugin Description
Saudi CR Pro Business Forms adds optional business-record lookup to Contact Form 7. Its WordPress.org hosting request has been approved. Directory approval is not an endorsement by WordPress.org, Contact Form 7 or any government body.
Applicants enter a complete ten-digit CR or unified BUSINESS number, review the original Arabic legal name, separate identifiers, optional city/region and published period, then choose Use business details. Existing values require explicit replacement confirmation. Blank source fields are never used to erase entered details. Manual entry remains available on errors or without JavaScript.
The plugin calls Saudi CR Pro from the WordPress server. Its API key is never included in visitor HTML, JavaScript, browser storage or public settings. It uses exact lookup only, not name autocomplete or comparison. It does not provide VAT verification, national addresses, personal identity checks, ownership checks, live official status or ZATCA clearance/submission.
Supported adapter: Contact Form 7 ordinary uniquely named text, tel and textarea controls. No WooCommerce checkout, Shopify, Elementor, Gravity Forms, WPForms, select controls or arbitrary form-builder compatibility is claimed. Per-site activation only; network activation is unsupported.
External service and privacy
The code is GPL-2.0-or-later. The external Saudi CR Pro service requires a verified account, a valid private API key and active trial or annual access; an API subscription may be paid. Installing this plugin does not grant or extend service access. Account limits and usage are shared across integrations and keys.
When the visitor presses Look up business, WordPress sends the normalized business identifier and an Authorization header to https://saudicrpro.com/api/v1/lookup/{identifier}. This uses the service’s active published registry release, not an insights-report endpoint. Other form fields and visitor IP addresses are not forwarded by this plugin. The external service sees the WordPress server’s address and processes requests under its own privacy policy. No analytics, external fonts or executable scripts are loaded by this plugin.
Terms: https://saudicrpro.com/terms
Privacy: https://saudicrpro.com/privacy
Fair use: https://saudicrpro.com/fair-use
Documentation: https://saudicrpro.com/docs#wordpress-pilot
Support: support@saudicrpro.com
The administrator must explicitly enable external-service use and update the site’s own privacy notice. The plugin provides suggested privacy-policy text in WordPress. It keeps no lookup-result history. Contact Form 7 mail, storage addons, server logs, backups and your own form workflow have separate retention. A bounded rate-counter option retains daily totals and salted visitor-address hashes for the most recent request minute until subsequent lookup activity replaces them or the plugin is uninstalled. Raw visitor IPs and identifiers are not stored by these counters.
The integration key is encrypted at rest using AES-256-GCM and the installation’s WordPress salts, or read from a private SAUDICRPRO_API_KEY constant. Server administrators and installed plugins must still be trusted; encryption does not protect against a compromised WordPress server. Changing salts makes the stored key unreadable: replace it through settings. Never put the key in a form tag, mail template, screenshot, public repository or browser code.
Reliability and operating limits
Requests have a ten-second server timeout, no redirects, TLS verification, a fixed HTTPS destination and a 32 KiB response limit. Browser requests time out after twelve seconds. No automatic retries, persistent result caches or background lookups occur.
Local protection combines enabled-form checks, form tokens, same-origin checks and atomic counters. A public nonce or origin header is not authentication: bots can obtain or spoof them. Defaults: 5 requests per visitor address per minute, 30 per site per minute, and a configurable 250 per UTC day (1-10,000). These local budgets do not raise/reset the upstream account’s limits. Rejected upstream lookups can consume account allowance. Provider rate-limit backoff is respected; account/auth failures stop repeated upstream attempts briefly. Distributed abuse can still exhaust the site budget; disable public forms or require an authenticated, separately reviewed integration when appropriate.
REMOTE_ADDR must reflect the real client as configured by your host. This plugin deliberately does not trust arbitrary forwarded headers. Reverse proxies that leave all visitors on one address will share a visitor bucket. Site administrators should configure their host correctly, not relax the public request limits blindly.
Keep full-page cache lifetimes below twelve hours or exclude the form page. Expired WordPress form tokens require a reload. The lookup REST route must not be cached. On errors the applicant can continue manually; not found does not mean inactive. A missing optional source value is not an error and never erases manual content.
Changing a CF7 field name/type can invalidate its mapping; re-save mappings before exposing the form. No mapped fields should be dynamically removed/replaced by another plugin without retesting.
Deactivation keeps private settings for reactivation. Uninstall removes this plugin’s key, configuration and counters on the current site, but never deletes CF7 forms, submissions or a Saudi CR Pro account/key. Backups have their own retention.
Tested environment
The recorded environment is WordPress 7.1.4, PHP 8.4.27 and Contact Form 7 6.2.4.1, with controlled upstream responses rather than a live customer key. The integration targets WordPress 7.1+, PHP 8.3+ and CF7 6.2.4.1. Other themes, hosts and versions are not certified. Validate an authorized live lookup and your actual hosting setup before customer rollout.
Testing guide: https://saudicrpro.com/downloads/wordpress-testing.md
English and built-in Arabic widget copy are included. PHP text uses WordPress gettext; JavaScript uses the bundled WordPress wp-i18n library. A POT translation template is provided in languages/. No remote translation scripts are loaded.
Screenshots
No screenshots provided
