Form Builder

New

• Option layout for radio buttons and checkbox groups (field setting option_layout): Vertical (default) or Horizontal, where the options sit side by side and wrap on narrow screens. The builder has a "Layout" setting and shows the layout on the form; all three themes support it. The Customer Feedback and Product Question templates use the horizontal layout for their short radio groups.
• Form settings Maximum Width (px) (form_width, 320–1600; empty = full width) and Position (form_position: left, center or right) in the Design section. The whole form block (title, intro, steps, form, success message) moves; this applies on the own page (the page title moves with the form), in CMS widgets, in Page Builder and in product tabs, not inside the popup. Both settings are part of the REST data.
• Extension point for templates: Api\TemplateProviderInterface, registered as providers of Model\Template\Library in di.xml. Provider templates are installed on every setup:upgrade; they cannot replace built-in templates (duplicates are logged and skipped). Template form settings may contain form_width, form_position and option_layout.
• Template picker icons magento, cloud, shopify, wordpress and expert (neutral symbols); unknown icons fall back to the generic form icon.

Improved

• Forms are no longer limited to about 860 pixels: by default they fill the page, block or tab they are shown in. To keep the previous look, set Maximum Width to 860 and Position to Left.

Fixed

• After Next and after sending, the step indicator and the thank-you message were scrolled under a sticky store header. The form and the message now keep 96 pixels of space above them (CSS custom property --ti-form-scroll-offset).

New

• Forms grid (Content › Form Builder › Forms) with title, code, status, store views, customer groups, submissions, views, conversion rate and last change; filters, saved views and the mass actions Enable, Disable, Duplicate and Delete.
• Drag-and-drop builder: field palette, form canvas and settings panel; reordering by drag and drop, buttons and keyboard (Alt + arrow keys); full, half and third widths; multi-page forms with page titles, page conditions and page reordering.
• 19 field types: text, text area, email, phone, number, date, time, date and time, dropdown, multiple select, radio buttons, checkboxes, single checkbox, rating, file upload, Google Map location, hidden field, HTML / text block, heading / divider; per-field label, code, help text, placeholder, default value, required, width, CSS class, length limits, validation rules (email, URL, digits, letters, letters and digits, regular expression), customer prefill and hidden value sources (fixed value, page URL, product SKU, product name, customer email).
• Conditions for fields and pages (is, is not, contains, is empty, is not empty, is greater than, is less than; all or any), evaluated in the browser and again on the server; hidden fields are not required and not stored.
• Five templates installed by a data patch: Contact Us, Customer Feedback, Product Question / Quote Request, Callback Request and Job Application.
• Three form themes (Clean, Rounded, Outlined) and an accent colour per form, based on CSS custom properties.
• Display options: own form pages under a configurable URL prefix with meta title and description, the "Techimprovement Form" CMS widget (inline or popup), the "Form" Page Builder content type and product pages (product tab, product info column or below the product info) for all products or selected categories.
• Restrictions by store view, customer group, active period and one submission per customer.
• Submissions grid with status (New, Read, Answered), filters, mass actions, CSV and Excel XML export; submission page with answers, protected file downloads, product and page details, email replies with history, status and internal notes; per-form CSV export with one column per field, read in batches of 500.
• "My Forms" in the customer account with the customer's submissions and the replies.
• Emails: new submission notification (recipients per form), auto-reply and admin replies, all with editable email templates. Auto-replies go to signed-in customers at their account email (optionally with their answers); guests get one only when Google reCAPTCHA is enabled for Form Builder forms, without their name or answers; at most 3 auto-replies per address and hour.
• Spam protection: Google reCAPTCHA through Magento's reCAPTCHA settings, honeypot field and a limit of submission attempts per IP address (default 10 in 10 minutes), counted atomically in the database.
• Privacy: consent checkbox with the stored consent text, option not to store IP addresses, retention period with a daily cron job and the command bin/magento techimprovement:forms:clean.
• Statistics per form: views, submissions, conversion rate and a 30-day chart, from a daily statistics table; views are counted in a way that works with the full page cache, once per IP address, form and day.
• Cron job ti_formbuilder_refresh_scheduled_forms (every 15 minutes) refreshes cached pages of forms whose "Active From" / "Active To" day started or ended.
• Service contracts for forms and submissions and read-only REST endpoints.
• Configuration in Stores › Configuration › Techimprovement › Form Builder.
• Dependencies are declared in composer.json and module.xml, including Magento_Theme (pager of "My Forms").

Security

• Grid exports only export the submissions listing, so the "Export Submissions" permission cannot export other grids (customers, orders).
• Admin data is escaped in confirmation dialogs (form title in the grid's delete confirmation, field labels and page titles in the builder).
• "Redirect After Submit" accepts only paths on the store and URLs on the store's own domains; backslashes, control characters and user information are refused.
• Regular expressions with nested or overlapping quantifiers are refused on save; patterns that cannot be evaluated on the server are logged and do not block customers; long values are only checked on the server.
• One submission per customer is enforced with a lock, so parallel requests cannot create two submissions.
• Database messages are logged and never shown to visitors.
• Cells of the grid CSV export and the header of the per-form CSV export are protected against formula injection.
• Saving a form refreshes only the cached pages that show it; product pages only when its product placement changes.
• Downloads of uploaded files are sent with X-Content-Type-Options: nosniff.