# Form Audit

## Contact form (`/contact/`, and its `/fr/`, `/tr/`, `/en-gh/` equivalents)

- **Plugin**: Contact Form 7 (`_wpcf7*` hidden fields confirm this).
- **Method/action**: `POST` to `/contact/#wpcf7-f44-p541-o1` (form ID 44, page ID 541) — standard CF7 same-page AJAX submission pattern.
- **Fields**: `your-name`, `your-email`, `your-phone`, `your-subject`, `your-message` (each field name appears twice in raw HTML — once as the actual input, once as CF7's hidden mirror used for its AJAX validation flow; this is normal CF7 markup, not a duplicate-field bug).
- **Bot protection**: Cloudflare **Turnstile** (`_wpcf7_turnstile_response` field present) — already active, no CAPTCHA gap.
- **Submission was not tested** (no real form submission was sent, per audit scope) — destination email/handler not confirmed beyond the CF7 default (typically emails the site admin; exact recipient not verifiable without WP admin access or a live test submission, which was intentionally not performed).

## Recommendation for the rebuild

- Preserve the same field set (name/email/phone/subject/message) for continuity with whatever backend/CRM the business currently expects submissions to land in.
- Contact Form 7 is WordPress-specific; the static rebuild will need a replacement submission handler (e.g. a serverless function, Formspree-style service, or the business's mail provider's API) — keep Turnstile or an equivalent bot-protection mechanism, since it's already proven out.
- No other forms were found on any of the 53 sitemap pages (about-us, legal pages, product pages carry no additional forms beyond the shared contact form referenced/linked from them).