Create Plan a Visit

  1. Create a page and select the Plan a Visit template, then publish it.
  2. Add the address and schedule under Service & Location and Save All Options.
  3. Preview while signed out. Grace recognizes the template even with a custom URL, or a published /plan-a-visit/, /plan-visit/, or /visit/ page.
  4. If no public visit page exists, related links are hidden rather than sent to an unrelated page. Blank addresses hide the map and location section.
  1. Update and activate Grace Church Core 1.4 or later. A theme-only update does not update an installed companion plugin.
  2. In Theme Options → Contact Info, enable the contact form and set Send Messages To. Leave it blank to use the WordPress administration email from Settings → General. This delivery address is private. Set the public email under Footer Options, address under Service & Location, and phone/office hours under Contact Info. No invented contact details are added.
  3. Configure authenticated outgoing email using your hosting provider or an SMTP plugin. Grace uses WordPress wp_mail(), preserves the configured From address, and sets the visitor’s email as Reply-To. It does not require a specific paid mail service.
  4. Submit a real test from a logged-out browser and confirm receipt, spam-folder behavior, and Reply-To. “Accepted for sending” means the mail transport accepted the message; it does not guarantee inbox delivery.
  5. Publish a privacy policy describing your mail provider and retention. The form emails name, email, topic, and message; it does not store message entries in WordPress or send an automatic copy to visitors. Mail-log plugins/providers may retain copies separately.

Use [grace_church_contact_form] in a Shortcode block or Classic Editor on any page, including with another theme. If adding your own third-party form to the Contact template’s editor content, disable the built-in form to avoid duplicates. For a completely custom page layout, use a different template or a page slug other than contact.

Protection includes strict field limits, nonce validation, an invisible honeypot, a shared-site ceiling of 60 attempts, and five attempts per network address in a rolling hour. Site-keyed hashes and duplicate fingerprints are temporary; no raw network address or message body is stored by the form. A matching message from the same network is not emailed again for ten minutes. These are basic spam protections, not a CAPTCHA or a distributed-abuse defense. Reverse proxies can cause multiple visitors to share a limit; use host-level anti-abuse controls if needed.

Cached pages refresh the nonce immediately before sending. Exclude wp-admin/admin-ajax.php and wp-admin/admin-post.php from full-page caching or request-blocking rules. With JavaScript disabled, submissions use WordPress’s response page and Back link; if an old form has expired, copy the message before refreshing. Failed AJAX submissions preserve your text.