Elzo Forms

Elzo Forms is a form builder for WordPress. You build a form in the admin, place one shortcode where the form should appear, and every submission is stored on your own site. No page builder, no account, and no external service is required to run a form.

Use it for contact forms, request and quote forms, lead forms, application forms, feedback forms, file upload forms, and other everyday site forms.

Building forms

• Visual form builder inside the WordPress admin.
• Field types: text, textarea, select, checkbox, radio, range, file upload, hidden, content, and button.
• Text fields also cover email, telephone, URL, number, date, time, and password input, with matching validation.
• Responsive field widths (full, 1/2, 1/3, 1/4) for multi-column layouts.
• Multi-step forms with configurable step navigation text.
• Conditional field visibility based on field values, visitor login state, or page context.
• Shortcode output with width and alignment options.

Submissions and notifications

• Submissions are stored in the WordPress admin with the submitted values, uploaded files, and visitor details.
• Email notifications with configurable recipients, subject, and message text.
• AJAX or standard form submissions.
• Custom success message, or a redirect after a successful submission.
• File uploads with size limits, allowed file type checks, and chunked uploads for large files.

Spam protection

• Minimum time before a form can be submitted, and a minimum interval between submissions.
• Blocked IP addresses and blocked words.
• Blocked submissions can be discarded or kept and marked as spam for review.
• Optional Google reCAPTCHA v3 and Akismet modules. Both stay disabled until you enable them and add your own keys.

Styling and customization

• Global and per-form settings for form behavior, texts, and styling.
• Template overrides from an elzo-forms directory in your theme.
• Hooks and filters for custom field types, validation, and submission handling.
• Optional read-only JSON form sources, so a developer can ship forms with a theme or plugin and keep them under version control.

Free and paid versions

Everything described above is included in this plugin. No field type, module, or setting is locked behind a purchase.

Post-submission automations, including webhooks, conditional automation actions, and cookie actions, are part of Elzo Forms PRO, a separate commercial plugin available at https://elzoforms.com. Elzo Forms PRO replaces this plugin instead of extending it: while it is active, Elzo Forms (free) stops loading and can be deactivated.

Privacy

Elzo Forms stores form submissions on your own site, in your WordPress database.

For each submission the plugin stores the submitted field values, the time of submission, the visitor IP address and browser user agent, the WordPress user ID if the visitor is logged in, and the page the form was submitted from. Files uploaded through a file field are stored in your uploads directory under elzo-forms/user-uploads.

None of this data leaves your site by default. It is shared with a third party only if you enable one of the optional anti-spam modules described below, and only in the way those sections describe.

Elzo Forms does not add submission data to the WordPress personal data export and erasure tools. Submissions are managed from Forms > Submissions in the WordPress admin.

Third-party Services

Google reCAPTCHA v3

Elzo Forms includes an optional Google reCAPTCHA v3 module for spam protection. The module is disabled until a site administrator enables it and configures Google reCAPTCHA v3 site and secret keys.

Service provider: Google LLC.

When the module is enabled and a protected form with a configured site key is rendered, Elzo Forms loads the Google reCAPTCHA JavaScript API from:

https://www.google.com/recaptcha/api.js

Before a protected form is submitted, the browser asks Google reCAPTCHA to generate a token for the form action. During submission, Elzo Forms sends the token, the configured secret key, and the visitor IP address to Google’s verification endpoint:

https://www.google.com/recaptcha/api/siteverify

Google may receive information required for reCAPTCHA risk analysis and verification, such as the site key, reCAPTCHA token, action name, visitor IP address, browser/client information, and interaction signals. Elzo Forms uses the returned verification result, action, and score to decide whether the submission should be accepted or rejected as spam.

If reCAPTCHA logging is enabled in the module settings, Elzo Forms may store the returned reCAPTCHA score in submission metadata and write verification pass/fail messages to the site’s PHP error log for debugging.

Google reCAPTCHA is governed by Google’s terms and privacy policy:

• Terms: https://policies.google.com/terms
• Privacy Policy: https://policies.google.com/privacy
• reCAPTCHA documentation: https://developers.google.com/recaptcha/docs/v3

Akismet

Elzo Forms includes an optional Akismet module for spam protection. The module is disabled until a site administrator enables it and configures an Akismet API key.

Service provider: Automattic Inc.

Elzo Forms does not contact Akismet or send submission data to Automattic unless the Akismet module is enabled and configured with an API key. By enabling and configuring the Akismet module, the site administrator chooses to use Akismet as a third-party spam protection service.

During submission, Elzo Forms sends contact-form spam check data to Akismet’s comment-check endpoint:

https://rest.akismet.com/1.1/comment-check

Akismet may receive submitted text content, likely contact identity fields such as name, email address, or website URL when present, visitor IP address, browser user agent, referrer, form page URL, site URL, site language, and site character set. Elzo Forms uses the returned spam/ham result to decide whether the submission should be accepted or marked as spam.

If Akismet logging is enabled in the module settings, Elzo Forms may store the Akismet result and reason in submission metadata and write verification pass/fail messages to the site’s PHP error log for debugging.

Site administrators should review Automattic’s terms and privacy policy and update their own privacy policy or visitor notices as needed before enabling Akismet.

Akismet is governed by Automattic’s terms and privacy policy:

• Terms: https://automattic.com/terms/
• Privacy Policy: https://automattic.com/privacy/
• Akismet documentation: https://akismet.com/developers/detailed-docs/comment-check/

Support

For support, use the WordPress.org support forum for this plugin or visit https://elzoforms.com.