PubForms

PubForms lets you build a form in the WordPress admin, drop it into any page with a shortcode or the PubForms block, and read the submissions in your own dashboard.

• 20+ field types: text, email, paragraph, phone, URL, number, date, time, month, week, dropdown, multiple choice, checkboxes, quiz, file upload, signature, calculation, section heading, HTML, hidden and more
• Build contact forms and other common forms in seconds with ready-made templates
• Every submission is emailed to you and stored safely in your own database
• Read, search, sort and export entries to a spreadsheet (CSV) at any time
• Conditional logic — show or hide a field based on how someone answers
• Field calculations — total or multiply number fields automatically
• Style it your way: pick a look, layout (stacked, grid or flow), spacing, corners, button position and colours in the block sidebar, or set them on the shortcode
• Anti-spam you can switch on once for every form: Cloudflare Turnstile, hCaptcha or a built-in question, plus a hidden trap field, rate limiting, a minimum fill time, a link limit and a blocked-words list that work with no CAPTCHA at all
• Every input is validated and sanitised, so forms are safe from injection-style attacks
• Optional multi-page forms and save-&-resume for longer submissions

Everything runs on your own server: no IP addresses or browser details are stored with entries. Nothing is sent to a third-party service unless you turn on Cloudflare Turnstile, hCaptcha or a webhook (see External services below).

External services

PubForms works fully on its own. It contacts an outside service only if you switch one of these features on.

Cloudflare Turnstile (optional CAPTCHA)

Used when you choose Cloudflare Turnstile under PubForms > Settings and save your Turnstile keys. A form then loads Cloudflare’s script from https://challenges.cloudflare.com/turnstile/v0/api.js, and the visitor’s browser talks to Cloudflare to complete the check. When the form is submitted, your server sends the visitor’s check token and your secret key to https://challenges.cloudflare.com/turnstile/v0/siteverify to confirm it. The “Test these keys” button on the Settings screen does the same for one test token. Terms: https://www.cloudflare.com/website-terms/ – Privacy policy: https://www.cloudflare.com/privacypolicy/

hCaptcha (optional CAPTCHA)

Used when you choose hCaptcha under PubForms > Settings and save your hCaptcha keys. A form then loads hCaptcha’s script from https://hcaptcha.com/1/api.js, and the visitor’s browser talks to hCaptcha to complete the check. When the form is submitted, your server sends the visitor’s check token and your secret key to https://hcaptcha.com/siteverify to confirm it. The “Test these keys” button does the same for one test token. Terms: https://www.hcaptcha.com/terms – Privacy policy: https://www.hcaptcha.com/privacy

Webhooks (optional)

If you add webhook URLs to a form, each confirmed submission is sent as JSON to those addresses, which an administrator chooses. Uploaded files are not sent, only their names. Requests to private or internal network addresses are refused. What the receiving service does with the data is governed by that service.

The built-in question, trap field, rate limit, minimum fill time, link limit and blocked-words list all run on your own server and contact nothing.