Title: Wiwi Forms – Form Builder Author: Naiche Published: August 27, 2026 Last modified: October 7, 2026 --- Search plugins ![](https://s.w.org/plugins/geopattern-icon/wiwi-forms.svg) # Wiwi Forms – Form Builder By [Naiche](https://profiles.wordpress.org/naiches/) [Download](https://downloads.wordpress.org/plugin/wiwi-forms.1.0.3.zip) * [Details](https://twd.wordpress.org/plugins/wiwi-forms/#description) * [Reviews](https://twd.wordpress.org/plugins/wiwi-forms/#reviews) * [Installation](https://twd.wordpress.org/plugins/wiwi-forms/#installation) * [Development](https://twd.wordpress.org/plugins/wiwi-forms/#developers) [Support](https://wordpress.org/support/plugin/wiwi-forms/) ## Description Wiwi Forms is a lightweight WordPress form builder designed for developers and site owners who want a clean, fast, and privacy-focused form solution without the bloat. **About the name:** Wiwi Forms is built and maintained by Wiwi Websolutions, alongside Wiwi Cookie Consent. **Key Features:** * Drag-and-drop form builder with 17 field types and multi-step forms * Encrypted entry storage (libsodium) with a dedicated site key * Encrypted file uploads on disk * AJAX form submission (no page reload) * Bootstrap 5 form classes — works natively with Bootstrap themes * Email notifications with delivery tracking (sent/failed status per entry) * Privacy tools supporting GDPR/AVG/ePrivacy: encrypted storage, auto-delete retention, consent field * Anti-spam: honeypot, time token, rate limiting, math captcha, and local owner- managed rules * No tracking cookies or sessions; one short-lived functional cookie for non-JavaScript submissions; fully cache-compatible (LiteSpeed, WP Rocket, Cloudflare) * jQuery-free front end; the admin settings screen uses WordPress’s bundled colour picker * English + Dutch translations included **Field Types:** Text, Textarea, Select, Radio, Checkbox, Number, Email, Phone (with country prefix), Date/Time, File Upload, Hidden, Math Captcha, HTML, Heading, Separator, GDPR Consent, Page Break. ## Installation 1. Upload the `wiwi-forms` folder to `/wp-content/plugins/` 2. Activate the plugin through the ‘Plugins’ menu 3. Go to Wiwi Forms Add New to create your first form 4. Use the shortcode `[wiwi-forms id="X"]` to embed forms ## FAQ ### Does Wiwi Forms make my site GDPR compliant? It gives you tools that help, but compliance is something you achieve as the site owner — no plugin can grant it to you. It depends on your lawful basis for collecting the data, your privacy notice, your agreements with anyone who processes it for you, and how you configure and run the site. What the plugin does: the answers people submit, and any files they upload, are encrypted with libsodium before they are stored. An auto-delete retention policy removes entries after a number of days you choose. The GDPR Consent field auto-links to your Privacy Policy, Terms and Cookie Policy pages. What it does not do: it will not delete anything unless you set a retention period— left at zero, entries are kept indefinitely. It also does not register with WordPress’s own personal-data export and erase tools, so a subject access or erasure request has to be handled by hand. Some information stored next to an entry is deliberately left unencrypted, because the plugin has to read it without unlocking the entry: the spam signals that explain why a submission was scored the way it was, the original name of an uploaded file, the browser user agent string, and any error returned when sending mail. A spam signal can quote a short fragment of what was submitted. Visitor IP addresses are never stored — only a keyed hash of them. ### Does Wiwi Forms contact any external service? No. It does not phone home, load scripts or styles from a CDN, send your data anywhere, or check for its own updates. There is no bundled updater and no account to sign up for. One optional setting performs a lookup. “Email domain check”, which is off by default, asks whether the domain of a submitted email address is able to receive mail. That is a DNS lookup for MX, A and AAAA records, made by your own server through whatever resolver your host uses. Only the domain part of the address is looked up, never the full address, and each answer is cached for a day. Turning the setting off stops the lookups entirely. ### Does Wiwi Forms use cookies? Wiwi Forms uses no tracking cookies, sessions, or localStorage. On non-JavaScript submissions, it sets one functional cookie containing a random token for up to five minutes so the form can be re-populated after the redirect. The cookie is HTTP-only, SameSite=Lax, and Secure on HTTPS. Forms remain compatible with page caching solutions. ### Does Wiwi Forms require jQuery? The front end loads no jQuery. The admin settings screen uses WordPress’s bundled colour picker, which depends on jQuery. ### How are imported spam-rule regular expressions handled? Rule packs are pasted and installed explicitly by an administrator; Wiwi Forms does not download them from a remote service. Regular expressions are available only to imported Wiwi rule packs, not owner-authored rules. Their count and length are capped, they are validated during import, and runtime matches use PCRE resource limits plus a timed cooldown if a subject causes an error. ### Does Wiwi Forms support WordPress multisite? Install and activate Wiwi Forms separately on each site. Network activation is not supported. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Wiwi Forms – Form Builder” is open source software. The following people have contributed to this plugin. Contributors * [ Naiche ](https://profiles.wordpress.org/naiches/) [Translate “Wiwi Forms – Form Builder” into your language.](https://translate.wordpress.org/projects/wp-plugins/wiwi-forms) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/wiwi-forms/), check out the [SVN repository](https://plugins.svn.wordpress.org/wiwi-forms/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/wiwi-forms/) by [RSS](https://plugins.trac.wordpress.org/log/wiwi-forms/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.3 * Added: spam quarantine, Spam rules screen, confirmation-email guard. * Security: Editors can no longer edit forms; submission/proxy limits. * Fixed: upgrade could blank a form; CSV, resend, uninstall. #### 1.0.2 * Fixed: on a multi-step form, an optional field that failed a check once kept its error message for the rest of the form, even after the visitor had corrected it — and a screen reader kept announcing it as invalid. The check that skips fields already dealt with was looking at a mark left behind by an earlier attempt rather than at the current one. * Fixed: a field whose Custom ID contained a space had its error message detached from the field for screen-reader users, because the reference built from that ID was read as two names, neither of which existed. Custom IDs are now cleaned before the reference is built. * Fixed: on a multi-step form, errors that concern the whole submission — the rate limit, the honeypot, an expired form, submitting too quickly, a failed upload— were never shown. The message was inserted next to the first field, but on a multi-step form every field has already been moved inside a step, so the insertion failed and the visitor saw nothing happen at all. The message now appears at the top of the step the visitor is looking at. * Fixed: in the form builder, field labels on the canvas were clipped to a couple of characters on screens between 960 and 1200 pixels wide (a typical laptop at 1024). A missing breakpoint left the canvas with too little room; it now gets a proper width there. * Fixed: when the form itself checks a step before moving on, the errors it shows were visible but not announced — the field was not marked as invalid for assistive technology and the message was not linked to it, so a screen-reader user heard nothing. Those errors are now wired up exactly like the ones the server reports, and the marking is removed again once the field is corrected. * Fixed: the step indicator dots carried a label on an element that is not allowed to have one, which failed an accessibility check. They are now exposed as a list of steps, with the current step marked. #### 1.0.1 * Added: every submission is now scored for spam and the score is recorded with the entry, visible as a column in the entries list and as a breakdown of the signals that fired. Nothing is blocked, held back or filtered on that score in this release — it is recorded so the thresholds can be set from real data before anything acts on them. Existing behaviour is unchanged. * Security: files attached to a conditionally hidden upload field were stored without any of the field’s checks — allowed types, blocked types, size and count were all skipped. * Security: a solved captcha could be reused indefinitely. Each challenge is now single-use and expires, while still working behind full-page caching. * Security: decrypted copies of uploaded files could be left behind in the server’s temporary directory after an interrupted download or a mail failure. * Fixed: the encryption key is no longer derived from the WordPress salts, so rotating them no longer makes existing entries and uploads unreadable. Data saved before this update is still readable. * Fixed: auto-delete retention deleted the entry but kept its uploaded files on disk permanently. * Fixed: draft, private and trashed forms still rendered and accepted public submissions. * Fixed: a submission could report success after an uploaded file failed to save. * Fixed: exporting entries from more than one form labelled every row with the first form’s fields. * Fixed: the Apply button below the entries list did nothing. * Fixed: on multi-step forms, headings, separators and HTML blocks appeared on every step at once. * Fixed: the fallback used when JavaScript is unavailable submitted nothing. * Fixed: large uploads are encrypted in chunks instead of being held in memory whole. * Fixed: database changes are now applied when the plugin updates, not only when it is activated. * Changed: building forms now requires an administrator, matching the permission already needed to read submissions. * Removed: the entries search box, which could never match anything because entries are encrypted at rest. * Fixed: double-submit protection did nothing. The script disabled a hidden field that shares the submit button’s name instead of the button itself, so the button stayed live and a second click sent the form again — creating duplicate entries. * Fixed: behind a full-page cache, forms eventually stopped accepting submissions with “This form has expired”. The submit nonce is no longer written into cacheable HTML at all; JavaScript obtains it from the uncacheable token endpoint before submission, while the signed time token preserves the non-JavaScript path for public forms. * Fixed: the token refresh could be refused for a second visitor on the same network within five seconds, because the rate limit counted everyone behind one connection as one visitor. The limit now applies only to issuing new captchas, which is what it was there to protect. #### 1.0.0 * Initial release. ## Meta * Version **1.0.3** * Last updated **2 days ago** * Active installations **Fewer than 10** * WordPress version ** 7.0 or higher ** * Tested up to **7.1.3** * PHP version ** 8.4 or higher ** * Language * [English (US)](https://wordpress.org/plugins/wiwi-forms/) * Tags * [bootstrap](https://twd.wordpress.org/plugins/tags/bootstrap/)[contact form](https://twd.wordpress.org/plugins/tags/contact-form/) [encrypted](https://twd.wordpress.org/plugins/tags/encrypted/)[form builder](https://twd.wordpress.org/plugins/tags/form-builder/) [GDPR](https://twd.wordpress.org/plugins/tags/gdpr/) * [Advanced View](https://twd.wordpress.org/plugins/wiwi-forms/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/wiwi-forms/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/wiwi-forms/reviews/) ## Contributors * [ Naiche ](https://profiles.wordpress.org/naiches/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/wiwi-forms/)