Safe forms for WordPress

Why OctaForms

Most form plugins are page builders with a form attached. OctaForms is the opposite. There is no drag-and-drop builder on purpose. You get clean, fast forms and a delivery engine you can trust. The whole front end is under 10 KB of JavaScript and CSS over the wire, gzipped, and it never blocks your page from rendering.

No submission is ever lost

Every submission is queued before the visitor sees “thank you”. The first email tries inside the request. Anything that fails is retried by cron with backoff. Nothing is silently dropped.

Spam filtering without collateral

A honeypot that quarantines suspected spam instead of deleting it, so you can recover a real lead. Rate limiting that never punishes a busy office behind one IP.

Privacy built in from day one

Consent snapshots on every submission, IPs stored only as a hash, and full support for the native WordPress export and erase tools.

Lightweight and non-blocking

One small script and one stylesheet, loaded in the footer and never render-blocking. No framework, no jQuery, no page-speed tax.

Two ways to use it

Ready to use, no code

Drop [octa_form slug="…"] on any page or widget area and you have a working form. A starter contact form is created for you on first run. Want a floating contact button? Turn on the widget for phone, callback and message tabs.

Built for developers

Render your own markup and drive a small REST API: a token endpoint and a per-form submit endpoint. Form definitions live as validated JSON. Add your own validation rules with a filter. An optional vanilla JS helper handles the whole token and retry contract for you.

Reliable delivery

OctaForms puts durability before timeliness. Every delivery is saved to a queue before the visitor gets a response. The first email attempt runs inside the request behind a circuit breaker. Anything that fails is retried by cron with exponential backoff. Every protection and every degradation leaves a trace you can read in the admin or in Site Health.

Delivery goes out by email, autoresponder and HMAC-signed webhook. Webhooks are at-least-once and re-check DNS before every send to block SSRF.

How delivery worksThe queue, the inline attempt, the circuit breaker and retries.

Signed webhooksPayload shape, the signature header and SSRF protection.

Anti-spam that keeps your real leads

Aggressive spam filters lose real people. OctaForms is built so that never happens quietly.

Quarantine, don't delete

Suspected spam is stored, not dropped. Review it in Submissions and recover a genuine lead. A sudden spike usually means autofill, not attackers.

Two-counter rate limiting

A flood of requests earns a short, temporary ban. A burst of genuine submissions from one office network gets a polite “try again shortly” instead.

A stateless signed token

Adds deduplication, a time trap and a JavaScript requirement. It is a helper, not your main defence. The honeypot and rate limiting are.

Atomic deduplication

A double click returns the same submission, and each delivery goes out exactly once.

Read the anti-spam guideHow the honeypot, rate limiting and token work together.

GDPR and privacy

Consent snapshots

Each submission stores the consent field, the exact text that was shown, the value and the time.

Hashed IPs only

The visitor IP is kept only as a hash for spam forensics. It never leaves your site, and it is not in webhooks or exports.

Export and erase

Full integration with the WordPress personal data tools, covering both submissions and their delivery records.

Retention with cleanup

Automatic cleanup, global or per form. CSV export is hardened against spreadsheet formula injection. Optional full data removal on uninstall.

Privacy & GDPRConsent snapshots, retention, exports and erasure.

Start here

Getting startedInstall, create your first form and put it on a page.

Three ways to add a formShortcode, JS helper, or your own JavaScript against the REST API.

The config JSONFields, validation, emails, webhooks and settings in one place.

Production checklistCron, email deliverability, caching and proxies done right.