Production checklist

OctaForms works out of the box, but a few production concerns decide whether leads arrive reliably. Go through this list before you depend on a form.

1. Run a real cron

WP-Cron only runs when someone visits the site, and some hosts starve it further with page caches. That delays delivery of anything not sent inline. Run a real system cron every minute:

wp octa-forms queue drain

This bypasses the WP-Cron machinery entirely. Site Health shows a red status when the queue worker has not run for 15 minutes or more. This is important enough to have its own page: Cron and the delivery queue.

2. Set up proper email

WordPress reporting “sent” only means your server accepted the message, not that it arrived. Use an SMTP plugin and send from a domain with valid SPF and DKIM. Set each form’s sender address to your own domain. Full details in Email deliverability.

3. Exclude the token endpoint from cache

Your page cache or CDN must not cache /wp-json/octa-forms/v1/token. The endpoint already sends Cache-Control: no-store, private, but your cache layer needs its own explicit rule. A cached token breaks submissions.

4. If you are behind a proxy or CDN

If your site sits behind Cloudflare or a similar proxy, the visitor’s real IP arrives in a header. For rate limiting and spam forensics to work correctly and safely:

• Set the client IP source in the settings.
• List your provider’s IP ranges as trusted proxies. Without this, the header is ignored, because otherwise anyone could spoof it.
• Firewall your origin so traffic can only reach it through the CDN.

5. Understand webhooks are at-least-once

If you use webhooks, the receiver must deduplicate on the payload’s id and verify the signature against the raw body. See Webhooks.

6. Large multisite networks

On very large networks, automatic per-site iteration is skipped during activation and uninstall. Use WP-CLI per site instead. Tables and cron events self-heal on each site as they are used.

Keep an eye on Site Health

OctaForms adds a dedicated “delivery queue” test to Site Health, covering the backlog, the worker heartbeat, the inline circuit breaker, and a loopback self-test of the token endpoint. Check it after going live, and it will tell you if any of the above is not set up right.