Security and privacy update: uploads and signatures are now private, signatures are validated, saving unfinished forms is off by default (switch it on per form), and only administrators can set webhooks.<\/p>","0.3.1":"
Security update: forms now include a nonce and uploads use the WordPress upload handler. If you use a caching layer that ignores no-cache headers, exclude pages that contain forms. Deleting the plugin now keeps your data unless the delete-on-uninstall setting is on.<\/p>","0.3.0":"
Adds a site-wide spam-protection setting, block styling options, and write-only secret keys. Review PubForms > Settings after updating: forms that did not choose a CAPTCHA now follow the site-wide setting.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3769628,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3769628,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3769628,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3769628,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":{"pubforms\/form":{"name":"pubforms\/form","title":"PubForms Form"}},"tagged_versions":["0.3.2"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3769628,"resolution":"1","location":"assets","locale":"","width":1054,"height":1013},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3769628,"resolution":"2","location":"assets","locale":"","width":685,"height":949},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3769628,"resolution":"3","location":"assets","locale":"","width":652,"height":864},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3769628,"resolution":"4","location":"assets","locale":"","width":1084,"height":167}},"screenshots":{"1":"The form builder with the template picker and colour-coded field cards.","2":"A published form on a page, protected by Cloudflare Turnstile.","3":"A dropdown field on a published form.","4":"The Entries overview for your forms."}},"plugin_section":[],"plugin_tags":[358,2253,601,396],"plugin_category":[42,54],"plugin_contributors":[289074,289075],"plugin_business_model":[],"class_list":["post-381825","plugin","type-plugin","status-publish","hentry","plugin_tags-contact-form","plugin_tags-form-builder","plugin_tags-forms","plugin_tags-privacy","plugin_category-contact-forms","plugin_category-security-and-spam-protection","plugin_contributors-pubtly","plugin_contributors-steveomics","plugin_committers-pubtly"],"banners":{"banner":"https:\/\/ps.w.org\/pubforms\/assets\/banner-772x250.png?rev=3769628","banner_2x":"https:\/\/ps.w.org\/pubforms\/assets\/banner-1544x500.png?rev=3769628","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/pubforms\/assets\/icon-128x128.png?rev=3769628","icon_2x":"https:\/\/ps.w.org\/pubforms\/assets\/icon-256x256.png?rev=3769628","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/pubforms\/assets\/screenshot-1.png?rev=3769628","caption":"The form builder with the template picker and colour-coded field cards."},{"src":"https:\/\/ps.w.org\/pubforms\/assets\/screenshot-2.png?rev=3769628","caption":"A published form on a page, protected by Cloudflare Turnstile."},{"src":"https:\/\/ps.w.org\/pubforms\/assets\/screenshot-3.png?rev=3769628","caption":"A dropdown field on a published form."},{"src":"https:\/\/ps.w.org\/pubforms\/assets\/screenshot-4.png?rev=3769628","caption":"The Entries overview for your forms."}],"raw_content":"\n
PubForms lets you build a form in the WordPress admin, drop it into any page with a shortcode or the PubForms block, and read the submissions in your own dashboard.<\/p>\n\n
Everything runs on your own server: no IP addresses or browser details are stored with entries. Nothing is sent to a third-party service unless you turn on Cloudflare Turnstile, hCaptcha or a webhook (see External services below).<\/p>\n\n
PubForms works fully on its own. It contacts an outside service only if you switch one of these features on.<\/p>\n\n
Used when you choose Cloudflare Turnstile under PubForms > Settings and save your Turnstile keys. A form then loads Cloudflare's script from Used when you choose hCaptcha under PubForms > Settings and save your hCaptcha keys. A form then loads hCaptcha's script from If you add webhook URLs to a form, each confirmed submission is sent as JSON to those addresses, which an administrator chooses. Uploaded files are not sent, only their names. Requests to private or internal network addresses are refused. What the receiving service does with the data is governed by that service.<\/p>\n\n The built-in question, trap field, rate limit, minimum fill time, link limit and blocked-words list all run on your own server and contact nothing.<\/p>\n\n\n In a table in your WordPress database. They are not sent anywhere else.<\/p><\/dd>\n WordPress sends mail through your server, which many hosts do not deliver reliably. Use an SMTP or transactional email plugin.<\/p><\/dd>\n It is built around privacy and simplicity: entries live in your own database, no visitor IP address or browser details are stored with them, there is no account or subscription, and spam protection works without any third-party CAPTCHA if you prefer. For rate limiting only, a one-way hash of the visitor's address is kept for an hour and never shown.<\/p><\/dd>\n No. The built-in question, hidden trap field, rate limit, minimum fill time, link limit and blocked-words list need no account. Cloudflare Turnstile and hCaptcha are optional and need their own free keys.<\/p><\/dd>\n Yes. Select the PubForms Form block and use the Layout, Form style and Colors panels in the sidebar. The shortcode takes the same options, for example Yes. Each form carries a security token (nonce) that expires, so pages that contain a form are sent with \"do not cache\" headers and flagged for the common caching plugins (WP Super Cache, W3 Total Cache, WP Rocket, LiteSpeed Cache and others). If your host or CDN caches pages regardless (for example a \"cache everything\" rule), exclude the pages that contain your forms, or visitors who load a stale copy will be asked to submit again.<\/p><\/dd>\n Yes. They are saved in Only if you turn it on, per form, with \"Save what a visitor has typed if they leave without submitting\" in the form's settings. It is off by default. When it is on, the form shows a short notice, and answers typed so far (never files or signatures) are sent to your own site after a pause or when the visitor leaves, and are listed under \"Abandoned\" in Entries. Check that this fits your privacy policy and local law before you enable it.<\/p><\/dd>\n Nothing, unless you ask for it. Forms, submissions and settings are kept by default. To remove them when the plugin is deleted, tick \"Remove all forms and submissions when the plugin is deleted\" under PubForms > Settings first.<\/p><\/dd>\n\n<\/dl>\n\n\nhttps:\/\/challenges.cloudflare.com\/turnstile\/v0\/api.js<\/code>, and the visitor's browser talks to Cloudflare to complete the check. When the form is submitted, your server sends the visitor's check token and your secret key to https:\/\/challenges.cloudflare.com\/turnstile\/v0\/siteverify<\/code> to confirm it. The \"Test these keys\" button on the Settings screen does the same for one test token. Terms: https:\/\/www.cloudflare.com\/website-terms\/ - Privacy policy: https:\/\/www.cloudflare.com\/privacypolicy\/<\/p>\n\nhCaptcha (optional CAPTCHA)<\/h4>\n\n
https:\/\/hcaptcha.com\/1\/api.js<\/code>, and the visitor's browser talks to hCaptcha to complete the check. When the form is submitted, your server sends the visitor's check token and your secret key to https:\/\/hcaptcha.com\/siteverify<\/code> to confirm it. The \"Test these keys\" button does the same for one test token. Terms: https:\/\/www.hcaptcha.com\/terms - Privacy policy: https:\/\/www.hcaptcha.com\/privacy<\/p>\n\nWebhooks (optional)<\/h4>\n\n
\n
\/wp-content\/plugins\/<\/code> and activate it.<\/li>\n\n
Where are submissions stored?<\/h3><\/dt>\n
Why are notification emails not arriving?<\/h3><\/dt>\n
How is PubForms different?<\/h3><\/dt>\n
Do I need a CAPTCHA account?<\/h3><\/dt>\n
Can I change how an embedded form looks?<\/h3><\/dt>\n
[pubforms id=\"123\" preset=\"soft\" layout=\"grid\" density=\"compact\" accent=\"#db2777\"]<\/code>.<\/p><\/dd>\nDoes PubForms work with page caching?<\/h3><\/dt>\n
Are uploaded files and signatures private?<\/h3><\/dt>\n
wp-content\/uploads\/pubforms\/<\/code> with random file names, behind a deny-all .htaccess<\/code> and an empty index.php<\/code>, and the plugin never links to them by URL. You open them from an entry in the admin, which checks that you are signed in and can edit the form. On a server that ignores .htaccess<\/code> (nginx, for example), block direct access to \/wp-content\/uploads\/pubforms\/<\/code> in the server configuration, or move the folder outside the web root with the pubforms_uploads_basedir<\/code> filter.<\/p><\/dd>\nDoes PubForms save what visitors type before they submit?<\/h3><\/dt>\n
What happens to my data if I delete the plugin?<\/h3><\/dt>\n
0.3.2<\/h4>\n\n
\n
wp_hash()<\/code>), the HTML field is filtered again when it is shown, and a note can only be saved on an entry of the form being edited<\/li>\npubforms_uploads_basedir<\/code> to keep uploads outside the web root<\/li>\n<\/ul>\n\n0.3.1<\/h4>\n\n
\n
wp_handle_upload()<\/code>) instead of move_uploaded_file()<\/code><\/li>\n0.3.0<\/h4>\n\n
\n
--pubforms-accent<\/code>)<\/li>\npubforms_notification<\/code> filter)<\/li>\n0.2.0<\/h4>\n\n
\n
0.1.0<\/h4>\n\n
\n