Ananyoo Accessible Forms – Contact Form & Entry Storage

If you switch on Sender & device details (Settings > Email), the notification you receive also lists the sender's IP address, browser, operating system, device type, language and referring page - all read from the request itself and already stored with the entry. An IP address is personal data in the EU and UK, so please mention this in your privacy policy before enabling it. Nothing is sent anywhere: the location link beside the IP is an ordinary link that your browser opens only when you click it. The look-up service can be changed with the ananyoo_aaf_ip_lookup_url filter.

No. The built-in honeypot and submission-time trap stop most bots without asking visitors to solve a puzzle, which keeps the form accessible. The plugin deliberately does not bundle a CAPTCHA, and never uses image-puzzle CAPTCHAs, which create barriers for many disabled visitors. If your forms attract heavy, targeted spam and you want an extra layer, the most accessible choice is Cloudflare Turnstile — in its "Managed" / interaction-only mode it verifies most visitors invisibly, with no puzzle to solve. Add it with a dedicated Turnstile plugin (for example, "Simple CAPTCHA Alternative with Cloudflare Turnstile"). See the next question for connecting it to these forms.

The easiest way is automatic. Install the free "Simple CAPTCHA with Cloudflare Turnstile" plugin (by RelyWP) and add your Turnstile keys. These forms then detect it and show the Turnstile challenge by themselves — no code, no shortcode. A failed or missing challenge is reported through the same accessible error summary as any other field, with the visitor's answers kept. You can switch this off under Ananyoo Accessible Forms → Settings. Importantly, this plugin still loads no third-party script itself; the companion plugin renders and enqueues the Turnstile widget. So this plugin makes no external requests on its own. Prefer a different CAPTCHA, or want full control? Two hooks are also available:

• do_action( 'ananyoo_aaf_before_submit', $form_id, $uid, $errors ) — fires just before the submit button, inside the form. Use it to output a verification widget.
• apply_filters( 'ananyoo_aaf_validation_errors', $errors, $raw, $fields, $form_id ) — return a non-empty name => message array to reject a submission. The message then appears in the accessible error summary and beside the form.

Install the Akismet plugin, add your API key under Settings → Akismet Anti-spam, then tick "Add Akismet spam filtering when the Akismet plugin is active" under Accessible Forms → Settings. It stays off until you tick it.

Not to make it work, but it is strongly recommended for deliverability. This plugin sends every email through WordPress's own wp_mail(), so notifications and confirmations send with no extra setup. However, default server mail is often marked as spam. For emails to land reliably in the inbox we recommend a free SMTP plugin such as WP Mail SMTP or FluentSMTP. It is optional — nothing here requires it — and the plugin shows a gentle, dismissible tip on its Settings screen if none is detected. Because delivery goes through wp_mail(), whichever SMTP plugin you already use handles it automatically.

No — and that is deliberate. Accessible anti-spam is built in (an invisible honeypot plus a submission-time trap, satisfying SC 3.3.8 Accessible Authentication), with optional Akismet, so most sites need no CAPTCHA at all and visitors never face a puzzle. Cloudflare Turnstile is offered only as an optional extra layer for sites hit by heavy, targeted spam; in its invisible "Managed" mode it verifies most people with no interaction. It is never required, and leaving it off keeps the form as accessible as possible. Akismet adds nothing to the form itself, so there is no puzzle and nothing changes for keyboard or screen-reader users. A submission Akismet thinks is spam is saved quietly under Entries with the Spam status — the visitor is never blocked and never shown an error. This is deliberate: if Akismet guesses wrong, a real person still gets through, and you simply find their message in the Spam view. If Akismet cannot be reached, the entry is saved as normal. Please note that when this is on, the submitted values are sent to Akismet, an outside service, to be checked. Please make sure your privacy policy says so. Developers can disable the integration with the ananyoo_aaf_use_akismet filter (return false), or adjust what is sent with the ananyoo_aaf_akismet_request filter.

Add a File upload field to your form in the builder. On its own that changes nothing on the front end yet: file uploads are off for the whole site by default, on purpose. Until you switch them on under Settings → File uploads, the field shows as disabled with a short note, and nothing can be uploaded — so a form is never an open door for unwanted files until you decide to accept them. When you are ready, tick "Allow visitors to upload files". Each File upload field has its own maximum size (2 MB by default) and its own list of allowed file types (PDF, DOC, DOCX, JPG, PNG, GIF, WEBP to begin with — change these on the field). Every uploaded file is checked on the server for size, extension and its real content type before it is saved, files are kept in a separate uploads folder, and each one appears as a link on the stored entry.

In the form builder, add a Step break where you want one step to end and the next to begin. The form is then shown one step at a time, with a numbered progress indicator, Previous/Next buttons, a spoken "Step X of N", and focus moved to each step as it opens. "Next" checks only the current step. If a visitor has JavaScript turned off, the whole form still appears and works as a single page, so nobody is ever locked out.

Open the form, and in the settings box on the right fill in Analytics event name, for example contact_form_submit (letters, digits and underscores, starting with a letter, up to 40 characters). From then on every stored submission of that form is reported to Google Analytics 4 under that name, with form_id, form_name and form_page as parameters. The plugin uses whatever Google code your site already has: gtag.js (Site Kit, or a tag added by hand) when present, otherwise Google Tag Manager's dataLayer, where you add a Custom Event trigger with the same name. In GA4, open Admin > Events, find the event after the first submission and mark it as a key event to count it as a conversion. A submission that the anti-spam quarantines shows the visitor the same thank-you message but is never reported, so spam does not inflate your numbers. Leave the field blank and nothing is sent to Google. Every stored submission also dispatches a JavaScript event on the page, whether or not an Analytics event name is set: document.addEventListener( 'ananyoo_aaf_submitted', function ( e ) { console.log( e.detail.formId, e.detail.formName, e.detail.page ); } ); And on the server, the ananyoo_aaf_after_submission action runs once the entry is stored: add_action( 'ananyoo_aaf_after_submission', function ( $entry_id, $form_id, $data, $status, $reason ) { /* pass $data to a CRM or webhook; skip when $status is ANANYOO_AAF_STATUS_SPAM */ }, 10, 5 );

No. By itself the plugin makes no external/HTTP requests and includes no analytics or tracking. The optional Analytics event name calls the Google Analytics or Tag Manager code already on your site and passes only the form's ID, name and page path. Two optional extras are the exception, and only if you switch them on: the Akismet check sends the submission to Akismet for a verdict (through the Akismet plugin's own connection and key), and a third-party CAPTCHA plugin such as Cloudflare Turnstile handles its own requests. Both are covered by their own privacy terms.

Yes. Every valid submission is saved as an entry before the email is sent, so a mail problem never loses a message.

Only if you choose to. The clean-uninstall option is off by default, so your forms and entries are kept. Enable it under Settings if you want everything removed on delete.