Frontierline Forms – Confirmation & Multi-Step for Contact Form 7

Yes. Contact Form 7 5.7 or later must be installed and active. This plugin is an add-on for it.

No. Enable it under Settings -> General. It is off by default.

In your own WordPress database, in tables created by this plugin. Nothing is sent to an external service.

By default the premium version creates the key with the first encrypted submission and saves it in the WordPress options table as cf7mp_encryption_key. Since 2.2.0 you can keep the key outside the database instead: add define( 'FRONTIERLINE_FORMS_ENCRYPTION_KEY', 'a-long-random-string' ); to wp-config.php, or set an environment variable with the same name. Settings > Security shows where the key is, re-encrypts existing entries with the new key, and deletes the database copy once nothing depends on it (also available as wp frontierline-forms encryption status|reencrypt). When moving servers, move the key together with the database (or keep the same wp-config.php line). Encrypted entries cannot be decrypted without the key, not even by us. Only the submitted fields are encrypted; the IP address, user agent and referrer are stored as plain text.

Yes. Open Frontierline Forms -> MW WP Form Migration and convert each form with one click. Fields, validation rules, mail settings, and the input -> confirm -> submit flow are converted to Contact Form 7 automatically, and a report lists anything that needs manual review. The premium version can also import your saved MW WP Form inquiry data and convert all forms at once.

By default, no. Nothing is written to cookies or to localStorage. Temporary saving of entries is off by default. If you turn it on under Settings -> General, entries are held in sessionStorage only: they are removed as soon as the browser tab is closed, discarded after the time limit you set, and cleared once the form is submitted. Moving back from the confirmation screen keeps the entries either way, because the values simply stay in the form.

Yes. Use Contact Form 7's [file] tag as usual. The confirmation screen lists the selected file names, and the file is sent with the submission in the normal Contact Form 7 way. For security reasons browsers never let a script re-attach a file, so an uploaded file is not part of the temporary save.

The form itself is rendered by Contact Form 7, which handles caching plugins on its own. If your cache plugin serves the page to logged-out visitors from a static copy, exclude the pages that contain the form so that each visitor receives a fresh security token.

No. Deactivating or deleting the plugin keeps your saved submissions and settings, so nothing is lost by accident. To remove everything, back up your database first, then delete the tables whose names start with your table prefix followed by cf7mp_ (for example wp_cf7mp_submissions) and the options whose names start with cf7mp_.