OZY Forms

OZY Forms is a complete form builder for WordPress. Conditional logic, multi-step forms, file uploads, digital signatures, calculations, payments, entry management and integrations are all included — there is no pro tier, no addon store and no feature locked behind an upgrade prompt. What it does

• Drag and drop builder with 48 field types, from plain text through to signatures, repeaters, calculations and product fields.
• Conditional logic with nested AND/OR groups, 15 operators and 10 actions. Evaluated in the browser for responsiveness and again on the server, which is what actually decides.
• Multi-step forms with 8 progress indicator designs, per-step server validation, and Save & Resume.
• Calculations using a spreadsheet-style formula language with 14 functions.
• Payments through Stripe, PayPal, Razorpay, Square, Mollie or Authorize.Net. Card details are entered into the provider's own iframe and never touch this site.
• Built-in SMTP for 11 providers, so a separate mail plugin is not required. Queued delivery, retries with backoff, and a delivery log.
• 20 email designs plus a template library, autoresponders and conditional routing.
• AI features — generate a form from a description, summarise and tag submissions, find themes across responses, generate email templates. On WordPress 7.0 and later these run through the AI Client in core, so whichever provider you connect once under Settings → Connectors is the one they use. On older versions, or if no connector is set up, you can save your own key for OpenAI, Anthropic, Groq, Gemini or Mistral instead.
• Migration from Gravity Forms, WPForms, Fluent Forms, Formidable, Contact Form 7, Ninja Forms, Forminator and Everest Forms — read-only, with a preview and a full undo.
• 30 integrations including Zapier, Make, Mailchimp, HubSpot, Google Sheets, Airtable, Notion, Slack, Discord, Telegram, Twilio, Trello, Asana, ClickUp, monday.com, Salesforce, Zoho, Pipedrive and generic webhooks.
• Page builders — Gutenberg block, Elementor, Divi, WPBakery, Beaver Builder, Oxygen, Bricks, Avada, Brizy, plus a shortcode and a classic widget.

You decide what gets stored Most form plugins save every submission to your database and never mention it. OZY Forms tells you what it keeps, per form, and lets you change it. New forms store submissions, so the entry list, exports, analytics and AI insights all work immediately. Any form can be switched to email-only or metadata-only in its Data & Privacy tab — and before that change is applied, the plugin shows you exactly which features it turns off, which ones keep working, and confirms that existing entries are untouched and the change is reversible. Alongside that, each form controls whether IP addresses are stored at all (off, hashed, or full — hashed by default), whether browser and referrer details are kept, and whether entries are deleted or anonymised automatically after a set number of days. The plugin also contributes accurate text to your site's privacy policy draft, generated from how your forms are actually configured rather than a fixed claim. Privacy and external services Out of the box, OZY Forms contacts nothing. Every external service listed below is opt-in and requires you to supply your own credentials. There is no telemetry, no phone-home and no tracking of any kind.

1.0.9

• Fixed a crash that blanked the Entries screen. The list rendered each entry's preview, which the search endpoint returns as a set of value rows, as if it were a string; React refused it and took the whole screen down. Any site with at least one stored submission hit this. The preview is now joined into a readable line.
• Email smart tags such as {field_3} resolve again. The field lookup they read was built with wp_list_pluck() and a null field, which returns a row of nulls rather than the fields themselves, so every tag fell through and was delivered as literal text. The same call broke CSV entry import, which skipped every mapped column.
• Front-end submissions no longer report failure when they have in fact succeeded. The lookup above also emitted PHP warnings, and on a site that displays errors those were printed ahead of the JSON response, so the browser could not parse the reply and showed the validation error instead.
• Choice, lookup and product fields no longer pass null to strlen(), deprecated since PHP 8.1. The same pattern was corrected in CSV import and in the conditional logic evaluator.
• The Analytics screen no longer requests form_id=0 before the form list has loaded, which answered 404 on every visit.
• Removed a stray aria prop on number settings that React warned about.

1.0.8

• Corrected four dead links in the External Services list. Constant Contact's terms moved to /legal/terms, GetResponse's terms are served from /legal, and Notion's terms and privacy policy are now linked at their current addresses. Every link in the readme was checked with a request, not by eye.
• The entries shortcode now passes each field value through wp_kses_post() before it is returned, so the value is escaped at the point of output rather than relying on the field type that produced it.

1.0.7

• CAPTCHA now works end to end. Site and secret keys have a place to be entered, under Settings → Spam protection keys; the provider's widget script is loaded on pages that render the field; and the token is verified with the provider before a submission is accepted. reCAPTCHA v2 and v3, hCaptcha and Cloudflare Turnstile are supported. Previously the field always fell back to the maths question because there was nowhere to save keys.
• The site-wide CAPTCHA choice now matches the values the field understands, so picking a provider on the settings screen has an effect.
• Akismet checking is implemented. The key is entered on the same screen and confirmed with Akismet before it is stored, and submissions are checked before they are stored, ahead of the AI classifier.
• The readme now names the scripts a page loads from a payment or CAPTCHA provider, separately from the endpoints this site calls itself.
• Added a Plugin URI to the plugin header.

1.0.6

• AI features now go through the AI Client in WordPress 7.0 when a connector is set up, so the provider and its credentials are chosen once at site level and shared by every plugin. Saving a key directly for OpenAI, Anthropic, Groq, Gemini or Mistral still works, and is what older WordPress versions use.
• Removed the per-form custom CSS box. WordPress has its own CSS editor in the Customizer and the Site Editor, and the directory no longer allows plugins to store arbitrary CSS.
• A form’s generated design CSS is now enqueued through wp_add_inline_style() instead of being printed as a style tag next to the form.
• The behaviour metadata a form passes to the front-end script moved from an inline JSON script tag to a data attribute.
• Analytics events now carry the form nonce and are rejected without it.
• Uploaded file names and MIME types are sanitised as they are read, before anything else looks at them.
• Every REST route names its permission callback inline, so what guards each endpoint is readable at the point of registration.
• The readme now lists the terms and privacy policy of every external service, one by one.
• The author URI points at ozysolutions.com.

1.0.5

• Tested against WordPress 7.1.
• The block preview now carries the form stylesheet. WordPress 7.1 always serves the post editor inside an iframe, which no longer inherits front-end styles, so the stylesheet is declared on the block itself.
• The AI Generator uses the full screen. On a wide display the composer and the provider keys sit side by side instead of stacking in a narrow column.
• The settings screen fills the width, laying the groups out in columns instead of one long strip.
• The Email & SMTP screen puts the sending provider and the test message next to each other.

1.0.4

• Rebuilt the field settings panel. It now renders the settings each field type declares, so the colour picker, image and icon choices, rating, slider, option scale, signature, repeater, field group, hidden, lookup, post, chained dropdowns, calculation, payment, total, product, HTML, heading, section and page break fields all have their own controls instead of the same four generic ones.
• Added an options editor that carries per option images, icons, prices and default selections, with the WordPress media library behind the image picker.
• Added nested field editing for the repeater and field group, level and dataset editing for chained dropdowns, and a data source picker for hidden fields.
• Fixed the white screen on the Email & SMTP screen. Choosing a provider tried to render its setup guidance, which is a structured object, as plain text and took React down with it.
• Fixed the choice list appearing on fields that have no choices, such as the option scale and the slider.
• Fixed analytics reporting zero views, starts, conversion, completion and abandonment. Views are now recorded when a form is rendered and the page reports starts, field activity, submissions and errors back.
• Added the front-end behaviour several fields were rendering markup for but never received: signature drawing, the slider readout, the rating readout, repeater rows, chained dropdown refills, searchable dropdowns, colour swatches, quantity steppers, the password reveal and strength meter, the character counter, input masks and upload drag and drop.
• Fixed the colour picker ignoring the required rule. A native colour input always reports a value, so an untouched field now stays genuinely empty.
• Added image and logo selection, alternative text, sizing and divider colour to the email template blocks.
• Fixed a page break at the end of a form producing an empty final step.
• Options, transients, tables and request keys moved from the of_ prefix to ozyf_. of_ is short enough to belong to something else on the same site. Stored data does not carry over, so deactivate and reactivate after updating.
• Translations load through WordPress instead of load_plugin_textdomain(), which fired too early to be useful.
• Every directory carries an index.php, so a server with directory listing enabled cannot enumerate the plugin.
• The bundled translation template was several releases out of date and now covers every string.

1.0.3

• Fixed the fatal error that broke every page holding a form. Form_Renderer called a method that was never written, so the shortcode, the block, the widget and every page builder element crashed with "There has been a critical error on this website".
• Wired the shortcode's ajax attribute through to the renderer.
• Removed a byte order mark from readme.txt.

1.0.2

• Replaced the blue accent throughout the admin screens with the OZY Solutions palette.
• Added the "OZY Default" colour preset and made it the default for new forms.
• Front-end forms now start from the brand palette instead of the old blue.
• Rebuilt the settings screen as aligned rows with an explanation under every option, and replaced the checkboxes with toggles.
• Fixed the privacy, honeypot and credit-line defaults, which were shown on the settings screen but never applied to new forms.
• Removed the "Analyse entries automatically" option, which had no implementation behind it.
• Added a settings reference to the documentation.
• Added AI provider key management, so Groq, Gemini, Mistral, OpenAI and Anthropic keys can be entered, tested and removed from the AI Generator screen.
• Added an Email Templates screen exposing the twenty shipped templates with live previews.
• Added a block based builder for custom email templates.

1.0.1

• Built the entries, templates, AI generator, analytics, email, payments, integrations, migration, settings and help screens.
• Added settings, analytics, email, payment and integration REST routes, including credential entry for gateways, services and SMTP providers.
• Fixed admin requests losing the ozy-forms/v1 namespace, which made every screen load forever.
• Failed requests now report the reason instead of leaving a screen on "Loading".
• Scripts and styles are versioned by file modification time so updates are not served from cache.

1.0.0

• First release.