Ultimate Form – Multi-Step Form Builder, Conversion Analytics & Lead Forms
| 开发者 | desktopmoe |
|---|---|
| 更新时间 | 2026年7月2日 22:34 |
| PHP版本: | 8.0 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Ultimate Form is a powerful, free form builder for WordPress — and the only one with a built-in, privacy-first conversion dashboard that shows you exactly where visitors drop off, so you can fix the steps and fields that cost you leads.
Build multi-step funnels, add conditional logic, collect file uploads, send email notifications and manage every submission — all from one plugin with no limit on the number of forms, fields or entries. No cookies, no account, no upsell wall around the basics.
Why Ultimate Form?
- It's genuinely unlimited — unlimited forms, steps, fields and submissions in the free version.
- You can see what's working — most form plugins collect entries; Ultimate Form also tells you your conversion rate, your funnel and your worst-performing fields, with zero personal data.
- It looks good out of the box — a clean, modern form with floating labels, a clear focus ring and a consistent brand colour system across the whole plugin.
- It respects privacy by design — hashed entry IPs (salted SHA-256), cookieless analytics with no IP at all, Do-Not-Track support and a consent-checkbox generator.
- Drag & Drop Builder with 25+ field types (text, email, phone, textarea, select, radio, checkbox, multi-select, date/time, number, currency, URL, password, rating, range slider, color, file upload, multiple files, name, address, ZIP lookup, repeater, calculator, CAPTCHA, ...)
- Multi-Step Forms with a configurable progress bar and step navigation
- Form Analytics — privacy-first conversion dashboard: views, start & conversion rate, step funnel, step-abandonment, field drop-off, validation hotspots, device & traffic source — no cookies, no IP, fully anonymous
- Conditional Logic — show/hide fields and steps based on previous answers
- File Uploads — single and multiple file fields with type and size validation; uploads appear as download links in each entry
- Email Notifications — per-form templates for customer, admin and custom recipients
- Design Configurator — live preview for colours, typography, spacing and logo
- Entries Management — view, search, filter, star, paginate and export submissions as CSV
- Save & Continue — visitors can resume a long form where they left off
- Webhook Integration — send form data to any external URL via HTTP POST
- Honeypot Spam Protection — invisible spam protection on every form
- GDPR Compliant — hashed entry IPs, cookieless analytics with no IP, consent-checkbox generator, optional Strict GDPR mode
- Translation Ready — every user-facing string is translatable
- Shortcode Embed —
[ultimate_form id="X"]works with any theme or page builder - Elementor Widget — a dedicated widget to drop any form straight into your Elementor layouts
- Iframe Embed — embed a form on external, non-WordPress websites with a ready-to-paste iframe snippet
- Stripe & PayPal payment processing
- WooCommerce integration
- CRM integration (Brevo, HubSpot, ActiveCampaign, Pipedrive, Salesforce, Mailchimp)
- Native PDF generation from submissions
- Telegram, Discord & Slack notifications
- Zapier / Make automation
- Form cloning, A/B testing, submission limits
- GDPR data export & erasure tools
- Signature field
- Priority support
安装:
- Upload the plugin files to the
/wp-content/plugins/ultimate-formdirectory, or install via Plugins > Add New. - Activate the plugin through the Plugins menu in WordPress.
- Go to Ultimate Form in the admin sidebar to create your first form.
- Use the shortcode
[ultimate_form id="1"]to embed forms on any page or post.
屏幕截图:
常见问题:
How many forms can I create?
There is no limit. You can create and publish as many forms as you need. The free plugin has no form quotas, time limits or feature gates.
Can I build multi-step forms?
Yes. Add as many steps as you like and turn on the progress bar. Visitors can move back and forth, and conditional logic can even skip whole steps based on earlier answers.
Can visitors upload files?
Yes. The free version includes single and multiple file-upload fields with file-type and size validation. Uploaded files are stored in your Media library folder and shown as download links on each entry.
Does conditional logic work on the free version?
Yes. You can show or hide individual fields and entire steps based on what the visitor selected earlier — no Pro upgrade required.
What does the Form Analytics dashboard show?
Views, start rate, conversion rate, average time to complete, a step-by-step funnel, step-abandonment, the fields where people drop off, and device and traffic-source breakdowns — all anonymous and aggregated, with no cookies and no IP storage.
Can I export my submissions?
Yes. Entries can be searched, filtered and exported to CSV (UTF-8, spreadsheet-safe) at any time.
Is the plugin translation ready?
Yes. Every user-facing string is wrapped for translation, so you can localise the plugin into any language.
Does the plugin send data to external servers?
By default, no. All form submissions are stored in your WordPress database. The plugin does not contact any external server unless you explicitly enable and configure the Webhook addon. See the "External Services" section for full details.
Is it GDPR compliant?
Yes. IP addresses in form entries are hashed with a salted SHA-256 (not stored raw, irreversible), and the analytics never store an IP at all. A consent checkbox generator is included, and an optional Strict GDPR mode enforces hashing, drops the user agent and pauses analytics. No data leaves your server unless you explicitly enable an external integration.
Which page builders are supported?
The shortcode [ultimate_form id="X"] works with Gutenberg, Elementor, Divi, Bricks, Beaver Builder, Oxygen and the classic editor. A dedicated Elementor widget is included as well, and you can embed forms on external (non-WordPress) sites via the built-in iframe embed.
What are the minimum requirements?
WordPress 6.0+ and PHP 8.0+. Recommended: WordPress 6.4+ and PHP 8.1+.
Is there a Pro version?
Yes. Ultimate Form Pro adds payment processing, WooCommerce integration, CRM connections, PDF generation and more. The Pro version is hosted separately on the author's website and is NOT included in or required by the free plugin distributed via WordPress.org. Visit delta-web-solution.de for details.
更新日志:
2.9.3
- New: Choice fields (card style) can show a subtitle under each option title.
- New: "Card — auto-advance" style advances to the next step on selection (opt-in).
- New: Choice cards can carry an icon — pick from a built-in icon set, or use an emoji, image URL or inline SVG — with an optional left-aligned icon layout.
- New: Optional always-visible "Back" button at the top of each step for multi-step forms (shortcode back_top="1") — visitors can always go back, handy for auto-advance funnels.
- New: The Back button is now independently stylable in Design → Buttons (background, label colour, border), and the Submit / Next / Back button text can be set there too.
- Fixed: Conversational mode again shows one field at a time (a CSS rule made every field-step — each with its own Back button — display at once).
- New: Self-hosted web fonts (Newsreader, Hanken Grotesk) — loaded locally and only when a design actually uses them. No request to Google's servers, so no visitor IP is shared (GDPR-friendly by default).
- New: Bundled "PrivatSafe" premium funnel design (warm/serif look) you can drop into Design → Custom CSS; scoped so it never affects your other forms.
- Improved: Accessibility — ARIA labels on file, CAPTCHA, address and ZIP-lookup fields, keyboard focus moves to the active step when navigating, and aria-invalid is set on rating and signature fields for screen readers.
- Improved: Right-to-left (RTL) layouts now honour every design token (checkbox sizing, focus ring, required colour), so RTL forms match the left-to-right layout exactly.
- Internal: opt-in diagnostics tracker and groundwork for multiple design profiles — both disabled by default, no change to existing forms.
- Security: Stripe test mode is now enforced end-to-end — no real charge can be created while test mode is on.
- Security: WooCommerce add-on surcharges are locked in at submission, so the amount charged always equals the amount shown (no drift if option prices change mid-checkout).
- Security: Payments now verify the captured currency against the server-computed currency (not only the amount), on both Stripe and PayPal.
- Security: Priced option fields are frozen during payment, so a last-moment change can't make the charge differ from the displayed total.
- Security: Imported form data is sanitized on import (step titles/descriptions) and malformed conditions are skipped — defence-in-depth for hand-edited or imported forms.
- Fixed: Multi-step screen-reader progress ("Step X of Y") stays in the site language after navigating between steps.
- Fixed: Open/close schedules and entry limits now fire at the intended local time even when the server timezone differs from the site timezone.
- Fixed: A confirmation redirect set to a site-relative path (e.g. /thank-you) is no longer cleared when the form is re-saved.
- Security: Payment amount verification now fails closed when the expected-amount token is missing or expired (Stripe & PayPal) — a tampered or unverifiable charge amount is rejected instead of being accepted.
- Security: Hardened value deserialization during form duplication (no object instantiation from stored data).
- Security: Frontend hardening — server and translation strings are HTML-escaped before insertion (defence-in-depth against DOM-based XSS).
- Fixed: Save & Continue reliably stores entered values again (a scope error had silently disabled browser-side draft saving entirely).
- Fixed: A failed submission no longer triggers notification emails or webhooks for a non-existent entry.
- Fixed: The notification preview now matches the email that is actually sent (per-profile content mode).
- i18n: Additional admin strings are now translatable; the German (de_DE) translation was completed.
- Fixed: "The form has expired" on cached sites — the anti-spam time token is now set client-side, so page caches (WP Rocket, Cloudflare) no longer freeze it.
- Fixed: "Security token invalid" on heavily cached sites — the submit nonce is refreshed from an uncached endpoint and auto-retried, so forms keep working even when the page has been cached for over a day.
- Fixed: Math CAPTCHA on cached sites — the CAPTCHA token is now cache-safe and no longer fails for every visitor once the page cache outlives the old token.
- Fixed: Saving the form title from the builder toolbar — the toolbar Save now persists the title, description and status (previously the toolbar/Ctrl+S save only stored field changes; in some setups it even navigated to a blank page).
- Fixed: Success-window check icon not showing — the checkmark is now visible even when its draw animation does not run (power-saver, some mobile browsers).
- Fixed: Math CAPTCHA hardening — the answer token is now bound to the form and validated from the form schema, so the check can no longer be skipped by omitting the token field.
- Fixed: Clearing the form title in the builder no longer overwrites the saved title with an empty value.
- Fixed: Design "Reset" no longer fired a duplicate confirmation dialog.
- Fixed: Field widths on mobile — text areas, checkboxes and full-width fields now span the full width like text inputs.
- New: Modern success window after submitting — animated checkmark with separate heading + description fields (Settings → After submission).
- New: Per-device design tokens — tune font sizes, spacing and button sizes separately for tablet and phone in the Design editor.
- Improved: "Save & Continue" now uses sessionStorage with a 12h limit and an opt-out setting (privacy/GDPR).
- Improved: Email preview shows true device widths (Desktop/Tablet/Mobile).
- Improved: Server-side required-field validation hardened (respects conditional logic).
- New: Per-form SMTP routing — assign different mail servers to different forms via Settings → SMTP → "Per-profile SMTP accounts" and the new "Send via" picker in each email profile.
- New: Failover SMTP — if a primary account fails, a configured backup account delivers automatically. Recovery events are logged in Settings → Email Settings → Deliverability.
- New: Drag any form field directly onto a different step-tab in the form builder toolbar to move it across steps.
- New: Colour picker now has a transparency slider that fades the picked colour toward white.
- Improved: SMTP account host is now required on save (server-side validation prevents broken rows).
- Improved: Mail-error log entries distinguish between hard failures and successful failover recoveries.
- Improved: Existing global SMTP settings are automatically migrated into a "Default SMTP" account on update.
- Fixed: Stale wp_mail_failed reasons no longer leak between consecutive sends.
- Fixed: Elementor widget — removed the broken "field layout / 2 columns" option that forced fields to full width. Forms now render consistently in a single column; use per-field widths (½, ⅓ …) for multi-column rows.
- Improved: form is reliably capped to your configured max width and centered, even inside full-width Elementor sections; verified zero horizontal overflow from phone to desktop.
- New: 6 refined design presets in the Design Configurator (Ocean Navy, Sky Blue, Cyan Tech, Royal Purple, Sunset Orange, Slate Pro) — Ocean Navy is the default theme.
- New: Guided 3-step onboarding on the dashboard to help you set up your first form, email and spam protection.
- New: Adjustable textarea height — set the number of rows (1–10) per textarea field in the builder.
- Performance: form assets now load only on pages that actually contain a form, and CSS/JS are shipped minified — faster page loads across your whole site.
- Improved: single-step forms no longer show a redundant "Step 1" heading.
- Improved: import is now available directly from the empty Forms screen (templates & bundles).
- Improved: consistent default colour scheme across the form, design and email screens.
- Fixed: textarea fields no longer rejected on submit when longer than their row count.
- New: Email Profiles — reusable email setups (customer + admin notifications) with a live preview, configurable colours and an optional header gradient picker.
- New: Modernised field inspector — settings are now grouped into clean cards (Field basics · Behaviour & display · Custom CSS) with rounded, consistent inputs.
- New: Design configurator improvements and a shared custom colour picker across the design and email screens.
- Improved: Accessibility — visible keyboard focus rings across the builder, design and frontend form.
- Fixed: Form submission reliability — the submission endpoint is now registered independently of optional integrations, so every form submits correctly.
- Fixed: the {field:email} placeholder in the email "To" field is now preserved on save.
- Fixed: field-palette category icons and several admin UI polish issues.
- New: File uploads now work end-to-end — single and multiple file fields upload to your Media library folder (with file-type and size validation) and appear as download links on each entry.
- New: Repeater and ZIP lookup fields are now available directly in the builder's field palette.
- Fixed: conditional logic now supports every operator (equals, not equals, contains, greater/less than, starts/ends with, is empty / is not empty) for both field-level and step-level rules, and re-evaluates correctly across steps.
- Fixed: required validation for multi-checkbox groups, plus minimum/maximum character-length checks on text fields.
- Fixed: Entries screen now supports search, status filtering and pagination, and the CSV export is hardened against spreadsheet formula injection.
- Fixed: the Design configurator no longer loses a custom font family on save, and the "Reset" button restores the true defaults again.
- Fixed: Save & Continue is now stored per form and clears automatically after a successful submission.
- Improved: textarea line breaks are preserved in stored entries; the form focuses the first invalid field; double submissions are blocked; and several remaining hardcoded strings are now translatable.
- Fixed: saving the General settings tab no longer wipes the Email-template settings (and vice-versa) — each tab now saves only its own fields. This also stops the admin notification address and the honeypot/analytics toggles from being reset.
- Fixed: the "Confirmation message" and "Redirect URL" fields are visible again on the Settings screen (a broken script kept both rows hidden).
- Fixed: "Redirect to URL" after submission now actually redirects (the saved option was read under the wrong name).
- Fixed: spam protection no longer blocks legitimate submissions on forms that contain an unrelated field whose name ends in "_token".
- Fixed: leaving a field's min/max length empty in the builder now means "no limit" again instead of forcing it to 0.
- Fixed: importing a form/template with incomplete conditional-logic rules no longer creates broken rules or warnings.
- Fixed: entry detail no longer double-encodes form titles that contain "&" or special characters.
- Improved: a saved global e-mail heading is now used for customer confirmations; hardened a few output paths against PHP 8.1 notices.
- Fixed: floating labels now display correctly on the public form — the field label sits inside the field as a placeholder and lifts up on focus/fill (a bulletproof CSS rule was forcing the label to stay bold and static on forms that use the Design configurator).
- Fixed: removed a broken script on the form editor screen that threw a JavaScript console error (a stray template artifact).
- Fixed: creating a form from a template now generates a clean slug (e.g. "contact") instead of carrying the internal template prefix (e.g. "tpl_contact").
- Fixed: the form-editor preview button now reads "Submit" instead of a leftover checkout label.
- New: Step-abandonment analysis in Form Analytics — a visual funnel showing exactly which step visitors reach before leaving an unfinished form, with the drop-off rate and the field they last touched at each step.
- Improved: clearer "where visitors stop" reporting to pinpoint the steps and fields that cost you conversions.
- New: Form Analytics — a privacy-first conversion dashboard. See views, start rate, conversion rate, average time-to-complete, a step-by-step funnel, where visitors drop off, which fields throw the most errors, plus device and traffic-source breakdowns. No cookies, no IP, no personal data — anonymous and aggregated, with an automatic data-retention cleanup and a Do-Not-Track option.
- New: privacy controls under Settings → "Analytics & privacy" (enable/disable tracking, honour Do-Not-Track, set retention days).
- Design: the public-facing form is fully redesigned — modern floating labels that sit inside each field and lift up on focus, softer inputs, a clearer focus ring, and primary buttons with subtle depth and a smooth hover lift.
- Added: a trust line under every form ("Spam-protected · GDPR-compliant").
- Improved: the entire plugin (admin + frontend) now shares one consistent brand colour system.
- Fixed: the focus ring and the red "invalid field" border are reliably visible again (a defensive style reset was hiding them).
- Maintenance: uninstall now also removes view counters, analytics tables, the retention cron and orphaned per-field options.
- Note: floating labels apply to text, email, phone, URL, number, password, textarea, select and date/time fields; choice, file, rating and composite fields keep their static labels for clarity and accessibility.
- Design: unified the entire admin colour scheme to a single brand blue (previously 5 different blue tones were mixed across screens)
- Design: redesigned the "Create New Form" screen — colourful template icons, a feature highlight bar, a clear "start from scratch" entry, hover states and full-width gallery
- Improved: template meta now uses correct singular/plural ("1 step" vs "3 steps") and is fully translatable
- Improved: replaced inconsistent emoji template icons with crisp inline SVG icons
- Fix: creating a form from a template now opens the editor correctly instead of a blank screen (import routine now returns the new form ID)
- Fix: the email template editor now saves all fields — greeting, footer, recipient, CC, BCC, custom HTML and field selection were previously discarded on save
- Fix: conditional logic rules are now stored correctly (the save handler read the wrong field keys, so rules were saved empty and never applied on the frontend)
- Fix: the password field strength meter now renders and works (a duplicate switch case had disabled it)
- Improved: admin notification emails now set Reply-To to the submitter's address, so replying goes straight to the lead
- Improved: deleting a form now also removes its entries, entry fields and view stats (no more orphaned rows)
- Security: email From header is stripped of CR/LF to prevent header injection via stored settings
- Maintenance: removed non-WordPress.org contributor handle from the Contributors header (silences the import warning shown only to plugin authors)
- Compliance: radio-card label now escapes the raw option value via
esc_html()at the output site (no longer relies on a pre-escaped variable Plugin Check cannot trace) - Compliance: the TTL-preserving rate-limit counter increment on
wp_optionsnow carries an explicit Plugin Check annotation explaining why the transient API cannot be used here
- Compliance: added
/* translators: */annotations to every__()/esc_html__()call that uses placeholders (Plugin Check requirement) - Compliance: replaced
rand()withwp_rand()in the math-captcha renderer - Compliance: every
wp_redirect()in admin page callbacks replaced withwp_safe_redirect() - Compliance: explicit output escaping for
$total_unreadand radio-cardaltattributes - Compliance:
error_log()debug calls gated behindWP_DEBUG+WP_DEBUG_LOG(no production logging) - Documentation: class-level PHPCS justifications added to
UltimateForm_AdminandUltimateForm_Form_Managerexplaining the plugin's custom-table architecture, the nonce-verification helper indirection, and the intentional cache bypass
- Fix: registered the public REST route
ultimateform/v1/checkoutthat the frontend form engine posts submissions to (this route was previously only shipped with the Pro edition, which left the free version unable to submit forms) - Improved: client IP resolution falls back through CF-Connecting-IP, X-Forwarded-For and REMOTE_ADDR, with strict IPv4/IPv6 validation
- Improved: confirmation message is now passed through
wp_kses_post()before output
- Hardened output escaping in the upgrade comparison table (per-cell if/else instead of conditional echo expressions)
- Field renderer attribute output split into separate echo statements with explicit per-line phpcs annotations
- Security: added nonce verification to the entry-detail admin screen before marking an entry as read (prevents CSRF state changes via crafted GET URLs)
- Compliance: removed the Plugin URI header (no broken external link in the directory listing)
- Compliance: contributor list now includes the WordPress.org account that owns the plugin
- Security: recursive sanitization for all JSON-decoded administrator inputs (logic, conditions, visible_fields, import payloads)
- Security: all REST endpoints use a custom permission callback with rate limiting (no
__return_true) - Compliance: removed
load_plugin_textdomain()call (WordPress 4.6+ auto-loads translations) - Compliance: every PHP file with executable code starts with an
ABSPATHdirect-access guard - Compliance: file/path resolution uses
plugin_dir_path(),plugin_dir_url()andwp_upload_dir()only (no hardcodedsite_url()→ABSPATHstring replacements) - Documentation: External Services section expanded with per-service data flow, destination and provider information
- Documentation: clarification that the free plugin contains no license server calls or telemetry of any kind
- Security: replaced permissive permission callbacks with nonce validation and IP rate limiting on all REST endpoints
- Improved: inline scripts and styles replaced with properly enqueued assets via
wp_enqueue_script()/wp_add_inline_script() - Improved: all administrator-facing output properly escaped via
esc_html(),esc_attr()andesc_url() - Plugin version constant updated throughout
- Split save button: Save as Draft vs Publish in form editor
- Toast notifications redesigned (fixed full-width banner bug)
- Delete form action fixed (double event handler removed)