Webcraft Forms

Webcraft Forms Premium – need file uploads, multi-step forms, tile choices and calculated fields? See the Premium version.

• Spam protection that stays on your server. ALTCHA proof-of-work runs entirely on your own site – no account, no external service, no CDN, no data transfer. It is the default. Google reCAPTCHA is deliberately not supported at all.
• No outbound request, ever, unless you ask for one. No tracking, no phone-home, no usage statistics. The only optional exception is Friendly Captcha, and only if you switch it on with your own credentials.
• Nothing is stored anywhere but your database. Submissions are sent by e-mail and processed on your own server. There is no vendor cloud in the free version and none in the paid add-on either.
• Column layout per device. Set each field's width separately for desktop, tablet and phone, with inheritance – the way a page builder works. The canvas narrows to the simulated device so you see the real result.
• Conditional display included, not sold separately. Show or hide any field based on other fields' values, evaluated in the browser and verified again on the server.
• Switching plugins does not mean rebuilding forms. Existing forms from Contact Form 7, WPForms and Fluent Forms are taken over field by field, with their layout and their settings – from this site, or from an export file of another installation.

• Live canvas with inline editing, drag and drop and row-based layout
• Field widths per device (desktop, tablet, phone) with inheritance, like a page builder
• Field types: text and multiline text, e-mail, phone, website, number, date, time, dropdown, radio buttons, checkbox, multiple choice, consent checkbox, multi-part name, heading with optional divider, free text, hidden field with a dynamic value
• Conditional display per field: show or hide a field based on the values of other fields, evaluated on the client and verified again on the server
• Duplicate forms, export and import them as JSON, start from one of three templates
• Take over existing forms from Contact Form 7, WPForms or Fluent Forms – from this site, or from an export file of another installation – including labels, choices, widths, conditions, recipient and confirmation

• Multiple recipients plus CC and BCC
• Reply-To set to the address the visitor entered
• Confirmation as an on-page message or as a redirect to any URL
• Auto-responder with its own subject and body, placeholder for the submitted data
• Internal label added to the notification only, never to the auto-responder

• Honeypot, always active. The field name is different on every site and can be renewed at any time, so a bot adapted to one installation does not fit the next
• Time check, always active: a form filled in faster than a person possibly could is discarded
• Both counted per form in the form list, so you can see how much spam never reaches you. Only numbers are stored, no content and no IP address
• ALTCHA: local proof-of-work, the default for new forms
• Friendly Captcha as an optional alternative. You bring your own site key and API key; the plugin only provides the connection fields and never proxies the service. Its browser SDK is bundled with the plugin, so nothing is fetched from a CDN. See "External services" below.

• Shortcode [webcraft_form id="123"]
• Elementor widget, registered only when Elementor is active

1. Upload the plugin folder to /wp-content/plugins/ or install it through Plugins → Add New.
2. Activate the plugin.
3. Open "Webcraft Forms" in the admin menu and create your first form, empty or from a template.
4. Place the shortcode [webcraft_form id="123"] on any page, or use the Elementor widget.

• Tested with WordPress 7.1

• A signature is now shown in the mail like an uploaded file: by name, linked for the site owner. Until now the bare download address stood there as plain text – including in the confirmation to the person who sent the form, where a link to the admin download does not belong
• New filter wcforms_mail_file_types so an extension can have its own field type rendered as a file block

• Fixed: own mail text with the placeholder for the submitted data. The data block was placed inside the paragraph of the introduction, which is not a valid table. Outlook could then show it above the introduction instead of below it
• Fixed: an invalid address in an optional email field is now rejected instead of being silently dropped or silently corrected. The browser already refused those entries, the server did not
• Files that an extension has already stored are now released again when the submission does not go through after all – a missing required field, a failed captcha, or a field that turned out to be hidden

• The mails use the full width of the mail programme again. The width was capped while the layout still had a tinted margin around it; without that margin it only looked like a narrow strip

• The mails are plain again: white ground, dark type, thin rules. The tinted background and the white boxes around every single value made a submission look decorated rather than readable
• Frames are drawn with tables now. Outlook renders a border on a div only partly – usually just bottom and right – which is why the boxes looked broken there

• Fixed: a form is now wired up exactly once. If the setup ran a second time – a page builder reloading the area, another script triggering it – every listener was attached twice, and one click on "add another" produced two entries

• The mails read more calmly: section headings are dark type on a light ground instead of a filled colour bar, and every single entry sits in its own framed box so it is clear where a value begins and ends
• More air in the form: greater distance between fields, and noticeably more room below a heading, so heading, intro text and the first field no longer stick together

• Notifications and confirmations are now laid out instead of being one long list of "label: value". Headings and page breaks of the form become sections, a repeatable group appears as one block per entry, longer texts keep their paragraphs, and uploaded files are listed by name with the information the visitor gave for each of them
• The confirmation to the visitor never shows an address or path of an uploaded file any more – only the file name and their own note. The downloads are for logged-in administrators, so a link there has no place in that mail
• Every mail carries a plain-text version alongside the formatted one, so mail programs without HTML show the same structure
• The filter wcforms_mail_html switches the whole thing back to plain text

• Fixed: submitting a form while logged in could fail with "The link you followed has expired". The security token is fetched through the REST endpoint so it cannot grow stale inside a page cache – but WordPress treats such a request as coming from a logged-out visitor, so the token belonged to the wrong person. It is now issued for whoever is actually logged in
• A failed security check no longer ends on the WordPress dead end. The form comes back with everything still filled in and an explanation; only chosen files have to be picked again

• A website field now accepts an address without a scheme. "www.example.com" was rejected as invalid until now, even though it is what most people type; the address is completed to https:// when the form is submitted. Only entries that are clearly not an address are still refused

• The version is now part of the address of the plugin's own stylesheet and script. Optimisation plugins that strip the query string made every update invisible to browsers that already had the old file – the form then stayed on the previous version until someone happened to reload the page the hard way

• New field type "Repeatable group": bundle several subfields (text, multiline text, dropdown) into one entry that visitors can repeat - instead of building the same fields fifteen times. Label per entry, add-button label, minimum and maximum are configurable
• The number of entries can be linked to another field: the first number in its value determines how many entries appear (e.g. a dropdown "How many subpages?"). The add button is hidden then
• Required logic per entry: a required group demands its required subfields in every entry, an optional group simply drops entries that were left empty
• Entries arrive in the notification, the auto-responder and the entry storage as a clearly separated block per entry

• The honeypot field name is now generated per site instead of being the same in every installation, and it can be renewed in the spam protection settings. A bot adapted to one site no longer fits all the others
• New time check: a submission sent faster than a person could possibly fill in the form is discarded, just like a filled honeypot. Three seconds by default, adjustable through the filter wcforms_min_seconds
• New column "Spam" in the form list counts the submissions that were discarded, split by reason and resettable. Until now they disappeared without a trace and you had no way of knowing how much spam the form caught
• Only the counters are stored – no content, no IP address, nothing about the sender

• Fixed: on sites with page caching, sending a form protected by the local ALTCHA security check failed on the first attempt, even though the check reported success. The check was created while the page was rendered and stayed valid for ten minutes only, so a cached page handed out a check that had long expired. It is now fetched fresh for every visitor and renewed automatically while the form stays open
• The security token of the form is fetched the same way and can no longer grow stale inside a cached page
• A solved security check is now accepted exactly once

• The description now covers taking over forms from another plugin in its own section instead of only mentioning it in passing
• The short description names the import as well, so it is visible in search results and in the plugin installer
• No change to the plugin itself

• The texts inside the form and in the builder can now be translated at last. They were passed through a helper function that the string scanner of WordPress.org does not recognise, so 69 texts – including every validation message – never reached the translation project
• No change in behaviour

• The import now has its own menu entry under Webcraft Forms instead of only a button below the form list
• Template buttons wrapping to a second row no longer sit flush against the row above

• The import screen now always offers all three sources, whether or not the other plugin is installed
• WPForms and Fluent Forms export files can be uploaded, so forms from a different WordPress installation can be taken over as well
• Contact Form 7: form properties stored without the leading underscore are now read too, so older forms import correctly
• Contact Form 7: choices written in pipe syntax keep only the visible label instead of the whole entry
• WPForms: the column classes are mapped completely, including fifths and the alternative spellings of the same share
• Fluent Forms: a submit button placed as a field is taken as the button text instead of being reported as a lost field
• Fluent Forms: the address field is split into its visible parts instead of being dropped
• Fluent Forms: date fields with the time option switched on now say so in the report, and the administration address placeholder resolves correctly
• A switched-off notification in the source form is now named in the report instead of silently falling back to the administration address

• Take over existing forms from Contact Form 7, WPForms and Fluent Forms. The button appears below the form list as soon as such forms exist on the site
• Carried over where available: fields and labels, choices, required flags, placeholders, column widths, conditional display, recipient, CC/BCC, subject, submit button text and confirmation
• File uploads and page breaks are imported as locked premium fields, so the form stays complete even without the Premium add-on
• Every import ends with a report that names what could not be carried over, instead of dropping it silently
• The source form is only ever read, never changed, and keeps working

• Description now links to the plugin page and the Premium version
• No change in behaviour

• The links to the plugin page follow its new address
• No change in behaviour

• Plugin Check pass on 1.25.0: the four remaining warnings resolved. Two concerned the meta_key column written by the one-off migration, two concerned unprefixed variables in uninstall.php
• No change in behaviour

• All identifiers now use the prefix wcforms_ instead of wcf_, as required for the WordPress.org directory. This affects the post type of the forms, the meta keys, the option, the script handles and every hook. Existing forms are migrated automatically on the first request after the update
• Extensions have to be updated as well; Webcraft Forms Premium 1.11.0 or later is required
• The Friendly Captcha SDK is bundled with the plugin (version 1.0.1, MPL-2.0) instead of being loaded from a CDN, and is pinned to a fixed version
• New readme section "External services" documenting the Friendly Captcha connection, the data sent and the links to its terms and privacy policy
• Builder data is handed over through wp_add_inline_script() instead of an inline script tag
• Extensions no longer receive the raw $_POST array through wcforms_save_settings, but an unslashed and cleaned copy
• Removed load_plugin_textdomain() and the bundled translation files; WordPress loads translations from translate.wordpress.org by itself

• Forms are now styled correctly inside the Elementor editor preview.
• New hook wcf_preview_assets for extensions that ship their own front-end files.

• Extensions can now provide their own form templates (filters wcf_template_fields and wcf_template_title).
• Without Premium, the premium templates are shown greyed out below the template buttons.

• readme.txt: description rewritten to state up front what sets the plugin apart – local spam protection, no external requests, no cloud storage, per-device column layout, conditional display in the free version
• No code change

• German now ships in both forms of address: de_DE uses the informal "du", de_DE_formal uses the formal "Sie". WordPress treats these as two separate locales, and until now only one file existed – sites set to "Deutsch (Sie)" fell back to English
• Both variants are complete and include the script translations

• The premium section of the field palette now shows every field type the add-on provides – file upload, page break, tile choice, calculation and signature – instead of file upload alone
• The note below it lists the current premium feature set; it still described the state of version 1.0
• Description in readme.txt updated accordingly

• Eight strings in the builder were still hard-coded and stayed German regardless of the site language: the width bar label, the "Required" chip, the drag handle tooltip, the salutation and divider switches, the multiline switch and the name field preview. They are translatable now
• Template now has 262 strings, the German translation covers all of them

• Source language changed to English. All strings in PHP and JavaScript are now English in the code, which is the WordPress convention and lets translators on translate.wordpress.org work from an English original
• German is now shipped as a translation (de_DE), complete for all 256 strings, including the script translations
• About 28 strings in the builder that were previously hard-coded are now translatable as well (conditional display, field toolbar, option editor)
• No change in behaviour or data

• Translations are now loaded through load_plugin_textdomain(), so a language file placed directly in the plugin's /languages folder is picked up as well
• No other change

• Translation template /languages/webcraft-forms.pot regenerated (228 strings, previously 205); it now covers the strings added in 1.16.x to 1.20.0
• No code change

• New extension point window.WCF_PANEL_EXTRAS: add-ons can append their own controls to the field options panel of any field type, not just their own
• Entries provide options(field, api) and panelEvent(field, event, api); a faulty add-on cannot break the panel
• Builder API gains getFields()
• New filter wcf_computed_values: add-ons can supply values that only follow from all fields together, such as a calculation; the value is available to notifications, entries and conditions
• No change in behaviour on its own

• New field type: hidden field with a dynamic value. The value is filled on request from a URL parameter, the page title, the page address or the logged-in user, with an optional fallback
• Useful for campaign and source attribution, especially for one form placed on many pages by shortcode
• The value is always resolved again on the server when the form is submitted and never taken from the submitted form; it is never required and never rendered as a visible control
• The field can be used as the reference of a conditional display like any other field
• New filters wcf_hidden_sources and wcf_hidden_value

• Form settings are now a centred dialog with a vertical tab list instead of a narrow side drawer: Sending, Confirmation, Auto-responder, Design, Spam protection
• New filter wcf_settings_panes so add-ons can register their own tab; sections still hooked to the older wcf_settings_panel_sections are shown in a separate tab
• Narrow screens move the tab list to the top

• Extension points for conditional notifications and confirmations: add-ons can filter the list of notifications sent for a submission and replace the redirect target and the on-page success message
• New filters wcf_notifications, wcf_success_target and wcf_success_text; a notification may carry its own body text with the {daten} placeholder
• No change in behaviour on its own: without an add-on the plugin still sends exactly one notification and shows the configured message

• Client-side validation now treats any radio or checkbox group as empty until something is checked, including groups rendered by add-ons
• Add-on field defaults are deep-copied so two fields of the same type no longer share one object

• Fields now carry an ext container that add-ons can use for their own data; it is preserved on save even while the add-on is inactive
• Registry gains panelEvent so add-ons can handle their own controls in the field options panel
• Condition values offer a dropdown for any field that carries options, including add-on field types

• Translation template regenerated: 205 strings, including the two new builder strings from 1.15.0

• Field types from an add-on that is temporarily inactive are now kept on save instead of being turned into text fields
• Such fields are shown locked in the builder, are not rendered on the front end, and are never validated, mailed or stored
• Re-activating the add-on brings them back unchanged

• Extension points for custom field types: add-ons can register a field type with its own canvas card, preview and option controls
• New filter wcf_field_display_only, new actions wcf_builder_assets and wcf_form_render
• Front-end validation helpers exposed for add-ons, plus a wcf:form-init event per form
• The builder now draws the canvas on DOMContentLoaded so registrations from later scripts are picked up

• Plugin Check pass: all nine warnings resolved
• Saved settings run through the standard sanitizing functions before the plugin-specific checks
• Removed the manual load_plugin_textdomain() call, discouraged since WordPress 4.6

• Code pass against the WordPress Coding Standards ahead of the plugin review: no findings left
• The Friendly Captcha SDK is now loaded through the script queue instead of inline script tags
• Form tag output escaped attribute by attribute; the enctype allow list returns a plain value

• Editing a saved form now highlights "Alle Formulare" in the admin menu instead of "Neues Formular", and the browser tab shows the correct title.

• Builder and front-end scripts are translatable again, this time through the standard wp.i18n API and wp_set_script_translations(), so Loco Translate and comparable tools pick them up.
• Fixed the naming collision that emptied the builder canvas in 1.13.0: the translation helper shadowed an existing local variable.

• Fix: the builder canvas stayed empty after 1.13.0. The translation layer for the builder script has been removed again; the script is back to its proven state.
• The form data handed to the builder is now guarded against invalid JSON encoding.

• All interface strings are now translatable, webcraft-forms.pot added
• Plugin header completed (license, minimum WordPress version, domain path)
• Security pass: button colours, corner radius, site key and API key escaped at output; the wcf_form_enctype filter is checked against an allow list
• ALTCHA is preselected as the captcha method for new forms; existing forms are unchanged

• Notice when a Friendly Captcha check could not be carried out (network error, HTTP error, unexpected response, missing keys), with time and reason in the admin area
• Submissions are still accepted in that case; the notice disappears once the service answers again

• Duplicate a form, export and import forms as JSON, three form templates
• Delete a form, with confirmation

• New fields: heading with optional divider, time, multi-part name
• Internal label per form, added to the notification and the entry only

• Multiple recipients, CC and BCC, Reply-To on the sender address
• Confirmation as a message or a redirect, auto-responder

• Conditional display per field, evaluated on the client and verified on the server