Wiwi Forms - Form Builder

It gives you tools that help, but compliance is something you achieve as the site owner — no plugin can grant it to you. It depends on your lawful basis for collecting the data, your privacy notice, your agreements with anyone who processes it for you, and how you configure and run the site. What the plugin does: the answers people submit, uploaded files and stored spam diagnostics are encrypted with libsodium. An auto-delete retention policy removes entries, including starred entries, after the number of days you choose. The GDPR Consent field auto-links to your Privacy Policy, Terms and Cookie Policy pages. The plugin also registers with WordPress's personal-data export and erasure tools. What it does not do: it will not delete anything unless you set a retention period — left at zero, entries are kept indefinitely. Automated privacy requests find entries through the indexed HMAC stored for the first configured email field. Entries without that email hash cannot be found automatically and require manual review. Visitor IP addresses are never stored — only a keyed hash of them. The default encryption key is stored in the WordPress database, so encryption protects files and accidental plaintext disclosure but cannot protect against an attacker who obtains a complete database dump including that key. You can define WIWI_FORMS_ENCRYPTION_KEY outside the database; keep the exact old key available because changing it does not re-encrypt existing data. Stored without encryption beside an entry are the keyed email hash, body/domain hashes, similarity hash and delivery status. Spam explanations are encrypted.

No. It does not phone home, load scripts or styles from a CDN, send your data anywhere, or check for its own updates. There is no bundled updater and no account to sign up for. One optional setting performs a lookup. "Email domain check", which is off by default, asks whether the domain of a submitted email address is able to receive mail. That is a DNS lookup for MX, A and AAAA records, made by your own server through whatever resolver your host uses. Only the domain part of the address is looked up, never the full address, and each answer is cached for a day. Turning the setting off stops the lookups entirely.

Wiwi Forms uses no tracking cookies, sessions, or localStorage. On non-JavaScript submissions, it sets one functional cookie containing a random token for up to five minutes so the form can be re-populated after the redirect. The cookie is HTTP-only, SameSite=Lax, and Secure on HTTPS. Forms remain compatible with page caching solutions.

The front end loads no jQuery. The admin settings screen uses WordPress's bundled colour picker, which depends on jQuery.

Rule packs are pasted and installed explicitly by an administrator; Wiwi Forms does not download them from a remote service. Regular expressions are available only to imported Wiwi rule packs, not owner-authored rules. Their count and length are capped, they are validated during import, and runtime matches use PCRE resource limits plus a timed cooldown if a subject causes an error.

Install and activate Wiwi Forms separately on each site. Network activation is not supported.