Wiwi Forms - Form Builder -- WordPress 插件

开发者	naiches
更新时间	2026年9月8日 21:44
PHP版本:	8.4 及以上
WordPress版本:	7.1
版权:	GPLv2 or later
版权网址:	版权信息

Wiwi Forms is a lightweight WordPress form builder designed for developers and site owners who want a clean, fast, and privacy-focused form solution without the bloat. About the name: Wiwi Forms is built and maintained by Wiwi Websolutions, alongside Wiwi Cookie Consent. Key Features:

Drag-and-drop form builder with 17 field types and multi-step forms
Encrypted entry storage (libsodium) with a dedicated site key
Encrypted file uploads on disk
AJAX form submission (no page reload)
Bootstrap 5 form classes — works natively with Bootstrap themes
Email notifications with delivery tracking (sent/failed status per entry)
GDPR/AVG/ePrivacy compliance: encrypted storage, auto-delete retention, consent field
Anti-spam: honeypot, time token, rate limiting, math captcha
No tracking cookies or sessions; one short-lived functional cookie for non-JavaScript submissions; fully cache-compatible (LiteSpeed, WP Rocket, Cloudflare)
jQuery-free front end; the admin settings screen uses WordPress's bundled colour picker
English + Dutch translations included

Field Types: Text, Textarea, Select, Radio, Checkbox, Number, Email, Phone (with country prefix), Date/Time, File Upload, Hidden, Math Captcha, HTML, Heading, Separator, GDPR Consent, Page Break.

1.0.1

Added: every submission is now scored for spam and the score is recorded with the entry, visible as a column in the entries list and as a breakdown of the signals that fired. Nothing is blocked, held back or filtered on that score in this release — it is recorded so the thresholds can be set from real data before anything acts on them. Existing behaviour is unchanged.
Security: files attached to a conditionally hidden upload field were stored without any of the field's checks — allowed types, blocked types, size and count were all skipped.
Security: a solved captcha could be reused indefinitely. Each challenge is now single-use and expires, while still working behind full-page caching.
Security: decrypted copies of uploaded files could be left behind in the server's temporary directory after an interrupted download or a mail failure.
Fixed: the encryption key is no longer derived from the WordPress salts, so rotating them no longer makes existing entries and uploads unreadable. Data saved before this update is still readable.
Fixed: auto-delete retention deleted the entry but kept its uploaded files on disk permanently.
Fixed: draft, private and trashed forms still rendered and accepted public submissions.
Fixed: a submission could report success after an uploaded file failed to save.
Fixed: exporting entries from more than one form labelled every row with the first form's fields.
Fixed: the Apply button below the entries list did nothing.
Fixed: on multi-step forms, headings, separators and HTML blocks appeared on every step at once.
Fixed: the fallback used when JavaScript is unavailable submitted nothing.
Fixed: large uploads are encrypted in chunks instead of being held in memory whole.
Fixed: database changes are now applied when the plugin updates, not only when it is activated.
Changed: building forms now requires an administrator, matching the permission already needed to read submissions.
Removed: the entries search box, which could never match anything because entries are encrypted at rest.
Fixed: double-submit protection did nothing. The script disabled a hidden field that shares the submit button's name instead of the button itself, so the button stayed live and a second click sent the form again — creating duplicate entries.
Fixed: behind a full-page cache, forms eventually stopped accepting submissions with "This form has expired". The submit nonce is no longer written into cacheable HTML at all; JavaScript obtains it from the uncacheable token endpoint before submission, while the signed time token preserves the non-JavaScript path for public forms.
Fixed: the token refresh could be refused for a second visitor on the same network within five seconds, because the rate limit counted everyone behind one connection as one visitor. The limit now applies only to issuing new captchas, which is what it was there to protect.

1.0.0

Initial release.

Wiwi Forms - Form Builder

标签

下载

详情介绍:

安装:

升级注意事项:

常见问题:

更新日志: