Wiwi Forms - Form Builder

It gives you tools that help, but compliance is something you achieve as the site owner — no plugin can grant it to you. It depends on your lawful basis for collecting the data, your privacy notice, your agreements with anyone who processes it for you, and how you configure and run the site. What the plugin does: the answers people submit, and any files they upload, are encrypted with libsodium before they are stored. An auto-delete retention policy removes entries after a number of days you choose. The GDPR Consent field auto-links to your Privacy Policy, Terms and Cookie Policy pages. What it does not do: it will not delete anything unless you set a retention period — left at zero, entries are kept indefinitely. It also does not register with WordPress's own personal-data export and erase tools, so a subject access or erasure request has to be handled by hand. Some information stored next to an entry is deliberately left unencrypted, because the plugin has to read it without unlocking the entry: the spam signals that explain why a submission was scored the way it was, the original name of an uploaded file, the browser user agent string, and any error returned when sending mail. A spam signal can quote a short fragment of what was submitted. Visitor IP addresses are never stored — only a keyed hash of them.

No. It does not phone home, load scripts or styles from a CDN, send your data anywhere, or check for its own updates. There is no bundled updater and no account to sign up for. One optional setting performs a lookup. "Email domain check", which is off by default, asks whether the domain of a submitted email address is able to receive mail. That is a DNS lookup for MX, A and AAAA records, made by your own server through whatever resolver your host uses. Only the domain part of the address is looked up, never the full address, and each answer is cached for a day. Turning the setting off stops the lookups entirely.

Wiwi Forms uses no tracking cookies, sessions, or localStorage. On non-JavaScript submissions, it sets one functional cookie containing a random token for up to five minutes so the form can be re-populated after the redirect. The cookie is HTTP-only, SameSite=Lax, and Secure on HTTPS. Forms remain compatible with page caching solutions.

The front end loads no jQuery. The admin settings screen uses WordPress's bundled colour picker, which depends on jQuery.

Rule packs are pasted and installed explicitly by an administrator; Wiwi Forms does not download them from a remote service. Regular expressions are available only to imported Wiwi rule packs, not owner-authored rules. Their count and length are capped, they are validated during import, and runtime matches use PCRE resource limits plus a timed cooldown if a subject causes an error.

Install and activate Wiwi Forms separately on each site. Network activation is not supported.