{"id":284225,"date":"2026-03-18T22:29:30","date_gmt":"2026-03-18T22:29:30","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/nxp-easy-forms\/"},"modified":"2026-03-18T22:29:20","modified_gmt":"2026-03-18T22:29:20","slug":"formatrica","status":"publish","type":"plugin","link":"https:\/\/ky.wordpress.org\/plugins\/formatrica\/","author":23455679,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_crdt_document":"","version":"1.0.6","stable_tag":"1.0.6","tested":"6.9.4","requires":"6.4","requires_php":"8.1","requires_plugins":null,"header_name":"Formatrica - Drag and Drop Form Builder","header_author":"Zoran Tanevski","header_description":"Lightweight drag-and-drop WordPress form builder with reliable email delivery, strong security, and flexible integrations.","assets_banners_color":"9da8c9","last_updated":"2026-03-18 22:29:20","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/nexusplugins.com\/products\/formatrica","header_author_uri":"https:\/\/nexusplugins.com","rating":0,"author_block_rating":0,"active_installs":0,"downloads":174,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.6":{"tag":"1.0.6","author":"thezoran","date":"2026-03-18 22:29:20"}},"upgrade_notice":{"1.0.0":"<p>Initial release of Formatrica. Requires PHP 8.1+ and WordPress 6.4+.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3486067,"resolution":"128x128","location":"assets","locale":""},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3486067,"resolution":"256x256","location":"assets","locale":""}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3486067,"resolution":"1544x500","location":"assets","locale":""},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3486067,"resolution":"772x250","location":"assets","locale":""}},"assets_blueprints":{},"all_blocks":{"formatrica\/form":{"$schema":"https:\/\/schemas.wp.org\/trunk\/block.json","apiVersion":3,"name":"formatrica\/form","title":"Formatrica","description":"Embed a form created with Formatrica.","category":"widgets","icon":"feedback","keywords":["form","contact","easy"],"supports":{"align":["wide","full"],"html":false,"anchor":true,"className":true,"multiple":true,"lock":false},"textdomain":"formatrica","editorScript":"formatrica-block"}},"tagged_versions":["1.0.6"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3486067,"resolution":"1","location":"assets","locale":""},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3486067,"resolution":"2","location":"assets","locale":""},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3486067,"resolution":"3","location":"assets","locale":""},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3486067,"resolution":"4","location":"assets","locale":""},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3486067,"resolution":"5","location":"assets","locale":""}},"screenshots":{"1":"Drag-and-drop form builder with live preview","2":"Form settings with tabs: General, Email Settings, Integrations, Security, Privacy, Advanced","3":"Form templates library","4":"Field editor with validation options","5":"Frontend form with inline validation"},"jetpack_post_was_ever_published":false},"plugin_section":[],"plugin_tags":[],"plugin_category":[],"plugin_contributors":[258077],"plugin_business_model":[],"class_list":["post-284225","plugin","type-plugin","status-publish","hentry","plugin_contributors-thezoran","plugin_committers-thezoran"],"banners":{"banner":"https:\/\/ps.w.org\/formatrica\/assets\/banner-772x250.png?rev=3486067","banner_2x":"https:\/\/ps.w.org\/formatrica\/assets\/banner-1544x500.png?rev=3486067","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/formatrica\/assets\/icon-128x128.png?rev=3486067","icon_2x":"https:\/\/ps.w.org\/formatrica\/assets\/icon-256x256.png?rev=3486067","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/formatrica\/assets\/screenshot-1.png?rev=3486067","caption":"Drag-and-drop form builder with live preview"},{"src":"https:\/\/ps.w.org\/formatrica\/assets\/screenshot-2.png?rev=3486067","caption":"Form settings with tabs: General, Email Settings, Integrations, Security, Privacy, Advanced"},{"src":"https:\/\/ps.w.org\/formatrica\/assets\/screenshot-3.png?rev=3486067","caption":"Form templates library"},{"src":"https:\/\/ps.w.org\/formatrica\/assets\/screenshot-4.png?rev=3486067","caption":"Field editor with validation options"},{"src":"https:\/\/ps.w.org\/formatrica\/assets\/screenshot-5.png?rev=3486067","caption":"Frontend form with inline validation"}],"raw_content":"<!--section=description-->\n<p>Formatrica was built to solve common frustrations with form builders: dated interfaces, overly complex workflows, and feature gating that makes proper evaluation difficult. It delivers a clean, modern drag-and-drop experience with practical defaults, so you can create a production-ready form in 5-6 clicks and add it to any page via shortcode or block.<\/p>\n\n<h4>Key Features<\/h4>\n\n<p><strong>Form Builder<\/strong>\n* Intuitive drag-and-drop form builder (Vue.js + Pinia + SortableJS)\n* Real-time preview with live field editing\n* Form preview functionality with zoom control (50-100%)\n* 15 pre-built templates: Simple Contact, Business Contact, Newsletter Signup, Job Application, Appointment Request, Real Estate Inquiry, Course Registration, Event Registration, Customer Feedback, Support Ticket, Front-end Post Submission, Request a Quote, RSVP Response, Volunteer Signup, User Registration\n* Smart Quick Start notification for new forms<\/p>\n\n<p><strong>Field Types<\/strong>\n* Text, Email, Telephone, Password\n* Textarea for long-form content\n* Select (single\/multiple), Radio, Checkbox\n* File Upload with validation and size limits\n* Date Picker\n* Hidden fields for internal metadata\n* Custom Text blocks for static content\n* Submit Button with customizable labels<\/p>\n\n<p><strong>Security &amp; Anti-Spam<\/strong>\n* Honeypot protection (enabled by default)\n* CSRF token validation\n* IP-based rate limiting (configurable per form)\n* Multiple CAPTCHA providers:\n  - Google reCAPTCHA v3\n  - Cloudflare Turnstile\n  - FriendlyCaptcha\n* CAPTCHA secrets stored encrypted at rest with write-only admin controls\n* Minimum submission time detection\n* File upload validation with type and size restrictions<\/p>\n\n<p><strong>Privacy Controls<\/strong>\n* IP address storage options: Full, Anonymized, or None\n* Default: Anonymized (removes last octet)\n* Auto-delete submissions after X days (optional)\n* GDPR-friendly data handling<\/p>\n\n<p><strong>Email Delivery<\/strong>\n* Multiple delivery providers:\n  - WordPress default (wp_mail)\n  - SendGrid API\n  - SMTP2GO API\n  - Mailgun API (with EU\/US region support)\n  - Postmark API\n  - Brevo API (formerly Sendinblue)\n  - Amazon SES (with AWS Signature v4 authentication)\n  - Custom SMTP\n  - Mailpit (for development)\n* Encrypted credentials storage (AES-256-CBC)\n* Test email functionality\n* Customizable sender name, email, subject, and recipient\n* Smart defaults from WordPress settings\n* Verification emails for registration forms use the same provider configured in that form's settings<\/p>\n\n<p><strong>User Registration<\/strong>\n* Special form type for WordPress user registration\n* Integrates with WordPress user creation flow\n* Email verification required: users must confirm their email before logging in\n* Verification emails respect each form's configured delivery provider (SMTP\/API\/wp_mail)\n* Login is blocked for unverified users with a clear message on wp-login.php<\/p>\n\n<p><strong>Integrations &amp; Webhooks<\/strong>\n* <strong>Zapier<\/strong>: Connect to 5,000+ apps via Webhooks by Zapier trigger\n* <strong>Make.com<\/strong>: Build visual automation workflows (formerly Integromat)\n* <strong>Slack<\/strong>: Instantly notify Slack channels via Incoming Webhooks\n* <strong>WordPress Post<\/strong>: Create pending posts (or other post types) with field mappings, taxonomy, and meta controls\n  - Full ACF (Advanced Custom Fields) support with 20+ field types\n  - Author mode: current user, fixed user, or anonymous\n  - Featured image support, taxonomy term creation, custom post meta\n* <strong>WooCommerce<\/strong>: Generate orders and optional customer records directly from form submissions\n* <strong>Mailchimp<\/strong>: Subscribe contacts to audiences with field mapping and double opt-in\n* <strong>Salesforce (Essentials)<\/strong>: Create Web-to-Lead entries without OAuth\n* <strong>HubSpot<\/strong>: Submit contacts to HubSpot forms using a Private App token\n* <strong>Custom Webhooks<\/strong>: POST submission data to any endpoint\n* <strong>Async integration queue<\/strong>: Background processing for external webhooks (WordPress Cron)\n  - Dramatically improves form submission performance (5-15s \u2192 &lt;200ms)\n  - 10 jobs per batch, 3 retry attempts with error logging\n  - Keeps local integrations synchronous for data consistency\n* Secret key signing for verification (custom webhooks only)\n* Custom payload filtering via hooks\n* SSRF protection and security validation<\/p>\n\n<p><strong>Developer-Friendly<\/strong>\n* Comprehensive <a href=\"https:\/\/docs.nexusplugins.com\/products\/formatrica\">API documentation<\/a>\n* 15+ action and filter hooks for extensibility\n* REST API endpoints for forms and submissions\n* Provider-specific payload filters (Slack, Mailchimp, Salesforce, HubSpot, WordPress Post)\n* PSR-4 autoloaded architecture with Service Layer design\n* Clean separation of concerns: Validation, Security, File Handling, Rendering, and Integrations layers\n* 22 single-responsibility classes for maintainability and testability\n* Database schema versioning system with migration support\n* Modular ES6 JavaScript with class-based structure\n* Vite-powered build system\n* Full TypeDoc-style inline documentation\n* Admin list improvements: Active\/Inactive filters, Activate\/Deactivate actions, and safe delete confirmations\n<h3>Hooks &amp; Filters<\/h3><\/p>\n\n<h4>Action Hooks<\/h4>\n\n<p><strong>formatrica_before_submission<\/strong>\nFires before processing a form submission.\n    do_action('formatrica_before_submission', $form_id, $form, $request_data, $context);<\/p>\n\n<p><strong>formatrica_after_submission<\/strong>\nFires after successful submission processing.\n    do_action('formatrica_after_submission', $form_id, $sanitised, $result, $form, $context);<\/p>\n\n<p><strong>formatrica_user_registered<\/strong>\nFires after a new WordPress user is registered via form.\n    do_action('formatrica_user_registered', $user_id, $data);<\/p>\n\n<p><strong>formatrica_webhook_failed<\/strong>\nFires when webhook delivery fails.\n    do_action('formatrica_webhook_failed', $error_data);<\/p>\n\n<p><strong>formatrica_integration_dispatch<\/strong>\nFires when an integration ID is not handled by the built-in dispatchers, allowing custom providers.\n    do_action('formatrica_integration_dispatch', $integration_id, $settings, $form, $payload, $context, $field_meta);<\/p>\n\n<h4>Filter Hooks<\/h4>\n\n<p><strong>formatrica_submission_request<\/strong>\nFilter raw submission data before validation.\n    apply_filters('formatrica_submission_request', $request_data, $form_id, $form, $context);<\/p>\n\n<p><strong>formatrica_sanitized_submission<\/strong>\nFilter sanitized submission data before processing.\n    apply_filters('formatrica_sanitized_submission', $sanitised, $form_id, $form, $request_data, $context);<\/p>\n\n<p><strong>formatrica_webhook_payload<\/strong>\nFilter webhook payload before sending to integrations (Zapier, Make, Slack) or custom webhooks. The <code>$context<\/code> parameter includes an <code>integration<\/code> key identifying the target.\n    apply_filters('formatrica_webhook_payload', $body, $form, $payload, $context, $field_meta);<\/p>\n\n<p><strong>formatrica_slack_payload<\/strong>\nFilter the Slack payload before dispatching to the incoming webhook.\n    apply_filters('formatrica_slack_payload', $body, $form, $payload, $context, $field_meta);<\/p>\n\n<p><strong>formatrica_mailchimp_payload<\/strong>\nFilter the Mailchimp member payload before it is sent via the API.\n    apply_filters('formatrica_mailchimp_payload', $body, $form, $payload, $context, $field_meta);<\/p>\n\n<p><strong>formatrica_salesforce_payload<\/strong>\nFilter the Salesforce Web-to-Lead form data before submission.\n    apply_filters('formatrica_salesforce_payload', $data, $form, $payload, $context, $field_meta);<\/p>\n\n<p><strong>formatrica_hubspot_payload<\/strong>\nFilter the HubSpot Forms API payload before dispatch.\n    apply_filters('formatrica_hubspot_payload', $body, $form, $payload, $context, $field_meta);<\/p>\n\n<p><strong>formatrica_duplicate_title<\/strong>\nFilter duplicated form title.\n    apply_filters('formatrica_duplicate_title', $title, $original_form);<\/p>\n\n<p><strong>formatrica_min_submission_time<\/strong>\nFilter minimum time between page load and submission (anti-bot).\n    apply_filters('formatrica_min_submission_time', 2, $form_id);<\/p>\n\n<p><strong>formatrica_max_upload_size<\/strong>\nFilter maximum file upload size in MB.\n    apply_filters('formatrica_max_upload_size', $max_size, $field);<\/p>\n\n<p><strong>formatrica_allowed_file_types<\/strong>\nFilter allowed MIME types for file uploads.\n    apply_filters('formatrica_allowed_file_types', $allowed_types, $field);<\/p>\n\n<p><strong>formatrica_max_image_dimension<\/strong>\nFilter maximum image dimension in pixels.\n    apply_filters('formatrica_max_image_dimension', 4096, $field);<\/p>\n\n<p><strong>formatrica_recaptcha_v3_min_score<\/strong>\nFilter minimum reCAPTCHA v3 score threshold.\n    apply_filters('formatrica_recaptcha_v3_min_score', 0.5, $form_id);<\/p>\n\n<p>For detailed examples, see the <a href=\"https:\/\/docs.nexusplugins.com\/products\/formatrica\">plugin documentation<\/a>.<\/p>\n\n<h3>REST API<\/h3>\n\n<p>Formatrica registers REST API endpoints under the <code>formatrica\/v1<\/code> namespace. All admin endpoints require the <code>manage_options<\/code> capability and a valid REST nonce.<\/p>\n\n<h4>Public Endpoints<\/h4>\n\n<p>The following endpoints are intentionally public (no authentication required) because they serve front-end form functionality for unauthenticated visitors:<\/p>\n\n<p><strong>POST \/formatrica\/v1\/forms\/{form_id}\/submissions<\/strong>\nAccepts a form submission from any visitor. Security is enforced at the application layer: CSRF token validation, honeypot field detection, minimum submission time check, IP-based rate limiting, CAPTCHA verification, and full field sanitisation\/validation.<\/p>\n\n<p><strong>GET \/formatrica\/v1\/utility\/countries<\/strong>\nReturns a read-only list of country names for front-end country select fields. No user data is accepted or stored.<\/p>\n\n<p><strong>GET \/formatrica\/v1\/utility\/states\/{country}<\/strong>\nReturns a read-only list of states\/provinces for a given ISO 3166-1 alpha-2 country code (e.g. <code>US<\/code>, <code>DE<\/code>). The country code is validated to exactly two uppercase letters. No user data is accepted or stored.<\/p>\n\n<h4>Admin Endpoints (require `manage_options` + REST nonce)<\/h4>\n\n<ul>\n<li><code>GET\/POST \/formatrica\/v1\/forms<\/code> \u2014 List or create forms<\/li>\n<li><code>GET\/PUT\/PATCH\/DELETE \/formatrica\/v1\/forms\/{form_id}<\/code> \u2014 Read, update, or delete a form<\/li>\n<li><code>POST \/formatrica\/v1\/emails\/test<\/code> \u2014 Send a test email<\/li>\n<li><code>GET \/formatrica\/v1\/wp\/post-types<\/code> \u2014 List available post types<\/li>\n<li><code>GET \/formatrica\/v1\/woocommerce\/catalog<\/code> \u2014 List WooCommerce products\/categories<\/li>\n<li><code>POST \/formatrica\/v1\/integrations\/mailchimp\/lists<\/code> \u2014 Fetch Mailchimp audience lists<\/li>\n<li><code>GET\/POST \/formatrica\/v1\/settings\/email<\/code> \u2014 Read or update email settings<\/li>\n<li><code>POST \/formatrica\/v1\/settings\/email\/test<\/code> \u2014 Test email configuration<\/li>\n<li><code>GET \/formatrica\/v1\/settings\/email\/diagnostics<\/code> \u2014 Email delivery diagnostics<\/li>\n<\/ul>\n\n<h3>External services<\/h3>\n\n<p>Formatrica does not contact any external service by default. Each service below is used only when a site administrator explicitly enables and configures it for a form.<\/p>\n\n<h4>CAPTCHA Verification<\/h4>\n\n<p>When a CAPTCHA provider is enabled on a form, the visitor's browser loads the provider's JavaScript widget and, on submission, the visitor's IP address and a verification token are sent to that provider's server-side verification endpoint. This happens once per form submission.<\/p>\n\n<ul>\n<li><p><strong>Google reCAPTCHA v3<\/strong> \u2014 Verifies submissions are from real users by scoring browser behaviour.\nData sent: visitor IP address, verification token, site key.\n<a href=\"https:\/\/policies.google.com\/terms\">Terms of Service<\/a> | <a href=\"https:\/\/policies.google.com\/privacy\">Privacy Policy<\/a><\/p><\/li>\n<li><p><strong>Cloudflare Turnstile<\/strong> \u2014 Non-intrusive bot detection challenge.\nData sent: visitor IP address, verification token, site key.\n<a href=\"https:\/\/www.cloudflare.com\/terms\/\">Terms of Service<\/a> | <a href=\"https:\/\/www.cloudflare.com\/privacypolicy\/\">Privacy Policy<\/a><\/p><\/li>\n<li><p><strong>FriendlyCaptcha<\/strong> \u2014 Privacy-focused proof-of-work CAPTCHA.\nData sent: visitor IP address, puzzle solution, site key.\n<a href=\"https:\/\/friendlycaptcha.com\/legal\/terms\/\">Terms of Service<\/a> | <a href=\"https:\/\/friendlycaptcha.com\/legal\/privacy-end-users\/\">Privacy Policy<\/a><\/p><\/li>\n<\/ul>\n\n<h4>Email Delivery<\/h4>\n\n<p>When a third-party email delivery provider is configured, submission notification emails are transmitted to the provider's API each time a form is submitted. Data sent includes: recipient address, sender name and email, subject line, and the message body containing the submitted form data.<\/p>\n\n<ul>\n<li><p><strong>SendGrid<\/strong> (Twilio) \u2014 Transactional email API.\n<a href=\"https:\/\/www.twilio.com\/en-us\/legal\/tos\">Terms of Service<\/a> | <a href=\"https:\/\/www.twilio.com\/en-us\/legal\/privacy\">Privacy Policy<\/a><\/p><\/li>\n<li><p><strong>SMTP2GO<\/strong> \u2014 Transactional email API.\n<a href=\"https:\/\/www.smtp2go.com\/terms\/\">Terms of Service<\/a> | <a href=\"https:\/\/www.smtp2go.com\/privacy\/\">Privacy Policy<\/a><\/p><\/li>\n<li><p><strong>Mailgun<\/strong> (Sinch) \u2014 Transactional email API.\n<a href=\"https:\/\/www.mailgun.com\/legal\/terms\/\">Terms of Service<\/a> | <a href=\"https:\/\/www.mailgun.com\/legal\/privacy-policy\/\">Privacy Policy<\/a><\/p><\/li>\n<li><p><strong>Postmark<\/strong> (ActiveCampaign) \u2014 Transactional email API.\n<a href=\"https:\/\/postmarkapp.com\/terms-of-service\">Terms of Service<\/a> | <a href=\"https:\/\/postmarkapp.com\/privacy-policy\">Privacy Policy<\/a><\/p><\/li>\n<li><p><strong>Brevo<\/strong> (formerly Sendinblue) \u2014 Transactional email API.\n<a href=\"https:\/\/www.brevo.com\/legal\/termsofuse\/\">Terms of Service<\/a> | <a href=\"https:\/\/www.brevo.com\/legal\/privacypolicy\/\">Privacy Policy<\/a><\/p><\/li>\n<li><p><strong>Amazon SES<\/strong> (AWS) \u2014 Transactional email API. Uses AWS Signature v4 authentication.\n<a href=\"https:\/\/aws.amazon.com\/service-terms\/\">Terms of Service<\/a> | <a href=\"https:\/\/aws.amazon.com\/privacy\/\">Privacy Policy<\/a><\/p><\/li>\n<\/ul>\n\n<p>Custom SMTP and Mailpit send data to your own mail server. The default WordPress provider uses <code>wp_mail()<\/code> with no external API call.<\/p>\n\n<h4>Integrations<\/h4>\n\n<p>When an integration is enabled and configured by the site administrator, form submission data is sent to the configured endpoint upon each form submission. Data sent includes: form title, submitted field values, and field metadata. The Zapier, Make.com, and custom webhook integrations also include the submitter's IP address and user agent in the payload.<\/p>\n\n<ul>\n<li><p><strong>Zapier<\/strong> \u2014 Automation platform. Receives a JSON webhook with full submission data on each form submission.\n<a href=\"https:\/\/zapier.com\/legal\/terms-of-service\">Terms of Service<\/a> | <a href=\"https:\/\/zapier.com\/privacy\">Privacy Policy<\/a><\/p><\/li>\n<li><p><strong>Make.com<\/strong> (formerly Integromat) \u2014 Automation platform. Receives a JSON webhook with full submission data on each form submission.\n<a href=\"https:\/\/www.make.com\/en\/terms\">Terms of Service<\/a> | <a href=\"https:\/\/www.make.com\/en\/privacy-notice\">Privacy Policy<\/a><\/p><\/li>\n<li><p><strong>Slack<\/strong> \u2014 Team messaging. Sends a formatted message containing form title and submitted field values to a Slack Incoming Webhook URL. No IP address or user agent is sent.\n<a href=\"https:\/\/slack.com\/terms-of-service\">Terms of Service<\/a> | <a href=\"https:\/\/slack.com\/trust\/privacy\/privacy-policy\">Privacy Policy<\/a><\/p><\/li>\n<li><p><strong>Mailchimp<\/strong> (Intuit) \u2014 Email marketing. Subscribes the visitor's email address and optionally mapped name fields to a Mailchimp audience list.\n<a href=\"https:\/\/mailchimp.com\/legal\/terms\/\">Terms of Service<\/a> | <a href=\"https:\/\/www.intuit.com\/privacy\/statement\/\">Privacy Policy<\/a><\/p><\/li>\n<li><p><strong>Salesforce<\/strong> \u2014 CRM. Submits mapped lead fields via the Web-to-Lead endpoint. Only the fields explicitly mapped by the administrator are sent.\n<a href=\"https:\/\/www.salesforce.com\/company\/legal\/\">Terms of Service<\/a> | <a href=\"https:\/\/www.salesforce.com\/company\/privacy\/\">Privacy Policy<\/a><\/p><\/li>\n<li><p><strong>HubSpot<\/strong> \u2014 CRM. Submits mapped contact properties to the HubSpot Forms API using a Private App token. Only the fields explicitly mapped by the administrator are sent.\n<a href=\"https:\/\/legal.hubspot.com\/terms-of-service\">Terms of Service<\/a> | <a href=\"https:\/\/legal.hubspot.com\/privacy-policy\">Privacy Policy<\/a><\/p><\/li>\n<li><p><strong>Custom Webhooks<\/strong> \u2014 Sends a signed JSON payload to an arbitrary endpoint URL configured by the site administrator.<\/p><\/li>\n<\/ul>\n\n<h3>Privacy<\/h3>\n\n<h4>Local Data Storage<\/h4>\n\n<ul>\n<li>Submissions are stored in a custom database table on your WordPress site when storage is enabled.<\/li>\n<li>IP address storage can be set to Full, Anonymized (last octet removed), or None per form.<\/li>\n<li>Automatic submission deletion can be enabled with a configurable retention period.<\/li>\n<li>API keys and secrets are encrypted at rest using AES-256-CBC and are never exposed in the admin UI or REST API responses.<\/li>\n<\/ul>\n\n<!--section=installation-->\n<ol>\n<li>Upload the plugin files to <code>\/wp-content\/plugins\/formatrica<\/code>, or install through the WordPress plugins screen<\/li>\n<li>Activate the plugin through the \"Plugins\" screen<\/li>\n<li>Visit <strong>Formatrica \u2192 Forms<\/strong> to create your first form<\/li>\n<li>Use the shortcode <code>[formatrica id=\"123\"]<\/code> or Gutenberg block to embed forms<\/li>\n<\/ol>\n\n<p><strong>First Time Setup<\/strong>\n1. Create your first form or apply a template\n2. Configure email delivery in form settings\n3. Test email delivery before going live<\/p>\n\n<!--section=faq-->\n<dl>\n<dt id=\"how%20do%20i%20send%20a%20test%20email%3F\"><h3>How do I send a test email?<\/h3><\/dt>\n<dd><p>Open a form in the builder, click <strong>Settings<\/strong>, navigate to <strong>Email Settings<\/strong> tab, configure your email settings, and click <strong>Send test email<\/strong>.<\/p><\/dd>\n<dt id=\"where%20are%20submissions%20stored%3F\"><h3>Where are submissions stored?<\/h3><\/dt>\n<dd><p>If storage is enabled, submissions are saved in <code>{$wpdb-&gt;prefix}formatrica_submissions<\/code> table with full field metadata.<\/p><\/dd>\n<dt id=\"can%20i%20create%20wordpress%20users%20from%20forms%3F\"><h3>Can I create WordPress users from forms?<\/h3><\/dt>\n<dd><p>Yes! Use the \"User Registration\" template or set form type to \"User Registration\" in settings. The form creates WordPress users and sends a verification email. The new user must confirm before logging in. The verification email is sent using the same delivery provider you configured for the form (SMTP\/API\/wp_mail).<\/p><\/dd>\n<dt id=\"why%20is%20the%20new%20user%20blocked%20from%20logging%20in%3F\"><h3>Why is the new user blocked from logging in?<\/h3><\/dt>\n<dd><p>For security, login is blocked until the user confirms their email. The verification link redirects back to the WordPress login screen with a success message.<\/p><\/dd>\n<dt id=\"how%20do%20i%20send%20slack%20notifications%3F\"><h3>How do I send Slack notifications?<\/h3><\/dt>\n<dd><p>Open a form, head to <strong>Settings \u2192 Integrations<\/strong>, enable Slack, and paste the webhook URL. Message templates support placeholders such as <code>{{form_title}}<\/code> and <code>{{field:email}}<\/code>. See the <a href=\"https:\/\/docs.nexusplugins.com\/products\/formatrica\">Slack integration guide<\/a> for a detailed walkthrough.<\/p><\/dd>\n<dt id=\"how%20do%20i%20add%20contacts%20to%20mailchimp%3F\"><h3>How do I add contacts to Mailchimp?<\/h3><\/dt>\n<dd><p>Enable <strong>Mailchimp<\/strong> in the Integrations tab, add your API key, fetch or paste the audience ID, then map the form fields for email and names. Toggle double opt-in if you want Mailchimp to send confirmation emails. See the <a href=\"https:\/\/docs.nexusplugins.com\/products\/formatrica\">Mailchimp integration guide<\/a> for screenshots and payload examples.<\/p><\/dd>\n<dt id=\"can%20i%20push%20submissions%20into%20salesforce%20or%20hubspot%3F\"><h3>Can I push submissions into Salesforce or HubSpot?<\/h3><\/dt>\n<dd><p>Yes. Enable <strong>Salesforce (Essentials)<\/strong> or <strong>HubSpot<\/strong>, provide the required identifiers (organisation ID, portal ID, form GUID, etc.) and map the fields you want to sync. Salesforce uses Web-to-Lead, while HubSpot submits to the Forms API with optional GDPR consent. Refer to the <a href=\"https:\/\/docs.nexusplugins.com\/products\/formatrica\">Salesforce<\/a> and <a href=\"https:\/\/docs.nexusplugins.com\/products\/formatrica\">HubSpot<\/a> integration guides.<\/p><\/dd>\n<dt id=\"do%20verification%20emails%20use%20my%20smtp%2Fapi%20settings%3F\"><h3>Do verification emails use my SMTP\/API settings?<\/h3><\/dt>\n<dd><p>Yes. If you configured a delivery provider in the form's Email Settings, verification emails are routed through the same provider. If no provider is set (e.g., registration created outside a form context), the plugin falls back to wp_mail().<\/p><\/dd>\n<dt id=\"how%20do%20i%20customize%20form%20styling%3F\"><h3>How do I customize form styling?<\/h3><\/dt>\n<dd><p>Add custom CSS in <strong>Settings \u2192 Advanced \u2192 Custom CSS<\/strong> per form, or target <code>.formatrica<\/code> classes in your theme.<\/p><\/dd>\n<dt id=\"what%20file%20types%20are%20allowed%20for%20uploads%3F\"><h3>What file types are allowed for uploads?<\/h3><\/dt>\n<dd><p>Default: JPG, PNG, GIF, WebP, PDF, DOC, DOCX, TXT. Customize via <code>formatrica_allowed_file_types<\/code> filter.<\/p><\/dd>\n<dt id=\"how%20do%20i%20anonymize%20ip%20addresses%3F\"><h3>How do I anonymize IP addresses?<\/h3><\/dt>\n<dd><p>Go to <strong>Settings \u2192 Privacy<\/strong> and select \"Store anonymized IP address\". This removes the last octet (e.g., 192.168.1.xxx).<\/p><\/dd>\n<dt id=\"can%20submissions%20be%20automatically%20deleted%3F\"><h3>Can submissions be automatically deleted?<\/h3><\/dt>\n<dd><p>Yes! In <strong>Settings \u2192 Privacy<\/strong>, enable \"Automatically delete old submissions\" and set retention period (default: 90 days).<\/p><\/dd>\n<dt id=\"how%20do%20i%20duplicate%20a%20form%3F\"><h3>How do I duplicate a form?<\/h3><\/dt>\n<dd><p>Hover over any form in the list and click <strong>Duplicate<\/strong>. The copy will have \" (Copy)\" appended to the title.<\/p><\/dd>\n<dt id=\"how%20do%20i%20disable%20a%20form%20without%20deleting%20its%20data%3F\"><h3>How do I disable a form without deleting its data?<\/h3><\/dt>\n<dd><p>Use the <strong>Deactivate<\/strong> action in the Forms list. Deactivated forms are hidden on the frontend and won\u2019t accept submissions, but you keep all data. You can re-enable via <strong>Activate<\/strong>.<\/p><\/dd>\n<dt id=\"what%E2%80%99s%20the%20difference%20between%20deactivate%20and%20delete%20permanently%3F\"><h3>What\u2019s the difference between Deactivate and Delete permanently?<\/h3><\/dt>\n<dd><p>Deactivate is a safe, reversible action and keeps submissions. <strong>Delete permanently<\/strong> removes the form and all its submissions after a confirmation. This cannot be undone.<\/p><\/dd>\n<dt id=\"can%20i%20filter%20between%20active%20and%20inactive%20forms%3F\"><h3>Can I filter between Active and Inactive forms?<\/h3><\/dt>\n<dd><p>Yes. Use the filters above the forms table: <strong>All<\/strong>, <strong>Active<\/strong>, <strong>Inactive<\/strong>. Counts are shown for each.<\/p><\/dd>\n<dt id=\"how%20do%20i%20connect%20my%20forms%20to%20zapier%3F\"><h3>How do I connect my forms to Zapier?<\/h3><\/dt>\n<dd><p>Open your form, go to <strong>Settings \u2192 Integrations<\/strong>, enable Zapier, and paste your Zapier webhook URL. In Zapier, create a Zap using \"Webhooks by Zapier\" \u2192 \"Catch Hook\". Submit a test form to send data to Zapier, then build your workflow.<\/p><\/dd>\n<dt id=\"how%20do%20i%20connect%20my%20forms%20to%20make.com%3F\"><h3>How do I connect my forms to Make.com?<\/h3><\/dt>\n<dd><p>Open your form, go to <strong>Settings \u2192 Integrations<\/strong>, enable Make, and paste your Make webhook URL. In Make.com, create a Scenario using \"Webhooks\" \u2192 \"Custom webhook\". Submit a test form to determine the data structure, then build your scenario.<\/p><\/dd>\n<dt id=\"what%20data%20is%20sent%20to%20integrations%3F\"><h3>What data is sent to integrations?<\/h3><\/dt>\n<dd><p>Integrations receive JSON with form title, submission data, field metadata, and context (IP, user agent). Use the <code>formatrica_webhook_payload<\/code> filter to customize the payload per integration.<\/p><\/dd>\n<dt id=\"does%20it%20work%20with%20page%20builders%3F\"><h3>Does it work with page builders?<\/h3><\/dt>\n<dd><p>Yes! Use the <code>[formatrica id=\"123\"]<\/code> shortcode in any page builder that supports WordPress shortcodes.<\/p><\/dd>\n<dt id=\"is%20it%20compatible%20with%20multilingual%20plugins%3F\"><h3>Is it compatible with multilingual plugins?<\/h3><\/dt>\n<dd><p>The plugin is translation-ready with full i18n support. Text domain: <code>formatrica<\/code><\/p><\/dd>\n<dt id=\"is%20source%20code%20for%20built%20assets%20included%3F\"><h3>Is source code for built assets included?<\/h3><\/dt>\n<dd><p>Yes. The plugin package includes the human-readable frontend\/admin source under <code>src\/<\/code> and the compiled runtime assets under <code>build\/<\/code>. Build command: <code>npm ci &amp;&amp; npm run build<\/code>.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.6 - 2026-03-06<\/h4>\n\n<ul>\n<li>Escaped all remaining output variables at the echo boundary (escape-late pattern) per WP.org reviewer feedback<\/li>\n<li>Hardened all wp_add_inline_style() and wp_add_inline_script() calls with wp_kses_no_null and close-tag neutralisation<\/li>\n<li>Removed phpcs:ignore EscapeOutput annotations replaced by proper escaping<\/li>\n<\/ul>\n\n<h4>1.0.5 - 2026-02-24<\/h4>\n\n<ul>\n<li>Removed all <code>use function<\/code> imports for WordPress global functions across 31 PHP files to resolve PHP \"name already in use\" errors in certain hosting environments<\/li>\n<\/ul>\n\n<h4>1.0.4 - 2026-02-24<\/h4>\n\n<ul>\n<li>Converted all inline <code>&lt;style&gt;<\/code> and <code>&lt;script&gt;<\/code> output to <code>wp_add_inline_style()<\/code> and <code>wp_add_inline_script()<\/code> for WordPress enqueue compliance<\/li>\n<li>Added comprehensive \"External Services\" section to readme.txt documenting all third-party services, data sent, and links to Terms of Service and Privacy Policy<\/li>\n<li>Encrypt CAPTCHA secret keys at rest and expose them as write-only fields in the builder<\/li>\n<li>Fixed \"Send test email\" button doing nothing when \"Use global Recipient email\" is enabled<\/li>\n<li>Fixed Plugin Check output-escaping issues for admin page header icon URLs<\/li>\n<li>Fixed translators comment placement for placeholder-based error strings<\/li>\n<\/ul>\n\n<h4>1.0.3 - 2026-02-15<\/h4>\n\n<p><strong>WordPress Plugin Directory Compliance<\/strong><\/p>\n\n<p>Security Hardening\n* Added ABSPATH direct-access guards to all 69 PHP files in app\/\n* Replaced all <code>error_log()<\/code> calls with hook-based debug logger (<code>formatrica_debug_log<\/code> action)\n* Escaped all frontend-facing exception messages with <code>esc_html__()<\/code> or <code>sanitize_text_field()<\/code>\n* Sanitized all <code>$_SERVER<\/code>, <code>$_GET<\/code>, and <code>$_COOKIE<\/code> superglobal reads with <code>sanitize_text_field(wp_unslash())<\/code>\n* Added PHPCS ignore annotations with rationale for legitimate nonce-free <code>$_GET<\/code> reads (admin screen checks, signed-token flows)<\/p>\n\n<p>Database\n* Hardened all SQL queries with <code>%i<\/code> identifier placeholders for table names<\/p>\n\n<p>Internationalization\n* Added <code>\/* translators: *\/<\/code> comments to all <code>sprintf()<\/code> calls containing translatable strings\n* Fixed unordered placeholders to use positional format (<code>%1$d<\/code>, <code>%2$d<\/code>)<\/p>\n\n<p>Filesystem\n* Replaced <code>unlink()<\/code> calls with <code>wp_delete_file()<\/code> in Export_Controller\n* Added PHPCS ignore annotations for legitimate filesystem operations (fopen, fwrite, fputcsv, fclose, filesize, readfile)<\/p>\n\n<p>Plugin Bootstrap\n* Removed manual <code>load_textdomain()<\/code> call (WordPress handles this automatically for directory-hosted plugins)\n* Fixed <code>Tested up to<\/code> header to use major.minor format (6.9)<\/p>\n\n<p><strong>Bug Fixes<\/strong>\n* Fixed \"Send test email\" button doing nothing when \"Use global Recipient email\" is enabled\n* Fixed additional Plugin Check output-escaping issues for admin page header icon URLs (Forms list, Settings, and Form Builder pages)\n* Fixed translators comment placement for placeholder-based error strings in form repository save\/duplicate operations<\/p>\n\n<h4>1.0.2 - 2026-02-14<\/h4>\n\n<ul>\n<li>Removed Microsoft Teams integration<\/li>\n<li>Added Privacy section to readme with third-party service disclosure<\/li>\n<li>Fixed Contributors field for WordPress.org compliance<\/li>\n<li>Cleaned up installation instructions for end users<\/li>\n<\/ul>\n\n<h4>1.0.1 - 2025-10-31<\/h4>\n\n<p><strong>Bug Fixes<\/strong>\n* Fixed: Mailpit sender domain enforcement causing unnecessary deliverability warnings during local development\n* Mailpit now bypasses sender domain validation (like API providers) since it's a development-only tool<\/p>\n\n<h4>1.0.0 - 2025-10-23<\/h4>\n\n<p><strong>Initial Release<\/strong><\/p>\n\n<p>Form Builder\n* Vue.js 3 + Pinia drag-and-drop form builder with SortableJS\n* Real-time field editing with live preview\n* Form preview functionality with zoom control (50-100%)\n* 15 pre-built templates\n* 13 field types with inline validation\n* Template selection modal with Quick Start notification<\/p>\n\n<p>Email Delivery\n* 9 email delivery providers: WordPress, SendGrid, SMTP2GO, Mailgun, Postmark, Brevo, Amazon SES, SMTP, Mailpit\n* Encrypted credentials storage (AES-256-CBC)\n* Test email functionality\n* Per-form email configuration<\/p>\n\n<p>Integrations\n* Zapier, Make.com, Slack integration\n* WordPress Post creation with full ACF support (20+ field types)\n* WooCommerce order creation\n* Mailchimp audience subscription\n* Salesforce Web-to-Lead\n* HubSpot Forms API\n* Custom webhooks with HMAC-SHA256 signing\n* Async integration queue for background processing (WordPress Cron)\n* Dramatically improved submission performance (5-15s \u2192 &lt;200ms for webhook-heavy forms)<\/p>\n\n<p>Security &amp; Privacy\n* Multiple CAPTCHA providers (reCAPTCHA v3, Turnstile, FriendlyCaptcha)\n* Honeypot protection, CSRF tokens, rate limiting\n* IP anonymization options (full, anonymized, none)\n* Auto-delete submissions after X days\n* GDPR-friendly data handling\n* File upload validation with MIME type checking<\/p>\n\n<p>User Registration\n* WordPress user registration form type\n* Email verification required before login\n* Verification emails use form's configured delivery provider\n* Login blocking for unverified users<\/p>\n\n<p>Developer Features\n* Comprehensive API documentation\n* 15+ action and filter hooks\n* REST API endpoints\n* Database schema versioning system with migration support\n* Service Layer Architecture with 22 specialized classes\n* PSR-4 autoloaded architecture\n* Modular ES6 JavaScript<\/p>\n\n<p>Admin Features\n* Active\/Inactive form filters with counts\n* Activate\/Deactivate actions\n* Safe delete confirmations\n* Form duplication\n* Settings modal with tabs (General, Email, Integrations, Security, Privacy, Advanced)<\/p>\n\n<p>Infrastructure\n* Custom database tables for forms and submissions\n* WordPress Cron integration for cleanup and async processing\n* Vite build system for assets\n* Full i18n support (text domain: formatrica)<\/p>\n\n<p>Code Quality\n* WordPress.org coding standards compliance\n* Removed aggressive admin notice suppression\n* Removed @ error suppressors (proper error handling)\n* Sanitized all nonce reads\n* PSR-12 code formatting standards<\/p>","raw_excerpt":"Lightweight drag-and-drop WordPress form builder with reliable email delivery, strong security, and flexible integrations. By NexusPlugins.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/284225","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=284225"}],"author":[{"embeddable":true,"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/thezoran"}],"wp:attachment":[{"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=284225"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=284225"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=284225"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=284225"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=284225"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/ky.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=284225"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}