Title: Wiwi Forms – Form Builder Author: Naiche Published: August 27, 2026 Last modified: September 8, 2026 --- Search plugins ![](https://s.w.org/plugins/geopattern-icon/wiwi-forms.svg) # Wiwi Forms – Form Builder By [Naiche](https://profiles.wordpress.org/naiches/) [Download](https://downloads.wordpress.org/plugin/wiwi-forms.1.0.1.zip) * [Details](https://az-tr.wordpress.org/plugins/wiwi-forms/#description) * [Reviews](https://az-tr.wordpress.org/plugins/wiwi-forms/#reviews) * [Installation](https://az-tr.wordpress.org/plugins/wiwi-forms/#installation) * [Development](https://az-tr.wordpress.org/plugins/wiwi-forms/#developers) [Support](https://wordpress.org/support/plugin/wiwi-forms/) ## Description Wiwi Forms is a lightweight WordPress form builder designed for developers and site owners who want a clean, fast, and privacy-focused form solution without the bloat. **About the name:** Wiwi Forms is built and maintained by Wiwi Websolutions, alongside Wiwi Cookie Consent. **Key Features:** * Drag-and-drop form builder with 17 field types and multi-step forms * Encrypted entry storage (libsodium) with a dedicated site key * Encrypted file uploads on disk * AJAX form submission (no page reload) * Bootstrap 5 form classes — works natively with Bootstrap themes * Email notifications with delivery tracking (sent/failed status per entry) * GDPR/AVG/ePrivacy compliance: encrypted storage, auto-delete retention, consent field * Anti-spam: honeypot, time token, rate limiting, math captcha * No tracking cookies or sessions; one short-lived functional cookie for non-JavaScript submissions; fully cache-compatible (LiteSpeed, WP Rocket, Cloudflare) * jQuery-free front end; the admin settings screen uses WordPress’s bundled colour picker * English + Dutch translations included **Field Types:** Text, Textarea, Select, Radio, Checkbox, Number, Email, Phone (with country prefix), Date/Time, File Upload, Hidden, Math Captcha, HTML, Heading, Separator, GDPR Consent, Page Break. ## Installation 1. Upload the `wiwi-forms` folder to `/wp-content/plugins/` 2. Activate the plugin through the ‘Plugins’ menu 3. Go to Wiwi Forms Add New to create your first form 4. Use the shortcode `[wiwi-forms id="X"]` to embed forms ## FAQ ### Is Wiwi Forms GDPR compliant? Yes. All form entries are encrypted with libsodium before storage. File uploads are encrypted on disk. An auto-delete retention policy lets you purge data after a configurable number of days. The GDPR Consent field auto-links to your Privacy Policy, Terms, and Cookie Policy pages. ### Does Wiwi Forms use cookies? Wiwi Forms uses no tracking cookies, sessions, or localStorage. On non-JavaScript submissions, it sets one functional cookie containing a random token for up to five minutes so the form can be re-populated after the redirect. The cookie is HTTP-only, SameSite=Lax, and Secure on HTTPS. Forms remain compatible with page caching solutions. ### Does Wiwi Forms require jQuery? The front end loads no jQuery. The admin settings screen uses WordPress’s bundled colour picker, which depends on jQuery. ### Does Wiwi Forms support WordPress multisite? Install and activate Wiwi Forms separately on each site. Network activation is not supported. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Wiwi Forms – Form Builder” is open source software. The following people have contributed to this plugin. Contributors * [ Naiche ](https://profiles.wordpress.org/naiches/) [Translate “Wiwi Forms – Form Builder” into your language.](https://translate.wordpress.org/projects/wp-plugins/wiwi-forms) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/wiwi-forms/), check out the [SVN repository](https://plugins.svn.wordpress.org/wiwi-forms/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/wiwi-forms/) by [RSS](https://plugins.trac.wordpress.org/log/wiwi-forms/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.1 * Added: every submission is now scored for spam and the score is recorded with the entry, visible as a column in the entries list and as a breakdown of the signals that fired. Nothing is blocked, held back or filtered on that score in this release — it is recorded so the thresholds can be set from real data before anything acts on them. Existing behaviour is unchanged. * Security: files attached to a conditionally hidden upload field were stored without any of the field’s checks — allowed types, blocked types, size and count were all skipped. * Security: a solved captcha could be reused indefinitely. Each challenge is now single-use and expires, while still working behind full-page caching. * Security: decrypted copies of uploaded files could be left behind in the server’s temporary directory after an interrupted download or a mail failure. * Fixed: the encryption key is no longer derived from the WordPress salts, so rotating them no longer makes existing entries and uploads unreadable. Data saved before this update is still readable. * Fixed: auto-delete retention deleted the entry but kept its uploaded files on disk permanently. * Fixed: draft, private and trashed forms still rendered and accepted public submissions. * Fixed: a submission could report success after an uploaded file failed to save. * Fixed: exporting entries from more than one form labelled every row with the first form’s fields. * Fixed: the Apply button below the entries list did nothing. * Fixed: on multi-step forms, headings, separators and HTML blocks appeared on every step at once. * Fixed: the fallback used when JavaScript is unavailable submitted nothing. * Fixed: large uploads are encrypted in chunks instead of being held in memory whole. * Fixed: database changes are now applied when the plugin updates, not only when it is activated. * Changed: building forms now requires an administrator, matching the permission already needed to read submissions. * Removed: the entries search box, which could never match anything because entries are encrypted at rest. * Fixed: double-submit protection did nothing. The script disabled a hidden field that shares the submit button’s name instead of the button itself, so the button stayed live and a second click sent the form again — creating duplicate entries. * Fixed: behind a full-page cache, forms eventually stopped accepting submissions with “This form has expired”. The submit nonce is no longer written into cacheable HTML at all; JavaScript obtains it from the uncacheable token endpoint before submission, while the signed time token preserves the non-JavaScript path for public forms. * Fixed: the token refresh could be refused for a second visitor on the same network within five seconds, because the rate limit counted everyone behind one connection as one visitor. The limit now applies only to issuing new captchas, which is what it was there to protect. #### 1.0.0 * Initial release. ## Meta * Version **1.0.1** * Last updated **53 minutes ago** * Active installations **Fewer than 10** * WordPress version ** 7.0 or higher ** * Tested up to **7.1** * PHP version ** 8.4 or higher ** * Language * [English (US)](https://wordpress.org/plugins/wiwi-forms/) * Tags * [bootstrap](https://az-tr.wordpress.org/plugins/tags/bootstrap/)[contact form](https://az-tr.wordpress.org/plugins/tags/contact-form/) [encrypted](https://az-tr.wordpress.org/plugins/tags/encrypted/)[form builder](https://az-tr.wordpress.org/plugins/tags/form-builder/) [GDPR](https://az-tr.wordpress.org/plugins/tags/gdpr/) * [Advanced View](https://az-tr.wordpress.org/plugins/wiwi-forms/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/wiwi-forms/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/wiwi-forms/reviews/) ## Contributors * [ Naiche ](https://profiles.wordpress.org/naiches/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/wiwi-forms/)