Webcraft Forms

Most form plugins ask you to accept a third party: a captcha loaded from Google, entries kept in the vendor’s cloud, an account somewhere. Webcraft Forms is built the other way round.

What makes it different

• Spam protection that stays on your server. ALTCHA proof-of-work runs entirely on your own site – no account, no external service, no CDN, no data transfer. It is the default. Google reCAPTCHA is deliberately not supported at all.
• No outbound request, ever, unless you ask for one. No tracking, no phone-home, no usage statistics. The only optional exception is Friendly Captcha, and only if you switch it on with your own credentials.
• Nothing is stored anywhere but your database. Submissions are sent by e-mail and processed on your own server. There is no vendor cloud in the free version and none in the paid add-on either.
• Column layout per device. Set each field’s width separately for desktop, tablet and phone, with inheritance – the way a page builder works. The canvas narrows to the simulated device so you see the real result.
• Conditional display included, not sold separately. Show or hide any field based on other fields’ values, evaluated in the browser and verified again on the server.

This matters for sites under the GDPR, where every external service in a contact form is one more data processor to document. It is written for small and medium businesses that need a form which a data protection officer can sign off without a second thought.

The builder has its own admin interface and a live canvas: what you see while building is exactly what visitors see on the front end. It works independently of the block editor.

Building forms

• Live canvas with inline editing, drag and drop and row-based layout
• Field widths per device (desktop, tablet, phone) with inheritance, like a page builder
• Field types: text and multiline text, e-mail, phone, website, number, date, time, dropdown, radio buttons, checkbox, multiple choice, consent checkbox, multi-part name, heading with optional divider, free text, hidden field with a dynamic value
• Conditional display per field: show or hide a field based on the values of other fields, evaluated on the client and verified again on the server
• Duplicate forms, export and import them as JSON, start from one of three templates

Sending and confirmation

• Multiple recipients plus CC and BCC
• Reply-To set to the address the visitor entered
• Confirmation as an on-page message or as a redirect to any URL
• Auto-responder with its own subject and body, placeholder for the submitted data
• Internal label added to the notification only, never to the auto-responder

Spam protection

• Honeypot, always active
• ALTCHA: local proof-of-work, the default for new forms
• Friendly Captcha as an optional alternative. You bring your own site key and API key; the plugin only provides the connection fields and never proxies the service. Its browser SDK is bundled with the plugin, so nothing is fetched from a CDN. See «External services» below.

Output

• Shortcode [webcraft_form id="123"]
• Elementor widget, registered only when Elementor is active

Privacy

The free plugin makes no outbound request unless you explicitly choose Friendly Captcha. In that case the browser talks to Friendly Captcha to fetch and solve the puzzle, and your server verifies the submitted solution against the Friendly Captcha API using your own credentials. The SDK itself is served from your own site. With ALTCHA or without a captcha, the plugin contacts no external server at all.

Premium add-on

The separate add-on Webcraft Forms Premium adds file uploads, multi-step forms with a progress bar, tile choices with an image or icon per option, calculated fields, a signature pad, save and resume in the browser, conditional notifications and confirmations, entry storage with CSV export and a data retention period. The free plugin contains no locked premium code, only extension points.

External services

This plugin can use one external service. It is optional, switched off by default and only ever contacted when you select it for a form and enter your own credentials.

Friendly Captcha (Friendly Captcha GmbH, Am Anger 3-5, 82237 Woerthsee, Germany)

• What it is and what it is used for. Friendly Captcha is a proof-of-work anti-bot service. It is one of the spam protection methods offered per form, as an alternative to the built-in local method (ALTCHA) which needs no service at all. It is used only if you select «Friendly Captcha» in the form settings and enter your own site key and API key from your own Friendly Captcha account.
• What data is sent and when. Two moments only. First, when a visitor loads a page carrying such a form, the visitor’s browser requests a puzzle from Friendly Captcha and sends the connection, environment and interaction data that Friendly Captcha needs to assess it, including the IP address. Second, when the form is submitted, your server sends the solution together with your site key and API key to https://global.frcapi.com/api/v2/captcha/siteverify (or https://eu.frcapi.com/api/v2/captcha/siteverify if you switch on the EU endpoint) and receives back whether the puzzle was solved correctly. No form content is transmitted at any point.
• Where the code comes from. The browser SDK is bundled with this plugin (assets/vendor/friendlycaptcha, version 1.0.1, Mozilla Public License 2.0) and served from your own site. Nothing is loaded from a CDN.
• Terms and privacy. Terms of Use: https://friendlycaptcha.com/legal/terms/ – Privacy Policy for End Users: https://friendlycaptcha.com/legal/privacy-end-users/ – Legal centre: https://friendlycaptcha.com/legal/

If you do not select Friendly Captcha, this plugin makes no request to any external service.