Xtreme Forms – WP Contact Form Builder, Lead Capture, Form to Email & Webhooks

Xtreme Forms is a modern, drag-and-drop contact form and lead capture plugin for WordPress. Build any form you need — contact forms, quote requests, event registrations, newsletter signups, multi-step lead qualification — then capture every submission into a built-in lead inbox, route email notifications to the right person, fire webhooks to your CRM, and track conversions on a clean analytics dashboard.

No upsells. No “Pro-only” features hidden inside the free download. Every feature listed below ships in the free plugin and is fully functional out of the box. The optional Pro add-on (sold separately at xtremeplugins.com) only adds advanced routing rules, retry queues, and extended analytics — it never gates or limits any feature you see on this page.

Useful Links

• Plugin homepage: https://xtremeplugins.com/plugins/xtreme-forms — overview, screenshots, live demo
• Features: https://xtremeplugins.com/plugins/xtreme-forms#features — full feature breakdown with comparison vs other form plugins
• Pricing: https://xtremeplugins.com/plugins/xtreme-forms/pricing — Pro add-on plans (free plugin stays free forever)
• Support: the WordPress.org support forum for free-version questions; Pro subscribers get priority support at xtremeplugins.com
• Source / issues: GitHub

Why Xtreme Forms?

If you’ve used the other popular form plugins (WPForms, Contact Form 7, Gravity Forms, Ninja Forms, Formidable Forms) you already know the trade-offs: free versions lock the features you actually need behind a Pro upgrade, the lighter ones don’t manage your leads after the email is sent, and the heavier ones drag down page speed with bloated assets. Xtreme Forms is built differently:

• Real lead management, not just form-to-email. Every submission lands in a searchable, filterable inbox with a full status workflow (new → read → contacted → converted), per-lead notes, tags, assignment to team members, and an append-only audit log. Treat your leads like a pipeline, not like inbox clutter.
• Everything in the free download is actually free. Drag-and-drop builder, conditional logic, webhooks, analytics, GDPR tools, multisite, audit log, JSON import/export — no popup nag screens, no “upgrade to Pro” overlay on settings pages.
• Lightweight on the page. No jQuery dependency on the frontend, no third-party font request, no external service call unless you explicitly enable and configure one.
• Modern WordPress stack. Tested up to WordPress 7.0, requires PHP 8.1+, ships a native Gutenberg block alongside the classic shortcode, and works inside any block-theme template / Elementor / Bricks / Beaver Builder widget that accepts shortcodes.
• WordPress.org-compliant. Fully GPL, no obfuscated code, no telemetry, no auto-update side-channels, and every external-service touchpoint is disclosed below.

A solid free alternative to WPForms for site owners who want lead management built in, not an afterthought.

Built-in Form Templates

Skip the blank canvas. Xtreme Forms ships ready-to-go templates for the forms you actually need:

• Simple Contact Form — name, email, message — the classic WordPress contact form
• Quote Request Form — name, email, phone, project description, budget range
• Event Registration Form — full name, email, phone, company, attendee count, date picker
• Newsletter Signup Form — name, email, GDPR consent
• Multi-step Lead Qualification Form — built using the conditional-logic engine
• Booking / appointment request form — fully customizable in the drag-and-drop form builder

Works With Your Page Builder

The [xtreme_forms id="X"] shortcode and the native Gutenberg block work inside every WordPress page builder and block theme:

• Elementor — drop the shortcode in the Shortcode widget, or use the Gutenberg block in Elementor Pro’s container element
• Bricks Builder — works via shortcode element
• Beaver Builder — works via the Text/HTML or Shortcode module
• Divi — works in any Text or Code module via shortcode
• Oxygen Builder — works via shortcode element
• WPBakery Page Builder — works via the Raw HTML / Shortcode element
• Block-based themes (Twenty Twenty-Four, Twenty Twenty-Five, Frost, Blockbase) — native Gutenberg block with live preview
• Classic editor — paste the shortcode anywhere

Switching From Another WordPress Form Plugin?

If you’re moving away from a heavier or upsell-driven WordPress contact form plugin — WPForms, Contact Form 7, Gravity Forms, Ninja Forms, Formidable Forms, Forminator, Fluent Forms, Everest Forms, or Happyforms — Xtreme Forms makes the transition straightforward:

• Rebuild forms in minutes using the drag-and-drop builder + the six ready-made templates above
• Bring existing leads with you via the JSON import endpoint — map your old plugin’s CSV/JSON export to the Xtreme Forms lead schema
• Keep your email recipients and routing rules — Xtreme Forms’s email-routing engine accepts the same rule structure most form plugins use (field value → recipient address)
• Shortcode parity — the [xtreme_forms id="X"] shortcode drops into any page that was using [wpforms id="X"], [contact-form-7], [gravityform id="X"], etc., so you don’t have to touch every theme template
• No vendor lock-in — your leads, forms, and audit log live in your own WordPress database, exportable as JSON at any time

Core Features (Free)

• Drag-and-drop Form Builder — text, email, phone, select, checkbox, radio, textarea, date, file, hidden fields with per-field conditional logic
• Lead Inbox — searchable, filterable lead list with status management (new, read, contacted, converted, archived, spam)
• Email Notifications — route notifications to different recipients based on form field values
• Auto-Responder — send a branded confirmation email to the lead on submission
• Email Templates — reusable templates with merge tags ({{first_name}}, {{form_name}}, etc.)
• Webhooks — fire HTTP POST payloads to external URLs on lead capture with delivery logging
• Analytics Dashboard — submission trends, conversion rates, top forms, lead source breakdown
• UTM Tracking — automatically capture and store UTM parameters with each lead
• Duplicate Detection — configurable duplicate suppression by email/phone within a time window
• Spam Protection — honeypot, time-gate, reCAPTCHA v3, and keyword blocklist
• GDPR Tools — consent checkbox, right-to-erasure helper, configurable data retention (tools to support your own GDPR workflow; the plugin does not guarantee legal compliance)
• Activity Timeline — per-lead event history (submitted, emailed, status changes, notes)
• Notes — add internal notes to any lead
• Tags — tag and filter leads with custom labels
• Audit Log — append-only log of all admin actions
• Import / Export — full JSON round-trip export and import
• Multisite Support — per-site tables, network-aware activation
• Gutenberg Block — embed any form with the Xtreme Forms block (live editor preview)
• Shortcode — [xtreme_forms id="X"] works everywhere

Optional Pro Add-On

An optional paid add-on is sold separately by the author. It is not required for any feature listed above and is not bundled with this plugin.

• Plugin page (overview + demo): xtremeplugins.com/plugins/xtreme-forms
• Full feature list: xtremeplugins.com/plugins/xtreme-forms#features
• Pricing & plans: xtremeplugins.com/plugins/xtreme-forms/pricing

What the Pro add-on adds on top of the free download:

• Priority routing rules with complex AND/OR conditions
• Webhook retry queue with exponential backoff
• Advanced analytics: cohort analysis, lead value tracking
• Priority email support from the developer

External services

Xtreme Forms is fully self-hosted by default. It only contacts third-party services when a site administrator explicitly enables and configures the corresponding feature. Each service below is opt-in: nothing is sent until you turn it on and provide credentials.

Google reCAPTCHA v3 (optional spam protection)

If you enable reCAPTCHA v3 in Xtreme Forms → Settings → Spam Protection and enter your site/secret keys, the public-facing form page loads the reCAPTCHA JavaScript from https://www.google.com/recaptcha/api.js, which executes in the visitor’s browser to generate a token. On submit, the plugin then sends a server-to-server request from your site to https://www.google.com/recaptcha/api/siteverify containing the token, your secret key, and the visitor’s IP address so Google can return a spam score.

Service provider: Google LLC. Terms of service: https://policies.google.com/terms Privacy policy: https://policies.google.com/privacy reCAPTCHA-specific terms: https://www.google.com/recaptcha/about/

Cloudflare Turnstile (optional spam protection)

If you enable Cloudflare Turnstile in Xtreme Forms → Settings → Spam Protection and enter your site/secret keys, the public-facing form page loads the Turnstile widget from https://challenges.cloudflare.com/turnstile/v0/api.js. On submit, the plugin sends a server-to-server request from your site to https://challenges.cloudflare.com/turnstile/v0/siteverify containing the widget token, your secret key, and the visitor’s IP address so Cloudflare can validate the challenge.

Service provider: Cloudflare, Inc. Terms of service: https://www.cloudflare.com/website-terms/ Privacy policy: https://www.cloudflare.com/privacypolicy/

Zoho CRM (optional integration)

If you enable the Zoho integration in Xtreme Forms → Automations → Integrations and enter your OAuth client ID, client secret, refresh token, and data-center region, then for every new lead capture the plugin makes two server-to-server requests from your site to Zoho:

1. A token exchange request to https://accounts.zoho.<tld>/oauth/v2/token (where <tld> is com, eu, in, au, or jp based on the region you select) containing your refresh token, client ID, and client secret.
2. A lead-create request to https://www.zohoapis.<tld>/crm/v2/Leads containing the lead’s name, email address, phone number, and company name (only the fields that were submitted in the form).

Service provider: Zoho Corporation Pvt. Ltd. Terms of service: https://www.zoho.com/terms.html Privacy policy: https://www.zoho.com/privacy.html

HubSpot CRM (optional integration)

If you enable the HubSpot integration in Xtreme Forms → Automations → Integrations and enter a Private App access token, then for every new lead capture the plugin makes a server-to-server request from your site to https://api.hubapi.com/crm/v3/objects/contacts containing the lead’s email, first/last name, phone number, and company name (only the fields that were submitted in the form). When you click the Test button on the integrations page, the plugin also sends a single GET request to the same host to verify the token.

Service provider: HubSpot, Inc. Terms of service: https://legal.hubspot.com/terms-of-service Privacy policy: https://legal.hubspot.com/privacy-policy

Salesforce (optional integration)

If you enable the Salesforce integration in Xtreme Forms → Automations → Integrations and enter your consumer key, consumer secret, instance URL, and access token, then for every new lead capture the plugin makes a server-to-server request from your site to <your_instance_url>/services/data/v57.0/sobjects/Lead/ containing the lead’s last name, email, phone number, and company name (only the fields that were submitted in the form).

Service provider: Salesforce, Inc. Terms of service: https://www.salesforce.com/company/legal/agreements/ Privacy policy: https://www.salesforce.com/company/privacy/

Pipedrive (optional integration)

If you enable the Pipedrive integration in Xtreme Forms → Automations → Integrations and enter an API token, then for every new lead capture the plugin makes two server-to-server requests from your site to https://api.pipedrive.com/v1/persons and https://api.pipedrive.com/v1/leads containing the lead’s name, email, and phone number (only the fields that were submitted in the form). The Test button sends one GET request to https://api.pipedrive.com/v1/users/me to verify the token.

Service provider: Pipedrive OÜ. Terms of service: https://www.pipedrive.com/en/terms-of-service Privacy policy: https://www.pipedrive.com/en/privacy

Webhooks (optional, user-defined destination)

If you create one or more webhooks in Xtreme Forms → Automations → Webhooks, the plugin will send the captured lead’s data as a JSON POST request to the URL(s) you configure for every new lead. These URLs are arbitrary endpoints that you (the site administrator) choose; the plugin itself is not affiliated with any particular webhook destination. Review the terms/privacy policy of whichever service you point your webhooks to.

Xtreme Plugins licensing API (optional, only for the paid Pro add-on)

The free Xtreme Forms plugin on WordPress.org is fully functional with no license required. A separately-sold Pro add-on is available from xtremeplugins.com; if (and only if) a site administrator chooses to buy it, the free plugin includes a “License” tab under Xtreme Forms → Settings → License that activates the Pro key.

The licensing API is only contacted when the administrator actively clicks a button on that tab:

1. Clicking Activate sends a server-to-server POST from your site to https://xtremeplugins.com/api/v1/license/activate containing the license key the admin entered and your site URL (home_url()), so the licensing server can validate the key and bind a seat to this site.
2. Clicking Deactivate sends a server-to-server POST from your site to https://xtremeplugins.com/api/v1/license/deactivate containing the same two values, so the licensing server can release the seat.

No request is ever made on form submissions, page loads, or in the background — the endpoints are only hit on the two explicit button clicks above, and only after an administrator has typed in a license key. If you never use the License tab, the plugin never contacts xtremeplugins.com. The endpoint URLs can be overridden (for example to point at a self-hosted licensing server or a staging environment) via the xtremeforms_license_activate_url and xtremeforms_license_deactivate_url filters.

Service provider: XtremePlugins (xtremeplugins.com). Terms of service: https://xtremeplugins.com/terms Privacy policy: https://xtremeplugins.com/privacy