Octa Forms

OctaForms is a forms plugin for WordPress with two ways to use it. Drop a form on any page with the [octa_form] shortcode and no code. Or build against a small REST API and let your own theme render the markup. Either way the plugin does the hard part. It validates every submission, stores it safely and delivers it by email and signed webhook.

There is no drag-and-drop builder on purpose. You get clean, fast forms and a delivery engine you can trust, not another page builder. The whole front end is under 10 KB of JavaScript and CSS over the wire, gzipped, and it never blocks your page from rendering.

Ready to use, no code needed

• The [octa_form slug="…"] shortcode renders any form you define, on a page or in a widget area.
• A starter contact form is created for you on first run, ready to wire up to your inbox.
• On top of that, an optional contact widget. A floating button opens a small popup with up to three tabs: Call us, Request a callback and Leave a message. Each tab appears only when you have set it up.
• File uploads. Add a file field and visitors can attach a document or a photo. A file that is too big or of the wrong type is caught before the upload starts, a progress bar shows how far a large one has got, and the file arrives attached to your notification email. The limit is 10 MB per file, or your server’s own limit when that is lower.
• Uploaded files are stored outside the media library, in a protected folder under unguessable names, so nobody reaches them by pasting a URL. Delete a submission and its files go with it.
• Ready for translation. Every string goes through the WordPress translation system, so the plugin picks up whatever your site language provides.

Built for developers

• Public REST API: a token endpoint and a per-form submissions endpoint. The form slug is a stable part of the contract and locks after you publish.
• Form definitions live as JSON on a private post type. You control the fields, validation rules, emails, webhooks and settings.
• A dry-run test panel. Preview validation, emails and webhook payloads for any form without sending an email or saving a submission.
• A validation engine with built-in rules (required, email, tel, min, max, date, regex and more). Add your own with the octa_forms_validation_rules filter.
• Multiple signed webhooks per form, with SSRF protection that re-checks DNS before every send. Each request carries an HMAC signature in the X-Octa-Forms-Signature header, computed over the raw body.
• Keep your forms in your theme. A form definition can live as a JSON file in {theme}/data/octa-forms/, so it is versioned with the rest of your code and travels between staging and production. Import it from the admin or with wp octa-forms theme import. The database stays the source of truth at runtime, the files never are.
• An optional vanilla JavaScript helper that implements the full token and retry contract for you. No framework, no build step.
• WP-CLI commands for the delivery queue and for syncing form definitions from your theme.
• Nothing hidden behind a build step. The JavaScript and CSS sources ship inside the plugin, in resources/, next to the compiled files in build/. Run npm install and npm run build to rebuild them yourself and compare.
• Thorough documentation. The full guides live at https://forms.octadevs.com/, covering the REST contract, theme integration, webhooks and every hook.

Reliable delivery

OctaForms puts durability before timeliness. Every delivery is saved to a queue before the visitor gets their response. The first email attempt runs inside the request and is guarded by a circuit breaker. Anything that fails is retried by cron with exponential backoff. Nothing is ever silently lost. Every protection and every degradation leaves a trace you can read in the admin or in Site Health.

The queue also keeps itself moving. On a site where WordPress cron is starved by a page cache or a blocked loopback, ordinary visitor traffic quietly tells the queue to send what is waiting. A notification does not sit for hours because nothing happened to trigger cron. It is a safety net rather than a replacement for a real system cron, it never hides a broken cron from Site Health, and you can switch it off in Settings.

Anti-spam that does not lose real leads

• A honeypot with a spam quarantine. Suspected spam is stored, not dropped, so you can review it and recover a real submission. A sudden spike usually means you are catching real people, for example browser autofill.
• Two-counter rate limiting. A flood of requests earns a short, temporary ban. A burst of genuine successful submissions from one network, like an office behind a single IP during a campaign, gets a polite ”try again shortly” instead of a ban.
• A stateless signed token that adds deduplication, a time trap and a JavaScript requirement. It is a helper, not your main defence. The honeypot and rate limiting are.
• Atomic deduplication. A double click returns the same submission and each delivery goes out once.

Measure what your forms do

• Form events reach Google Tag Manager on their own. A form start, a submission, a success, an error and every contact widget interaction land in the dataLayer, ready for you to build a conversion trigger on. You do not have to touch any code to get them there.
• The events describe the interaction, not the person. They carry the form, the place on the site and the outcome, and no visitor data at all. Nothing is sent anywhere until you build a trigger in your own tag manager, so the decision to measure stays yours.
• Every event is also available as a plain JavaScript event on the form, so your theme can react to a submission without a tag manager in the picture.
• An optional visit path records which pages someone looked at before they got in touch, so you can see what actually brought them to you. It is off by default, it stores page paths only and never the full address, and it records nothing until the visitor has agreed to analytics.

GDPR

• A consent snapshot stored with each submission: the field, the text that was shown, the value and the time.
• The visitor IP is stored only as a hash, kept for spam forensics. By default it never leaves your site. It is not in webhooks and not in exports. The one exception is the optional Akismet anti-spam check. If you turn it on, the submission content along with the visitor’s IP address and email are sent to Akismet to be scored for spam.
• Full integration with the WordPress ”Export” and ”Erase” personal data tools, covering submissions, their delivery records and the visit path.
• Retention with automatic cleanup, global or per form, with a matching cleanup of delivery records and of any files that came with a submission. The spam quarantine always clears after 30 days.
• CSV export limited to received submissions by default, hardened against spreadsheet formula injection.
• Optional full data removal on uninstall.

External services

By default OctaForms sends no data to any third party. It stores and delivers on your own site, and the plugin makes no outbound request until you turn the Akismet check on yourself.

Akismet spam checking (optional, off by default)

Akismet is a spam filtering service run by Automattic. OctaForms can send each submission to it for a spam score, so that obvious spam is quarantined instead of landing in your inbox. Nothing is sent unless you tick ”Check submissions with Akismet” in Settings and save an Akismet API key.

The plugin contacts two endpoints:

• https://rest.akismet.com/1.1/verify-key when you save the settings page with a key. It sends the API key and your site address, so a wrong key is reported to you straight away.
• https://{your-key}.rest.akismet.com/1.1/comment-check once per submission, while the submission is being processed. It sends the text the visitor typed, their email address, their IP address, their browser’s user agent and referrer, and your site address. Uploaded files are never sent.

If Akismet is slow or unreachable the submission goes through anyway, so a real lead is never lost to a failed check.

Terms of service: https://akismet.com/tos/ Privacy policy: https://akismet.com/privacy/ Automattic privacy policy: https://automattic.com/privacy/