About this plugin
AllTerrain Forms is a complete WordPress form builder — contact forms, survey forms, quiz forms, registration forms, order forms, booking forms, feedback forms — with every feature included, free, forever.
Conditional logic. Calculations. Multi-page forms.
File uploads. Signatures.
Save and resume. Entry management with CSV export. Webhooks.
Form analytics
with Net Promoter Score. User registration. Ten form themes you can rebuild
without writing CSS.
There is no Pro version, no upsell notice in your dashboard, no feature that
turns out to need a licence key. None of these things are hard to build. They
were only ever sold separately because somebody could.
Drag and drop form builder
Create a form by dragging. Pull a field from the palette onto the canvas, drop
it where you want it, type the label. That is the whole learning curve — 37
field types, from a simple text box to a signature pad to a Likert matrix, and
every one behaves the same way.
Or start from a template: contact form, event RSVP, job application, survey,
quiz, order form, registration form, feedback form, booking form and bug report.
Then paste one shortcode into a page, or drop in the Form block and pick
your form from a list:
[allterrain_form id="12"]
Conditional logic you can actually see
Show and hide fields, pages, emails and confirmations based on answers. Most
form builders tell you a field has a rule and leave you to go and find out
what it says. This one writes it on the card — Shown when · Can you make it?
· is · Yes — and draws a line from the question that decides to the fields it
decides, labelled with the answer that triggers them.
Hover a field and everything it does not touch fades. A rule pointing at a
question you deleted turns red, because that form is stuck and you would never
otherwise know.
Multi-step forms, calculations and totals
Break long forms into pages with per-step validation and a progress indicator.
Add calculated fields and running totals — an order form that adds up, a quote
form that quotes. Payment-style product and option fields keep their prices.
File upload forms and signatures
Accept file uploads with per-field type and size limits, stored in a protected
directory and attached to the entry. Collect a real drawn signature. Uploads
are parented to their submission, so deleting the entry cleans up after itself.
Survey builder, quiz builder and NPS
The survey builder makes survey forms with rating scales, opinion scales,
Likert matrices and 0–10 questions. The quiz builder adds scoring and
per-answer feedback. The Analytics window turns responses into answers: submissions over time,
conversion and completion rates, per-question distributions, a Net Promoter
Score panel, and any question broken down by any other question.
Entry management, search and CSV export
Every submission is saved as an entry. Search answers, filter by form, status
and star, read one beside the list, add private notes, and export to CSV or
JSON. Unread counts, a spam folder, and bulk actions included.
Email notifications, confirmations and webhooks
Send conditional notification emails with CC, BCC, reply-to and attachments.
Show a message, redirect, or send visitors to a page — conditionally, per
answer. POST every entry as JSON to any URL, signed with HMAC-SHA256, and
hook alltfo_entry_created for anything else.
Grows your MailPoet lists
With MailPoet installed, any form can subscribe visitors to your lists —
bound to an opt-in box they actually tick, with MailPoet’s own double opt-in
confirming every address. Map the email and name fields, pick the lists, done.
The kind of integration that is a paid addon elsewhere, free here.
Every email and confirmation has an Insert a value button that lists your
own questions by the label you wrote — not {field:f2} — with a live preview
of the finished text.
Import from Contact Form 7, WPForms and Gravity Forms — entries too
Switching form plugins? You do not have to go looking. Activate AllTerrain
Forms and it tells you what it found — “AllTerrain Forms found 6 forms in
Contact Form 7” — with one button that migrates all of them. Conditional
logic carries across, payment fields keep their prices, an order total keeps
calculating, and a Gravity Forms List becomes a real repeater.
The stored submissions come too. Messages Flamingo kept for Contact Form 7,
Gravity Forms entries, and WPForms Pro entries can all be brought across after
their form is — each with its original date, spam filed as spam, and the
originals left untouched. Running an import twice never imports anything
twice, and everything still works after the old plugin is deactivated, because
the data outlives the plugin.
Ten form themes, and an eleventh you make yourself
Clean, Midnight, Glass, Brutal, Paper, Neon, Terminal, Soft, Editorial and
Holo. A theme here is a flat list of 69 design tokens — no theme PHP, no
template, no stylesheet to edit.
Theme Studio gives you a control for every token and a live preview that
updates the instant you click. Six plain-language dials cover the common case:
Accent, Roundness, Density, Depth, Fields, Labels. Nobody thinks
“radius-field: 14px” — they think rounder. Save your changes as a theme,
pick it on any form, export it as JSON, import it on another site.
Spam protection without a CAPTCHA
A honeypot, a signed time trap, a per-address rate limit, a word blocklist,
and — if you already have it and switch it on for a form — Akismet. Nothing
asks a visitor to identify traffic lights, because a CAPTCHA charges the
visitor for the site’s spam problem and fails accessibility for a good number
of people.
Anything judged spam is kept, in a spam folder, never silently thrown away.
Accessible (WCAG AA) and works without JavaScript
Real labels bound to real controls. Grouped inputs in a fieldset with a
legend. Hints and errors wired with aria-describedby. An error summary that
takes focus. Every theme meets WCAG AA contrast, and the test suite fails if
one stops.
And the form works with JavaScript switched off — a real POST, real
server-side validation, errors against the right fields, answers still in the
boxes.
GDPR-friendly by structure
A form is a post. An entry is a post. A note on an entry is a comment.
Nothing
lives in a custom table, so WordPress’s own privacy exporter and eraser, user
capabilities, search and the trash already work on your form data. A consent
field, IP anonymisation and per-form storage controls are built in — and
nothing is ever sent to us. The only third parties your data can reach are the
ones you configure yourself, listed under External services below.
Ready for AI agents — WordPress Abilities API and MCP
AllTerrain Forms describes itself to AI agents. Nine abilities registered
through WordPress’s Abilities API let an agent — over MCP or the REST API —
list your forms, read a form’s questions, build a whole form from a
description, apply a theme, submit entries through the same validated
anti-spam pipeline a visitor uses, query submissions with human-readable
answers, and pull the full analytics report (conversion, distributions, NPS)
as structured data.
The nine, by name:
- list-forms — every form with its id, title, theme, shortcode, entry count and questions. The starting point; its ids feed everything else.
- get-form — one form’s questions in full: field ids, types, labels, required flags and choices. Read it before submitting or interpreting entries.
- list-field-types — the vocabulary for building: all 37 field types with what each stores.
- create-form — builds a form from a title and a plain list of fields, and returns the shortcode ready to paste.
- set-form-theme — dresses a form in any installed theme, by slug.
- submit-form — submits answers through the visitor pipeline: availability, validation, anti-spam, storage, notifications. Refusals return per-field errors and store nothing.
- list-entries — queries submissions with search, date range, status and pagination; answers come back raw and human-readable.
- get-entry — one submission in full, every answer labelled and formatted.
- form-report — the analytics as data: views, conversion, completion, a 90-day timeline, per-question distributions, NPS, and breakdowns by any grouping question.
Every ability carries a JSON Schema and a capability check, and none of them
has logic of its own — an agent and a human clicking the same button get the
same behaviour. Ask your assistant to “make a booking form and show me last
week’s responses”, and this is what it calls.
Built on OpenStation
AllTerrain Forms is an OpenStation
desktop app, and OpenStation is required — WordPress installs it alongside
this plugin and keeps the two together. OpenStation turns wp-admin into a
windowed desktop: the builder is a real window you can put beside your
entries, drag a field from one form into another, and drop an image straight
from the media browser onto a choice. That spatial way of working is the
product, which is why the plugin does not ship a lesser version of itself
without it.
Your visitors are never part of that dependency: published forms render and
submit on the front end regardless of what is happening in the admin.
External services
The plugin makes no connection of its own to us or to anyone else — no
org.
Two optional features send data to a destination you choose:
- Akismet — off by default on every form, even when the
Akismet plugin is installed and
configured on your site. Only when you switch it on for a form is each
submission to that form (the answers, plus the sender’s IP and user agent)
sent to Akismet’s servers for a spam verdict, with spam/ham corrections you
make in the entries screen reported back. Corrections obey the same per-form
switch: marking an entry spam or not-spam on a form that has Akismet off
sends nothing. Without the Akismet plugin, or with the per-form switch off,
nothing is ever sent. See the
Akismet Terms of Service and the
Automattic Privacy Policy.
- Webhooks — a form can POST each entry as JSON to a URL you enter,
signed with HMAC-SHA256. Entries go only to the address you configured, and
the feature is off until you configure one.
Built in the open
Source, issue tracker and full developer documentation:
com/AllTerrainDeveloper/forms
Over 800 automated tests, and the conditional-logic and calculation engines
are tested against one shared table of cases in both PHP and JavaScript —
because if the browser and the server ever disagreed about which fields were
required, you would be shown a form you could not submit.