Flexsolutions Form Builder

Flexsolutions Form Builder makes forms that look like your site and work in any language, with entries, file uploads and conditional fields included for free.

It matches your theme. json and Global Styles, so a form looks at home in Twenty Twenty-Five or any block theme without writing CSS.

It speaks Arabic. org’s language packs.

Everything is free. Entries, file uploads, conditional fields, columns and templates are part of the free plugin, with no upgrade screens and no locked fields.

Free, with no limits

• Saved entries with search, tags, notes, editing and CSV export.

• File uploads, checked and stored privately.

• Conditional fields that show parts of a form only when another answer matches.

• Multi-column layouts and eight ready-made templates.

• Cloudflare Turnstile, reCAPTCHA v3, hCaptcha and Akismet spam checks.

• Free forever: nothing in the free plugin will move to a paid version. Future paid features will come as a separate add-on.

No lost messages

Every submission is saved before the notification email is sent. A failed email is retried and can be resent from the entry, and Flexsolutions Form Builder → Diagnostics has a “Send test email” button that shows the mail server’s error.

All features

Build forms with the drag-and-drop builder (or plain HTML plus form tags), then embed them with a shortcode or the “Flexsolutions Form Builder form” block.

• Field types: text, email, url, tel, number, date, textarea, select (single/multiple), checkbox, radio, acceptance, submit.

• Server-side validation of every rule, whatever the browser does.

• Mail templates with placeholders, optional auto-reply.

• AJAX submission with inline errors, and it still works without JavaScript (Post/Redirect/Get).

• Drag-and-drop form builder: click or drag fields from a palette, reorder cards, nest fields in conditional groups, and edit each field in a settings panel that shows only the options that field type has. Keyboard users can move cards with up/down buttons. A Tags view shows the same form as tags for full control.

• Configuration check that flags mistakes before visitors hit them.

• Per-form settings: demo mode, logged-in users only, redirect to a thank-you page after success.

• Built-in spam protection: honeypot, time trap, per-IP rate limit, nonces for logged-in users.

• CAPTCHA: Cloudflare Turnstile, Google reCAPTCHA v3 or hCaptcha, verified on the server. Other providers can be added with a filter.

• Optional Akismet checks and the WordPress disallowed-words list.

• Department routing with pipes, hidden fields, dynamic defaults, character counters.

• HTML or plain-text mail, CC/BCC, a fixed From address, and option to leave out empty lines.

• Instant validation in the browser using the same rules and messages as the server.

• File uploads with size, type and real-content checks; files attached to the email and stored privately.

• Entries: submissions saved in the database, with search, filters, tags, notes, editing with a change history, CSV export of exactly what the list shows, retention period and WordPress privacy export/erase tools.

• Conditional fields: show parts of a form only when another answer matches.

Requirements and compatibility

These combinations are tested automatically on every change:

• PHP: 8.2, 8.3 and 8.4.

• WordPress: 6.8 and the latest release (7.1 at the time of writing).

• Database: MySQL 8.0, MariaDB 10.6 and MariaDB 11.4.

• Browsers: the form and the builder are tested in Chromium. They use only standard HTML, CSS and JavaScript supported by current Chrome, Edge, Firefox and Safari; forms also work with JavaScript turned off.

• Right-to-left languages (Arabic, Hebrew, Persian and others): the form, the builder and the Entries screens mirror correctly.

• Translations: Arabic comes as a WordPress.org language pack, installed by WordPress itself. A translation template ( languages/flexsolutions-form-builder.pot ) is included in every release for other languages.

• Accessibility: the form and the plugin’s screens are checked with axe-core in every test run (no serious or critical issues) and can be used with the keyboard alone.

Older PHP or WordPress versions are not supported; on them the plugin stays inactive and shows a notice.

Form builder

Open a form and use the Form tab. Click a field in the palette to add it above the submit button (or after the selected card), or drag it to any position. Select a card to edit its label, name, help text and options; the field name follows the label until you change it yourself.

Drag cards, or use their up/down buttons, to reorder them and to move them in and out of conditional groups. Switch to Tags at any time to see or edit the same form as tags; HTML the builder does not recognise is kept as a “Custom HTML” block.

Add New Form opens a template picker: start blank, or from one of eight templates (contact, lead capture, event registration, feedback, newsletter signup, job application, support request), each with its fields, notification email and thank-you message ready to change. Developers can add their own with the tflexforms_templates filter.

Press Preview in the Publish box to see the form with your unsaved changes, on a page of your theme, at desktop, tablet and phone widths. Nothing is saved and the form cannot be sent from the preview. The Forms list has a Preview link too.

If you try to leave the editor with unsaved changes, the browser asks you to confirm first.

Shortcode

[tflexforms id="123"], or use the "Flexsolutions Form Builder form" block.

Entries

Each form can save submissions (Settings tab → Entries, on by default). Find them under Flexsolutions Form Builder → Entries: filter by form, status or tag, search, mark read/unread, delete and download uploaded files. “Export CSV” downloads exactly the entries the list shows with its current filters and search, across all pages; keep “For Excel (UTF-8 BOM)” ticked so Excel reads Arabic and other non-English text correctly (LibreOffice and Google Sheets read the file either way).

On an entry you can add tags (for example “follow up” or “VIP”) and notes for your team; each note shows who wrote it and when. “Edit values” corrects a submitted value; every change is kept in the entry’s change history with who made it, when and the old value, and no notification is sent again.

Each entry is saved before its notification email is sent, so a mail server problem never loses a message: the visitor sees your success message, and the entry shows a “Mail failed” badge with a “Resend notification” button. A failed notification is also retried automatically three times in the background (after 1, 5 and 15 minutes), and every attempt, with the mail server’s error, is listed on the entry.

Submissions flagged by the disallowed-words list or Akismet are kept with the Spam status and are not emailed; choose Spam in the status filter to review them, and “Not spam” to move one back (you can then send its notification). Bot traps (honeypot, time trap) still reject submissions without storing them. If a visitor double-clicks or their browser resends the form, the repeat within 10 minutes returns the first result instead of creating a second entry and email.

Viewing and exporting require the read_tflexforms_entries capability; adding notes and tags and editing values edit_tflexforms_entries; deleting entries, or other people’s notes, delete_tflexforms_entries (all three given to administrators). Anyone who can edit entries can delete their own notes.

Uploaded files are encrypted before they are saved in wp-content/uploads/tflexforms-uploads/, under random names, so they are private on every web server, nginx included: a copy fetched from the folder cannot be read. They are decrypted only for users allowed to view entries and for notification attachments. config).

php.

org.

Privacy

Submitted values are emailed to the recipients you configure and, if entries are enabled, stored in the database. IP addresses are stored only if you enable it in Flexsolutions Form Builder → Settings, where you can also set how many days entries are kept. Flexsolutions Form Builder adds its entries to WordPress’s Tools → Export Personal Data and Erase Personal Data (matched by email address) and suggests text for your privacy policy.

When CAPTCHA is enabled, the visitor’s browser loads the provider’s script and the visitor’s IP address is sent to the provider for verification. When Akismet checking is enabled, the submission content is sent to Akismet. For rate limiting, a salted hash of the visitor’s IP address is kept in a transient for 10 minutes; the raw IP is not stored.

To recognise duplicate submissions, a salted hash of each submission (not its readable values) is kept for 10 minutes. When a notification email cannot be sent, its text is kept with the entry until it is resent, and is deleted with the entry.

External services

Flexsolutions Form Builder works without any external service. Each one below is used only when a site administrator turns it on, and only on the forms where it is enabled.

• Cloudflare Turnstile (CAPTCHA). The visitor’s browser loads the widget script from challenges.cloudflare.com, and when the form is sent your server asks Cloudflare whether the visitor’s token is valid, sending the token, the secret key and the visitor’s IP address. Terms, privacy policy.

• Google reCAPTCHA v3 (CAPTCHA). The visitor’s browser loads the script from www.google.com/recaptcha, and when the form is sent your server sends the token, the secret key and the visitor’s IP address to Google for verification. Terms, privacy policy.

• hCaptcha (CAPTCHA). The visitor’s browser loads the widget from js.hcaptcha.com, and when the form is sent your server sends the token, the secret key and the visitor’s IP address to hCaptcha for verification. Terms, privacy policy.

• Akismet (spam check). When the Akismet plugin is active and checking is turned on in Flexsolutions Form Builder → Settings, each submission’s name, email address, website and message, with the visitor’s IP address, browser user agent and referring page, are sent to Akismet to decide whether it is spam. Terms, privacy policy.

• The “Check the keys” button on the Diagnostics screen sends the configured secret key to the chosen CAPTCHA provider, only when an administrator presses it.