About this plugin
Haychdev Forms is a WordPress form builder that doesn’t send your visitors’ data anywhere else. Forms are built from native blocks, submissions are saved in your own database, and notification emails go out through WordPress’s own mailer. Nothing in the public-facing pipeline calls a third party.
Features:
- Block-based form builder with native field types: text, email, phone, textarea, select, checkbox, and file upload
- File upload field with MIME allow-listing and a max-size limit
- Per-field AES-256-GCM encryption at rest — no key ever leaves your site
- Honeypot and HMAC-signed time-trap spam protection
- REST submit endpoint with server-side validation
- Admin entry viewer with per-entry detail, status filtering, and bulk actions: delete, mark as read, mark as spam
- Email notifications via wp_mail, sent to a configurable site-wide default address (defaults to your WordPress admin email)
- Auto-delete retention: automatically remove entries older than a number of days you set
- Hashed IP and User-Agent metadata stored — no raw visitor values
- Sensitive fields masked in the entry viewer unless the current user has the required capability
Privacy
This plugin does NOT send any data to external servers. All settings, submissions, and uploads stay on your site.
Submissions can be exported or permanently erased per person from Tools → Export/Erase Personal Data (WordPress core privacy tools).
Source code and build process
This plugin is fully open source (GPLv2 or later). The editor blocks under build/ are compiled from human-readable source that ships inside this plugin:
- Source: the blocks/ directory (one folder per block, plus blocks/_shared ).
- Build tooling: package.json is included; the blocks are built with the official @wordpress/scripts toolchain.
-
To regenerate the compiled build/ files from source, run from the plugin directory:
npm install
npm run build
No other minified or obfuscated code is used. All PHP is shipped uncompiled.