SentientMail Form Builder

SentientMail Form Builder connects your WordPress site to SentientMail, so every newsletter signup and form submission lands in your email audience automatically, ready for journeys, campaigns, and transactional email.

Newsletter signups in two minutes

• Install and activate the plugin

• Paste your SentientMail Events API key on the Get Started screen

• Add the ready-made Newsletter Signup form to any page, as a block or a shortcode

Everything else a small site needs from forms

• Contact, application, and custom forms with 23 field types (including file uploads, address, rating, consent, calculations, signature, matrix and repeatable groups)

• Save and resume, so a long form can be finished later, plus optional capture of forms people abandon

• Conditional logic: show or hide fields based on earlier answers, enforced on the server as well as in the browser

• Multi-page forms with a progress indicator and per-page validation

• Eight starter templates, so you never begin with an empty form

• Privacy controls: optional IP logging, an entry retention window, and support for WordPress export and erasure requests

• Every submission saved as an entry, with CSV export

• Per-form analytics: views, submissions, the conversion rate between them, and which field people were on when they gave up. Aggregate counters only, kept in your own database, with no third-party service and no charting library

• Email notifications with smart tags ( {all_fields}, {field_id="2"}, …)

• A confirmation email to the person who submitted, with no account or third-party service needed

• Show-a-message or redirect confirmations

• Invisible anti-spam (honeypot + time trap) out of the box; optional Cloudflare Turnstile

• A keyword blocklist you control, plus optional Akismet if you already use it. Suspected spam is held for review, not thrown away

• Trigger a SentientMail transactional email to the submitter (welcome emails, promo codes)

• Add subscribers to a Mailchimp audience, with your own field-to-merge-field mapping. Double opt-in by default, and a consent checkbox on the form is honoured

• Post each submission to a Slack channel, using the same smart tags as your notification emails

• Outgoing webhooks with HMAC signatures for anything else (Zapier, Make, custom apps)

• One-click import of WPForms forms and entries if you’re switching

The plugin works without a SentientMail account too. Forms, entries, and notifications are fully functional standalone. Connect an account when you’re ready to grow your list.

External services

This plugin can connect to five named external services, and it can send

submissions to a webhook address you choose. All of it is optional: with none of

it configured, forms, entries and email notifications work entirely on your own

site and no data leaves it. The keyword blocklist is not one of them; it is

matched on your own server and sends nothing anywhere.

SentientMail

SentientMail is a hosted email marketing and transactional email platform, operated

by us. It is what the plugin syncs your form submissions into, so that signups

become contacts you can send campaigns and journeys to.

It is used only after you paste a SentientMail Events API key on the Get Started

screen. Nothing is sent before that.

What is sent, and when:

• When you verify your API key on the Get Started screen: your site’s address and

the plugin version, plus your WordPress administrator email address, as a single

connection event.

• When a visitor submits a form that has audience sync enabled: the values that

form collected (typically name and email address), the form’s name, and whether

the visitor gave marketing consent.

• When a form is configured to send a welcome or transactional email: the

recipient’s email address and the merge values that email needs.

com over HTTPS and are authenticated with

the key you supplied. Forms without audience sync enabled send nothing.

html

html

Mailchimp

Mailchimp is a hosted email marketing platform operated by Intuit. It is used

only if you enter your own Mailchimp API key under Settings AND switch Mailchimp

on for a particular form, where you also choose which audience to add people to.

It is off by default. With no key entered, no form makes any request to

Mailchimp.

Your Mailchimp API key ends in a dash and a short datacenter code, such as

-us21. The plugin reads that code out of the key to work out which Mailchimp

server your account is on, so there is no server address for you to enter. A key

without that suffix is refused, and nothing is sent.

What is sent, and when:

• When a visitor submits a form that has Mailchimp enabled: their email address,

the audience ID you chose, and the values you mapped to Mailchimp merge fields,

which by default are their first and last name. Uploaded files and signature

images are never sent. Nothing else from the submission is sent unless you map

it to a merge field yourself.

• Nothing is sent at any other time. There is no background sync, and the plugin

never reads your audiences or your Mailchimp account back.

If the form contains a consent checkbox, nothing is sent to Mailchimp at all

unless the visitor ticked it.

New subscribers are added as “pending” by default, which is Mailchimp’s double

opt-in: Mailchimp emails a confirmation link and nobody joins the audience until

they click it. You can choose single opt-in per form instead, which adds the

address immediately.

com over

HTTPS, authenticated with the API key you supplied. The key is sent in an

Authorization header, is never written into a URL, is never shown again after you

save it, and is removed from any error message the plugin records.

com/legal/terms/

com/legal/privacy/

Slack

Slack is a team messaging service operated by Salesforce. It is used only if you

create an incoming webhook in your own Slack workspace, paste its URL into a

form’s Integrations tab and switch Slack on for that form. It is off by default.

With no webhook URL saved, no form makes any request to Slack.

com/ address; anything else is refused

rather than saved, so the field cannot be pointed at some other server.

What is sent, and when:

• When a visitor submits a form that has Slack enabled: the message you composed

for that form, which by default is the form’s name followed by the answers.

Uploaded files and signature images are never posted to Slack; the message

says how many files were attached and links to the entry in your own

dashboard instead. The message is posted as plain text, so nothing a visitor

typed can become a link or a channel mention.

• Nothing is sent at any other time, and the plugin never reads anything back

out of Slack.

com over HTTPS. The webhook

URL is the credential: it is never displayed again after you save it, and it is

removed from any error message the plugin records.

com/terms-of-service

com/trust/privacy/privacy-policy

Cloudflare Turnstile

Turnstile is Cloudflare’s privacy-preserving CAPTCHA alternative. It is used only

if you enable it and enter your own Turnstile site key and secret key under

Settings. It is off by default.

What is sent, and when:

• On any page displaying a form: the visitor’s browser loads Turnstile’s widget

com. Cloudflare receives the visitor’s IP

address and browser information as part of that request.

• When a visitor submits the form: the challenge token their browser produced,

together with your secret key, is sent from your server to Cloudflare for

verification.

com/website-terms/

com/privacypolicy/

Akismet

Akismet is a spam-filtering service operated by Automattic. It is used only if

the Akismet plugin is installed and already set up with its own API key, AND you

tick “Akismet” in a form’s anti-spam settings. It is off by default. This plugin

never asks you for an Akismet key of its own and never stores one: it uses the

key Akismet already holds. With no key present, no request is made.

What is sent, and when:

• When a visitor submits a form that has Akismet enabled: the text values that

form collected, together with the submitter’s IP address, browser user agent,

and the address of the page the form was on. Uploaded files and signature

images are never included. Alongside the submission, the request carries the

fields the Akismet API defines for a spam check: your site’s address, its

language and its character set.

com over HTTPS, addressed

with your Akismet API key, which is how Akismet identifies the account making

the check. Nothing is sent from the visitor’s browser, and no Akismet script is

loaded on your pages.

If Akismet cannot be reached, or answers with anything other than a verdict, the

submission is accepted. A submission Akismet does call spam is kept as a spam

entry you can review and restore, not deleted.

com/tos/

com/privacy/

Outgoing webhooks

Not a third-party service, but it does send data off your site, so it is

documented here with the rest.

A form can be given a webhook address under its Integrations tab. There is no

default and no address is built in: it goes wherever you type. When somebody

submits that form, this plugin sends that address a JSON request containing your

site address, the form’s ID and title, the entry ID, the time of submission, the

page the form was on, and the values the visitor entered. If you set a signing

secret, the request is also signed so the receiver can verify it came from you.

Requests go over HTTPS only, and cannot be aimed at addresses inside your own

server’s network. Whoever operates the address you enter decides what happens to

the data once it arrives, under their own terms and privacy policy. Remove the

address to stop the sending.