{ "title": "Fluent Forms", "seo_title": "Fluent Forms: review, recommended settings and limits", "h1": "Fluent Forms", "description": "Fluent Forms: who it suits, what Pro adds (file uploads, multi-step), recommended spam and email settings, patched vulnerabilities and safe versions.", "lead": "Fluent Forms is a drag-and-drop form builder that saves submissions and offers conditional logic even in the free version. This sheet covers who it suits, what Pro keeps for paying users, the spam settings to turn on and the vulnerabilities you should know about.", "language": "en", "locale": "en-US", "type": "plugin-sheet", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/fluent-forms/", "canonical": "https://www.wp-masquerade.com/features/camouflaged-plugins/fluent-forms/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/fluent-forms/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/fluent-forms/index.json", "published": "2026-11-04T08:00:00+00:00", "modified": "2026-11-05T21:08:23+00:00", "site": { "name": "WP Masquerade", "url": "https://www.wp-masquerade.com/" }, "translations": [ { "language": "en", "hreflang": "en-US", "title": "Fluent Forms", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/fluent-forms/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/fluent-forms/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/fluent-forms/index.json" }, { "language": "fr", "hreflang": "fr-FR", "title": "Fluent Forms", "url": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/fluent-forms/", "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/fluent-forms/index.md", "json": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/fluent-forms/index.json" }, { "language": "es", "hreflang": "es-ES", "title": "Fluent Forms", "url": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/fluent-forms/", "markdown": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/fluent-forms/index.md", "json": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/fluent-forms/index.json" }, { "language": "de", "hreflang": "de-DE", "title": "Fluent Forms", "url": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/fluent-forms/", "markdown": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/fluent-forms/index.md", "json": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/fluent-forms/index.json" }, { "language": "it", "hreflang": "it-IT", "title": "Fluent Forms", "url": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/fluent-forms/", "markdown": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/fluent-forms/index.md", "json": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/fluent-forms/index.json" }, { "language": "pt", "hreflang": "pt-BR", "title": "Fluent Forms", "url": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/fluent-forms/", "markdown": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/fluent-forms/index.md", "json": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/fluent-forms/index.json" }, { "language": "nl", "hreflang": "nl-NL", "title": "Fluent Forms", "url": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/fluent-forms/", "markdown": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/fluent-forms/index.md", "json": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/fluent-forms/index.json" } ], "headings": [ { "level": 1, "text": "Fluent Forms" }, { "level": 2, "text": "What Fluent Forms does on your site" }, { "level": 2, "text": "Which sites Fluent Forms is a good fit for" }, { "level": 2, "text": "Fluent Forms strengths and limitations" }, { "level": 3, "text": "Strengths" }, { "level": 3, "text": "Limitations" }, { "level": 2, "text": "The Fluent Forms settings we recommend" }, { "level": 2, "text": "Fluent Forms vulnerabilities and the versions to run" }, { "level": 2, "text": "Fluent Forms FAQ", "id": "faq" } ], "body": "## The essentials\n\n- Best for saving submissions and using conditional logic without paying for a license.\n- Main caveat: file uploads, multi-step forms and calculations are reserved for the Pro version.\n- Free; Pro starts at $79 per year for one site, or $349 for a lifetime license.\n\n## What Fluent Forms does on your site\n\nFluent Forms is a drag-and-drop form builder, listed on wordpress.org since late 2017 and developed by WPManageNinja, the team behind FluentCRM and FluentSMTP. You build the fields in a visual editor or start from a template, then place the form with a Gutenberg block or a shortcode. A built-in AI assistant can also draft the form from a description, which is sent along with your site address to the developer’s service.\n\nUnlike Contact Form 7, every submission is saved in the database: the Entries screen lets you browse, filter, mark as spam and export them as CSV, Excel, ODS or JSON. The free version already includes conditional logic, conversational forms (one question per screen), email notifications and Stripe payments.\n\nThe business model is freemium: Fluent Forms Pro installs alongside the free plugin and unlocks file uploads, multi-step forms, calculations, quizzes, more payment gateways and over 60 integrations. On the front end, the developer says its scripts and styles load only on pages that display a form, and weigh under 30 KB combined for a standard form.\n\n![Diagram: Fluent Forms works on visitors and bots, wordpress, external services. Public traces: folder name (hidden with Pro); tag IDs (hidden with Pro); JavaScript variables (still visible); CSS classes (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/fluentform/diagram-en.svg?v=772a7301)\n\n## Which sites Fluent Forms is a good fit for\n\n- **Small business and brochure sites** that want a record of every inquiry in the dashboard, even when an email goes missing.\n- **Branching forms**: questionnaires, quote requests or registrations whose fields change based on earlier answers, with no license to buy.\n- **Small sales and donations** collected through Stripe, recurring payments included, as long as the free version’s fee is acceptable.\n- **Sites switching from another plugin**: the migrator imports forms and entries from Contact Form 7, WPForms, Gravity Forms, Ninja Forms or Caldera Forms.\n\nIt is the wrong choice if you need to receive attachments (résumés, photos, documents) without buying Pro, or if you want a plugin that rarely changes and needs little attention: Fluent Forms ships new releases very often. For complex forms wired to many services, also compare [Gravity Forms](https://www.wp-masquerade.com/features/camouflaged-plugins/gravity-forms/) and [WPForms](https://www.wp-masquerade.com/features/camouflaged-plugins/wpforms/).\n\n## Fluent Forms strengths and limitations\n\n### Strengths\n\n- **A capable free version.** Entry storage and export, conditional logic and conversational forms come without a license.\n- **Layered spam protection.** Honeypot, anti-bot token, Akismet, reCAPTCHA, hCaptcha, Turnstile and CleanTalk are all configurable without an add-on.\n- **Targeted loading.** According to the developer, scripts and styles load only on pages that contain a form.\n- **Per-form permissions.** The Permissions screen gives a non-admin account access to specific forms or their entries only.\n\n### Limitations\n\n- **File uploads cost extra.** The file upload and image upload fields are part of the Pro version.\n- **A fee on free payments.** The free version takes 1.9% per Stripe transaction on top of Stripe’s own fees; PayPal and the other gateways are Pro only.\n- **Advanced features are Pro.** Multi-step forms, calculations, quizzes, automatic deletion of old entries and integrations such as Google Sheets or HubSpot require a license.\n- **Frequent vulnerabilities in 2026.** Patchstack lists more than twenty patched flaws since January: a plugin left without updates quickly becomes exposed.\n\n## The Fluent Forms settings we recommend\n\nSpam protection is set once for the whole site under Fluent Forms > Global Settings; the sender address is set form by form.\n\n| Setting | Recommended value | Why |\n| --- | --- | --- |\n| **Enable Honeypot Security** Global Settings > General > Miscellaneous | On | A hidden field traps bots without bothering visitors; it is the setting the developer recommends. |\n| **Token Based Spam Protection** Global Settings > General > Miscellaneous | On | The token is only created after someone interacts with the form, so a direct automated post fails. Send a real test after turning it on. |\n| **Enable Akismet Integration** Global Settings > General > Miscellaneous | On, with \"Spam Validation\" set to \"Mark as Spam\" | Catches human spammers, and a false positive stays reviewable in Entries. Akismet must be active with a key. |\n| **Turnstile** Global Settings > Security > Turnstile | Keys from a Cloudflare widget, then a Turnstile field added to the form | A free Cloudflare service; save it for forms that still get spam after the first two rows. |\n| **From Email** Forms > your form > Settings & Integrations > Email Notifications | An address on your site’s domain, and the email field’s smartcode (for example `{inputs.email}`) in \"Reply To\" | The interface itself warns against any other address; pair it with an SMTP plugin such as [FluentSMTP](https://www.wp-masquerade.com/features/camouflaged-plugins/fluentsmtp/) for reliable delivery. |\n| **Disable IP Logging** Global Settings > General > Miscellaneous | On, unless you actually use IP addresses | Entries no longer keep the visitor’s IP address, which means less personal data to justify under privacy laws such as the GDPR. |\n| **Permissions** Global Settings > Permissions | Only the accounts that really manage forms | A manager can see personal data, and several past flaws targeted exactly these permissions. |\n| **MCP for AI Agents** Global Settings | Off (the default), unless you have a specific need | This server gives AI assistants access to your forms, entries and reports. |\n| **Automatic updates** Plugins > Installed Plugins | On, version 6.2.12 or later | Security fixes ship in minor releases. |\n\n- Send a test message, then check that it shows up in Entries and that the email lands in the inbox, not the spam folder.\n- Enter `akismet-guaranteed-spam@example.com` in the email field: the entry should be flagged as spam.\n- Open Global Settings > Permissions and remove accounts that no longer need access to entries.\n\nTo protect comments and logins as well, see our page on [WordPress anti-spam](https://www.wp-masquerade.com/wordpress-anti-spam/).\n\n## Fluent Forms vulnerabilities and the versions to run\n\nThe most serious flaw remains CVE-2024-2771, rated 9.8: up to version 5.1.16, a REST API route that manages permissions did not check capabilities, so a visitor with no account could grant form management rights. The same year, CVE-2024-4157 (versions up to 5.1.15) allowed PHP object injection from a contributor account.\n\nIn 2026, two stored [XSS](https://www.wp-masquerade.com/glossary/xss/) flaws exploitable without an account were fixed: CVE-2026-16655, through the Name field, up to version 6.2.7 (fixed in 6.2.8), and CVE-2026-18146, through notification smartcodes, up to version 6.2.11. Because a public form is open to anyone, any visitor could slip in a script that then ran on the pages displaying that data.\n\nThe step that matters is turning on automatic updates (see our guide to automatic plugin updates). WP Masquerade Pro removes some of the traces that reveal Fluent Forms to bots (the next section lists which ones), which makes the plugin harder to spot without replacing the patch.\n\n## Fluent Forms FAQ\n\n**Does Fluent Forms save submissions?**\n\nYes. Every submission is stored in the database and shown under Entries, including in the free version. You can export them as CSV, Excel, ODS or JSON.\n\n**Can I receive files with the free version?**\n\nNo. The file upload and image upload fields are reserved for Fluent Forms Pro. If attachments are all you need, Contact Form 7 accepts them for free.\n\n**What does a payment cost with the free version?**\n\nFluent Forms takes 1.9% per Stripe transaction, on top of Stripe’s fees. Pro removes that fee and adds PayPal, Mollie, Square and other gateways.\n\n**How do I move from Contact Form 7 or WPForms to Fluent Forms?**\n\nOpen Fluent Forms > Tools > Migrator: each supported plugin has one button to import forms and another for entries. Then review the notifications and spam settings of every imported form.\n\n**What does a Fluent Forms Pro license include?**\n\nAll Pro features, with one year of updates and priority support on an annual license, or with no time limit on a lifetime license. The developer offers a refund on request within 14 days of purchase.\n\n## Key facts\n\n- Category: Forms\n- Vendor: WPManageNinja\n- Price: Free; Fluent Forms Pro starts at $79 per year for one site, or $349 for a lifetime license\n- Active installations (wordpress.org): 800 000+\n- Version: 6.2.17\n- Official page: https://wordpress.org/plugins/fluentform/\n\n## What WP Masquerade hides\n\n- Handled by WP Masquerade Pro only\n- With Pro: folder name, tag IDs\n- Still visible: JavaScript variables, CSS classes", "catalog": "fluentform", "essentials": [ "Best for saving submissions and using conditional logic without paying for a license.", "Main caveat: file uploads, multi-step forms and calculations are reserved for the Pro version.", "Free; Pro starts at $79 per year for one site, or $349 for a lifetime license." ], "format": "application/json" }