{ "title": "Formidable Forms", "seo_title": "Formidable Forms: review, recommended settings and limits", "h1": "Formidable Forms", "description": "Formidable Forms: who it suits, what Pro adds (uploads, conditional logic), the 3% payment fee, GDPR and anti-spam settings, and patched vulnerabilities.", "lead": "Formidable Forms is a drag-and-drop form builder that stores submissions even in its free edition and stretches all the way to calculators and directories. This sheet covers who it suits, what the licenses and payment fees cost, the settings to apply and the vulnerabilities to know about.", "language": "en", "locale": "en-US", "type": "plugin-sheet", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/formidable-forms/", "canonical": "https://www.wp-masquerade.com/features/camouflaged-plugins/formidable-forms/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/formidable-forms/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/formidable-forms/index.json", "published": "2026-11-04T08:00:00+00:00", "modified": "2026-11-05T21:08:52+00:00", "site": { "name": "WP Masquerade", "url": "https://www.wp-masquerade.com/" }, "translations": [ { "language": "en", "hreflang": "en-US", "title": "Formidable Forms", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/formidable-forms/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/formidable-forms/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/formidable-forms/index.json" }, { "language": "fr", "hreflang": "fr-FR", "title": "Formidable Forms", "url": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/formidable-forms/", "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/formidable-forms/index.md", "json": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/formidable-forms/index.json" }, { "language": "es", "hreflang": "es-ES", "title": "Formidable Forms", "url": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/formidable-forms/", "markdown": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/formidable-forms/index.md", "json": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/formidable-forms/index.json" }, { "language": "de", "hreflang": "de-DE", "title": "Formidable Forms", "url": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/formidable-forms/", "markdown": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/formidable-forms/index.md", "json": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/formidable-forms/index.json" }, { "language": "it", "hreflang": "it-IT", "title": "Formidable Forms", "url": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/formidable-forms/", "markdown": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/formidable-forms/index.md", "json": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/formidable-forms/index.json" }, { "language": "pt", "hreflang": "pt-BR", "title": "Formidable Forms", "url": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/formidable-forms/", "markdown": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/formidable-forms/index.md", "json": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/formidable-forms/index.json" }, { "language": "nl", "hreflang": "nl-NL", "title": "Formidable Forms", "url": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/formidable-forms/", "markdown": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/formidable-forms/index.md", "json": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/formidable-forms/index.json" } ], "headings": [ { "level": 1, "text": "Formidable Forms" }, { "level": 2, "text": "What Formidable Forms does on your site" }, { "level": 2, "text": "Which sites Formidable Forms is a good fit for" }, { "level": 2, "text": "Formidable Forms strengths and limitations" }, { "level": 3, "text": "Strengths" }, { "level": 3, "text": "Limitations" }, { "level": 2, "text": "The Formidable Forms settings we recommend" }, { "level": 2, "text": "Payments and subscriber accounts, Formidable’s weak spots" }, { "level": 2, "text": "Formidable Forms frequently asked questions", "id": "faq" } ], "body": "## The essentials\n\n- Best for keeping submissions in WordPress and building calculators, quotes or directories on one base.\n- Main caveat: uploads, conditional logic and calculations are paid, and payments carry a 3% fee.\n- Free; Basic costs $79 per year for one site ($39.50 the first year).\n\n## What Formidable Forms does on your site\n\nFormidable Forms is a drag-and-drop form builder that has been on wordpress.org since 2009, made by Strategy11, the team led by Steve and Steph Wells. The free edition, called Lite, lets you build unlimited forms from templates or from scratch, and every submission is saved in the WordPress database: you’ll find it under Formidable > Entries and can export it to CSV. You embed a form with the Formidable block or the `[formidable id=x]` shortcode.\n\nFormidable Pro is a separate plugin that sits on top of Lite once you have a license. It unlocks file uploads, conditional logic, multi-page forms and calculations, and, on higher plans, Formidable Views, which turns entries into directories, tables or calendars. That is what sets Formidable apart from other builders: it doubles as a way to build small data-driven apps from what your forms collect, with no extra plugin.\n\nStripe, PayPal and Square payments work in Lite, but Formidable then takes a 3% fee on top of the processor’s own fees. Since version 7.0, the plugin also ships with an MCP server, so a compatible AI assistant can create and edit forms, entries and payments on your site. It stays off until you turn it on.\n\n![Diagram: Formidable Forms works on visitors and bots, wordpress, external services. Public traces: folder name (hidden with Pro); tag IDs (hidden with Pro); generated-file folders (hidden with Pro); CSS classes (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/formidable/diagram-en.svg?v=4a278a08)\n\n## Which sites Formidable Forms is a good fit for\n\n- **Sites that want to keep submissions** in the dashboard, with no extra storage plugin, even on the free edition.\n- **Calculators and quotes**: calculated fields (paid) power loan, pricing and instant quote calculators.\n- **Directories, job boards, registrations**: with Formidable Views, entries become public pages visitors can browse and filter.\n- **Agencies and developers** who want a visual builder but still control the HTML of each form.\n\nIt isn’t the best pick for a plain contact form with an attachment: file uploads need a license, while other free plugins include them. If you take payments regularly, also factor in the 3% fee, which only the Business and Elite plans remove. For everyday needs, compare it with [WPForms](https://www.wp-masquerade.com/features/camouflaged-plugins/wpforms/); for a fully licensed project, with [Gravity Forms](https://www.wp-masquerade.com/features/camouflaged-plugins/gravity-forms/).\n\n## Formidable Forms strengths and limitations\n\n### Strengths\n\n- **Entries stored in Lite.** Every submission stays in the database and exports to CSV, even if the notification email goes missing.\n- **Thorough spam protection.** Honeypot, JavaScript check, denylist, Akismet, reCAPTCHA, hCaptcha and Turnstile, with no paid add-on.\n- **Built-in GDPR options.** Lite can stop storing IP addresses, turn off the tracking cookie and add a consent checkbox.\n- **More than forms.** Calculations, quizzes, surveys and Views cover jobs that would otherwise take several plugins.\n- **Modest requirements.** WordPress 6.3 and PHP 7.0 are enough for the plugin; only the MCP server needs WordPress 6.9.\n\n### Limitations\n\n- **Core features cost extra.** File uploads, conditional logic, multi-page forms and calculations need at least the Basic plan.\n- **Payment fees.** On Lite, Basic, Plus or an expired license, a 3% fee comes on top of Stripe’s fees.\n- **Renewals at twice the price.** The listed prices are introductory; renewals are charged at full price.\n- **Tied to the license.** Once it expires, forms keep working, but you can no longer edit premium fields already in use.\n- **One Stripe action per form.** Without the Stripe add-on, a form can run only one Stripe payment action, even with Pro.\n\n## The Formidable Forms settings we recommend\n\nSettings shared by every form live under Formidable > Global Settings; a single form’s options are in the Settings tab of its builder.\n\n| Setting | Recommended value | Why |\n| --- | --- | --- |\n| **Default From Address** Global Settings > General Settings | A real address on your site’s domain | An address on another domain gets notifications flagged as spam. |\n| **Authenticated sending** SMTP plugin and the domain’s DNS zone | SMTP server, with SPF and DKIM | Formidable sends through WordPress’s mail function, and the developer itself recommends [WP Mail SMTP](https://www.wp-masquerade.com/features/camouflaged-plugins/wp-mail-smtp/) when emails don’t arrive. |\n| **Enable GDPR related features and enhancements** Global Settings > General Settings > GDPR | Checked, then “Do not store user IPs with form submissions” checked | Less personal data kept; the box also unlocks each form’s GDPR tab. |\n| **Use custom headers when retrieving IPs** Same section | Unchecked, unless behind a reverse proxy | These headers can be spoofed; only turn it on if every entry shows the same IP address. |\n| **Select captcha type** Global Settings > Captcha/Spam | Turnstile, with the site key and secret key | The choice applies to every form that has a CAPTCHA field. |\n| **Spam checks** Same tab | Honeypot on, “Save as a spam entry” | A false positive stays reviewable in the Spam tab of your entries instead of being lost. |\n| **Check entries for spam using JavaScript** Form > Settings > Spam | Checked on every form | A unique token blocks bots that post without loading the page. |\n| **Load form styling** Global Settings > Manage Styles | “only on applicable pages”, after testing | By default the stylesheet loads on every page; afterwards, check forms placed in a widget or a modal. |\n| **Enable the Formidable MCP server** Global Settings > MCP | Off, unless you actually use an AI assistant | When on, it grants access to forms, entries and payments through an application password. |\n\n- Submit a test entry and check that it shows up under Formidable > Entries and that the notification lands in the inbox.\n- Open the GDPR tab of every form that collects personal data and add the consent checkbox.\n- Under Global Settings > Permissions, limit access to entries to the roles that need it.\n- If you take payments, run a test-mode payment and check the amount received in Stripe.\n\nOur glossary explains how a [honeypot](https://www.wp-masquerade.com/glossary/honeypot/) catches bots.\n\n## Payments and subscriber accounts, Formidable’s weak spots\n\nSeveral recent vulnerabilities target the most exposed features. CVE-2026-2888 let a visitor without an account change the amount of a Stripe payment; it affects versions up to 6.28. CVE-2026-18331, a stored [XSS vulnerability](https://www.wp-masquerade.com/glossary/xss/) exploitable without an account, affects versions up to 6.33.1. Further back, CVE-2023-1405 was an unauthenticated PHP object injection, fixed in 6.2.\n\nThe most recent, CVE-2026-89435, let any logged-in subscriber install a plugin of their choice in versions up to 6.35; Patchstack rates it CVSS 8.8. Version 7.0 fixes it. Any site with open public registration is directly exposed.\n\nWhat helps: version 7.0 or later and automatic updates (see our guide to automatic plugin updates), with Formidable Pro kept current through an active license. WP Masquerade Pro removes some of the traces that point bots to Formidable (the next section lists which), which makes it harder to spot without replacing the patch.\n\n## Formidable Forms frequently asked questions\n\n**Does the free version of Formidable Forms save submissions?**\n\nYes. Every submission is kept under Formidable > Entries and exports to CSV. If you don’t want to keep anything for a given form, check “Do not store entries submitted from this form” in its settings.\n\n**How do I avoid the 3% payment fee?**\n\nOnly an active Business or Elite license removes it. On Lite, Basic, Plus or an expired license, Formidable takes 3% on top of Stripe’s fees.\n\n**What happens when my Pro license expires?**\n\nYour forms keep accepting submissions. You lose support, Pro updates, new add-ons and the ability to edit premium fields already in use.\n\n**How do I remove all Formidable data?**\n\nUnder Global Settings > Miscellaneous, the uninstall option permanently deletes forms, entries and settings. Export anything you want to keep first: there is no undo.\n\n## Key facts\n\n- Category: Forms\n- Vendor: Strategy11\n- Price: Free (Lite); Basic plan $79 per year for one site ($39.50 for the first year)\n- Active installations (wordpress.org): 300 000+\n- Version: 7.0\n- Official page: https://wordpress.org/plugins/formidable/\n\n## What WP Masquerade hides\n\n- Handled by WP Masquerade Pro only\n- With Pro: folder name, tag IDs, generated-file folders\n- Still visible: CSS classes", "catalog": "formidable", "essentials": [ "Best for keeping submissions in WordPress and building calculators, quotes or directories on one base.", "Main caveat: uploads, conditional logic and calculations are paid, and payments carry a 3% fee.", "Free; Basic costs $79 per year for one site ($39.50 the first year)." ], "format": "application/json" }