{
    "title": "SureForms",
    "seo_title": "SureForms: review, recommended settings and limits",
    "h1": "SureForms",
    "description": "SureForms: who it suits, its limits (paid file uploads and conditional logic, Stripe fees), anti-spam and email settings, and patched vulnerabilities.",
    "lead": "SureForms builds your forms in the block editor, with AI, stored entries and Stripe payments even in the free version. This sheet covers who it suits, what the paid plans hold back, the anti-spam and email settings to apply and the patched vulnerabilities you should know about.",
    "language": "en",
    "locale": "en-US",
    "type": "plugin-sheet",
    "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/sureforms/",
    "canonical": "https://www.wp-masquerade.com/features/camouflaged-plugins/sureforms/",
    "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/sureforms/index.md",
    "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/sureforms/index.json",
    "published": "2026-11-04T08:00:00+00:00",
    "modified": "2026-11-05T21:25:35+00:00",
    "site": {
        "name": "WP Masquerade",
        "url": "https://www.wp-masquerade.com/"
    },
    "translations": [
        {
            "language": "en",
            "hreflang": "en-US",
            "title": "SureForms",
            "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/sureforms/",
            "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/sureforms/index.md",
            "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/sureforms/index.json"
        },
        {
            "language": "fr",
            "hreflang": "fr-FR",
            "title": "SureForms",
            "url": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/sureforms/",
            "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/sureforms/index.md",
            "json": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/sureforms/index.json"
        },
        {
            "language": "es",
            "hreflang": "es-ES",
            "title": "SureForms",
            "url": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/sureforms/",
            "markdown": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/sureforms/index.md",
            "json": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/sureforms/index.json"
        },
        {
            "language": "de",
            "hreflang": "de-DE",
            "title": "SureForms",
            "url": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/sureforms/",
            "markdown": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/sureforms/index.md",
            "json": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/sureforms/index.json"
        },
        {
            "language": "it",
            "hreflang": "it-IT",
            "title": "SureForms",
            "url": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/sureforms/",
            "markdown": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/sureforms/index.md",
            "json": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/sureforms/index.json"
        },
        {
            "language": "pt",
            "hreflang": "pt-BR",
            "title": "SureForms",
            "url": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/sureforms/",
            "markdown": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/sureforms/index.md",
            "json": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/sureforms/index.json"
        },
        {
            "language": "nl",
            "hreflang": "nl-NL",
            "title": "SureForms",
            "url": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/sureforms/",
            "markdown": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/sureforms/index.md",
            "json": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/sureforms/index.json"
        }
    ],
    "headings": [
        {
            "level": 1,
            "text": "SureForms"
        },
        {
            "level": 2,
            "text": "What SureForms does on your site"
        },
        {
            "level": 2,
            "text": "Which sites SureForms is a good fit for"
        },
        {
            "level": 2,
            "text": "SureForms strengths and limitations"
        },
        {
            "level": 3,
            "text": "Strengths"
        },
        {
            "level": 3,
            "text": "Limitations"
        },
        {
            "level": 2,
            "text": "The SureForms settings we recommend"
        },
        {
            "level": 2,
            "text": "Patched vulnerabilities: why SureForms must stay up to date"
        },
        {
            "level": 2,
            "text": "SureForms frequently asked questions",
            "id": "faq"
        }
    ],
    "body": "## The essentials\n\n- Best for block editor sites that want stored entries and free Stripe payments in one plugin.\n- Main caveat: file uploads and conditional logic require a paid plan.\n- Free; paid plans start at $69 per year for a single site ($59 in year one).\n\n## What SureForms does on your site\n\nSureForms is a form plugin from Brainstorm Force, the company behind the Astra theme and the Spectra plugin. What sets it apart: you build forms inside the WordPress block editor, where every field is a block you drag, duplicate and style just like a paragraph. You can start from a template, from a blank form or from a plain-language description that the AI assistant turns into an editable form.\n\nSubmissions are saved in tables in your own database and listed under SureForms > Entries, with search and export. Each form sends an email notification, shows a confirmation message or redirects, and is embedded with a block or a shortcode. The free version also includes Instant Forms (a shareable URL without creating a page), Stripe payments, spam protection and a migration tool for Contact Form 7, WPForms and Gravity Forms.\n\nIt is a freemium product: the free version lives on wordpress.org, and a paid license unlocks SureForms Business (file uploads, conditional logic, multi-step forms, quizzes, surveys, calculations, PayPal). AI generation runs through a server operated by the vendor, which receives your description; without a license, the number of generations is capped.\n\n![Diagram: SureForms works on visitors and bots, wordpress, external services. Public traces: folder name (hidden with Pro); tag IDs (hidden with Pro); CSS classes (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/sureforms/diagram-en.svg?v=11f7e002)\n\n## Which sites SureForms is a good fit for\n\n- **Sites built with the block editor** (Astra, Spectra, Kadence, block themes) that want to build forms with the same moves they use for pages.\n- **Small businesses and nonprofits** that collect a deposit, a donation or a registration fee through Stripe without a separate payment plugin.\n- **Sites that need a record of every message**: entries stay in the dashboard even if the email gets lost.\n- **Agencies setting up several client sites**: the Team license covers 10 sites for $179 per year ($149 the first year).\n\nIt is not the best pick if you need a file upload field or conditional logic without paying: both are Business features, whereas [Fluent Forms](https://www.wp-masquerade.com/features/camouflaged-plugins/fluent-forms/) includes conditional logic in its free version. A site that takes a lot of payments on the free version should also factor in the transaction fees described below. And if you want an older builder with a large add-on ecosystem, [WPForms](https://www.wp-masquerade.com/features/camouflaged-plugins/wpforms/) remains the market benchmark.\n\n## SureForms strengths and limitations\n\n### Strengths\n\n- **Built in the block editor.** No proprietary builder to learn: fields are regular WordPress blocks.\n- **Entries kept in WordPress.** Submissions stay on your server, with export and automatic deletion after a period you choose.\n- **Stripe in the free version.** One-time payments and subscriptions with no extra add-on.\n- **Four anti-spam options.** reCAPTCHA, hCaptcha, Cloudflare Turnstile and a [honeypot](https://www.wp-masquerade.com/glossary/honeypot/) field, no third-party plugin required.\n- **Delivery failures surface.** Since version 2.12.9, a failed notification is reported in the entry logs instead of being silently retried.\n\n### Limitations\n\n- **Common features cost extra.** File uploads, conditional logic, multi-step forms, signatures and PayPal all require Business.\n- **Fees on free payments.** Without a license, the payments screen states that 2.9% transaction and gateway fees apply; with a paid license, only Stripe’s own fees remain.\n- **Introductory pricing.** The Solo plan costs $69 per year for one site ($59 the first year): the developer states that all renewals are at full price.\n- **Busy security record.** Patchstack lists around twenty patched vulnerabilities since January 2025, several of them exploitable without an account.\n- **Capped, off-site AI.** Free generations are limited, and every description is sent to the vendor’s server.\n\n## The SureForms settings we recommend\n\nGlobal options live under SureForms > Settings; per-form options sit in the sidebar of each form’s editor. The labels below are those of the plugin’s English interface.\n\n| Setting | Recommended value | Why |\n| --- | --- | --- |\n| **Turnstile**  SureForms > Settings > Spam Protection | Site key and secret key from a Cloudflare widget | Free and unobtrusive; the keys then serve every form. |\n| **Spam Protection**  Form editor, sidebar | “CloudFlare Turnstile” instead of “None” | Each form ships without a CAPTCHA until you pick one. |\n| **Enable Honeypot Security**  Settings > Spam Protection > Honeypot | On | Off by default; it stops basic bots without bothering visitors. |\n| **From Email**  Form editor > Email Notification | A real address on the site’s domain | The default is the admin email: if that is a Gmail address, notifications end up in spam. |\n| **Authenticated sending**  SMTP plugin and DNS zone | SMTP server with SPF and DKIM | The SureForms > SMTP menu points to SureMail, from the same vendor; [WP Mail SMTP](https://www.wp-masquerade.com/features/camouflaged-plugins/wp-mail-smtp/) works too. |\n| **Compliance Settings**  Settings > Global Defaults | “Enable GDPR Compliance” and “Automatically delete entries” after a set period | Entries do not pile up forever. Avoid “Never store entry data after form submission”: a lost email would then mean a lost message. |\n| **Enable IP logging**  Settings > General Settings | Off (the default), unless you have a documented need | Less personal data stored; once enabled, this setting may also call the ipinfo service. |\n| **Enable Abilities**  Settings > MCP | Off (the default) | Experimental feature: when on, AI clients can read, edit and delete forms and entries. If you use it, leave “Enable Delete Abilities” off. |\n| **Updates**  Plugins > Installed Plugins | Auto-updates enabled, version 2.13.1 or later | The last three releases all include security fixes. |\n\n- Send a test message, check that it lands in the inbox, then confirm it shows up under SureForms > Entries.\n- Open every existing form and make sure its spam protection is not still set to “None”.\n- If you take Stripe payments, compare the amounts under SureForms > Payments with those in your Stripe dashboard.\n\nFor the other ways bots get in, see our [WordPress anti-spam page](https://www.wp-masquerade.com/wordpress-anti-spam/).\n\n## Patched vulnerabilities: why SureForms must stay up to date\n\nYoung and widely installed, the plugin has received many security fixes. The most serious ones could be triggered by visitors without an account:\n\n- **CVE-2025-6691 and CVE-2025-6742** (versions up to 1.7.3): a crafted submission could lead to file deletion on the server or PHP object injection when an administrator deleted the entry.\n- **CVE-2026-4987** (up to 2.5.2): the amount of a Stripe payment could be bypassed by tampering with the form ID.\n- **CVE-2026-18406** (up to 2.12.2): a script submitted in a text field could be stored, then run for anyone who opened the affected page.\n\nBrainstorm Force handles reports with Patchstack, and versions 2.12.9, 2.13.0 and 2.13.1 still mention security fixes. The practical step is automatic updates (see our guide to plugin auto-updates). WP Masquerade Pro removes some of the traces that point bots to SureForms (the next section lists which), which makes it harder to spot without replacing the patch.\n\n## SureForms frequently asked questions\n\n**Does SureForms save submissions?**\n\nYes, in your database, under SureForms > Entries. You can turn storage off per form, but an undelivered email would then be lost for good.\n\n**Do I need an OpenAI key for AI form creation?**\n\nNo. Generation runs through the vendor’s server. The free version caps the number of generations; connecting the site to a free SureForms account adds 10 more.\n\n**Can visitors upload a file with the free version?**\n\nNo, the file upload field is part of SureForms Business, along with signature, date and repeater fields.\n\n**Can I import my Contact Form 7 forms?**\n\nYes, the Migration tab in the settings imports forms from Contact Form 7, WPForms, Gravity Forms and other plugins. Check each imported form, its notifications and its spam protection before you remove the old plugin.\n\n**Does SureForms work with Elementor?**\n\nYes, you embed the form with a shortcode or a widget, but you still build it in the block editor. Dedicated styling controls for Elementor and Bricks are part of Business.\n\n## Key facts\n\n- Category: Forms\n- Vendor: Brainstorm Force\n- Price: Free; paid plans from $69 per year for one site ($59 the first year)\n- Active installations (wordpress.org): 500 000+\n- Version: 2.13.1\n- Official page: https://wordpress.org/plugins/sureforms/\n\n## What WP Masquerade hides\n\n- Handled by WP Masquerade Pro only\n- With Pro: folder name, tag IDs\n- Still visible: CSS classes",
    "catalog": "sureforms",
    "essentials": [
        "Best for block editor sites that want stored entries and free Stripe payments in one plugin.",
        "Main caveat: file uploads and conditional logic require a paid plan.",
        "Free; paid plans start at $69 per year for a single site ($59 in year one)."
    ],
    "format": "application/json"
}