---
title: "WPForms"
description: "WPForms: who it suits, Lite limits (entries not stored, 3% fee), recommended email and anti-spam settings, and patched payment vulnerabilities."
language: "en"
locale: "en-US"
type: "plugin-sheet"
canonical: "https://www.wp-masquerade.com/features/camouflaged-plugins/wpforms/"
published: "2026-11-04T08:00:00+00:00"
modified: "2026-11-05T21:34:15+00:00"
translations:
  en-US: "https://www.wp-masquerade.com/features/camouflaged-plugins/wpforms/index.md"
  fr-FR: "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/wpforms/index.md"
  es-ES: "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/wpforms/index.md"
  de-DE: "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/wpforms/index.md"
  it-IT: "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/wpforms/index.md"
  pt-BR: "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/wpforms/index.md"
  nl-NL: "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/wpforms/index.md"
---

# WPForms

WPForms is a drag-and-drop form builder, free as WPForms Lite and extended by paid licenses. This sheet covers who it suits, what the free version leaves out, the email and anti-spam settings to apply and the payment vulnerabilities you should know about.

## The essentials

- Best for building a contact, quote or simple payment form with the mouse, no code required.
- Main caveat: Lite stores no entries on the site and has no file uploads or conditional logic.
- Free; Basic costs $99 per year before tax on one site ($49.50 for the first year).

## What WPForms does on your site

WPForms is a drag-and-drop form builder launched in 2016 and published by WPForms LLC, a brand of the Awesome Motive group. The free plugin on wordpress.org is called WPForms Lite; WPForms Pro, sold on the vendor’s site as annual licenses, adds fields, features and addons. You build a form from a template, or ask the AI assistant for a first draft, then embed it with the WPForms block or a shortcode.

On submission, WPForms validates the fields, runs its anti-spam protection and sends the email notifications defined in the builder under Settings > Notifications. One thing to know before you pick it: the vendor’s documentation states that WPForms Lite does not save entries to the WordPress database. The Lite Connect option can back them up on WPForms servers for one year, but you can only view them after upgrading to a paid license.

Even the free version takes one-time or recurring payments through Stripe, as well as PayPal Commerce and Square. Without an active license, the vendor charges a 3% platform fee on every transaction, on top of the payment processor’s own fees. On the front end, WPForms loads its scripts and stylesheets by default only on pages that display a form.

![Diagram: WPForms works on visitors and bots, wordpress, external services. Public traces: signed HTML comments (removed, free version); folder name (hidden with Pro); tag IDs (hidden with Pro); JavaScript variables (still visible); CSS classes (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/wpforms/diagram-en.svg?v=a892774a)

## Which sites WPForms is a good fit for

- **Small business sites and freelancers** who want a contact or quote form built with the mouse, without writing code or CSS.
- **Light payment needs**: a deposit, a donation or a booking paid through Stripe or PayPal, without setting up a full store.
- **Agencies** handing forms over to non-technical clients: the visual builder and templates need no training.

The free version is the wrong pick if you need every message in the dashboard, want to receive files or show fields based on answers: file uploads, conditional logic and multi-page forms are reserved for paid plans. For a simple free form, [Contact Form 7](https://www.wp-masquerade.com/features/camouflaged-plugins/contact-form-7/) does the job; [Fluent Forms](https://www.wp-masquerade.com/features/camouflaged-plugins/fluent-forms/) is the other visual builder worth comparing.

## WPForms strengths and limitations

### Strengths

- **Instant learning curve.** The drag-and-drop builder and ready-made templates mean there is no syntax to learn.
- **Payments in the free version.** Stripe, PayPal Commerce and Square work without a license, subject to the platform fee.
- **Thorough anti-spam.** Invisible protection on by default, plus reCAPTCHA, hCaptcha, Cloudflare Turnstile and Akismet with no extra addon.
- **Targeted loading.** By default, WPForms files load only on pages that contain a form.

### Limitations

- **No entries on the site with Lite.** If the email gets lost, so does the message; Lite Connect only makes it viewable after you buy a license.
- **Key features cost extra.** File uploads, conditional logic and multi-page forms require at least the Basic plan.
- **3% fee without a license.** On a payment form, it applies to every transaction for as long as you stay on Lite.
- **Full-price renewals.** The advertised price is a first-year discount: Basic costs $99 per year ($49.50 for the first year).
- **Payment-related vulnerabilities.** Several flaws from 2024 to 2026 hit Stripe and PayPal, which makes quick updates essential.

## The settings we recommend for WPForms

Form settings open from WPForms > All Forms: edit the form, then click Settings in the builder. Global settings live under WPForms > Settings. Because the free version keeps no copy of messages, email reliability comes first.

| Setting | Recommended value | Why |
| --- | --- | --- |
| **From Email**  Builder > Settings > Notifications | A real address on the site’s domain, for example `contact@yourdomain.com` | The vendor advises against Gmail or Yahoo and against the visitor’s address; the builder shows a warning when the domain does not match. |
| **Reply-To**  Builder > Settings > Notifications | The smart tag of the form’s Email field | Left empty, it falls back to the From Email: you would be replying to yourself. |
| **Authenticated sending**  SMTP plugin and the domain’s DNS zone | Send through an SMTP server, with SPF and DKIM | The vendor itself recommends [WP Mail SMTP](https://www.wp-masquerade.com/features/camouflaged-plugins/wp-mail-smtp/); the From Email must match your SMTP settings. |
| **Enable anti-spam protection**  Builder > Settings > Spam Protection and Security | On for every form | Forms still on the old token or honeypot are moved to this newer protection; check your older forms. |
| **CAPTCHA**  WPForms > Settings > CAPTCHA | Cloudflare Turnstile with the site key and secret key, then Enable Cloudflare Turnstile in the form | Free and puzzle-free for visitors; useful when bots get past the invisible protection. |
| **Enable Akismet anti-spam protection**  Builder > Settings > Spam Protection and Security | On if Akismet is installed with a key | Filters human spammers that CAPTCHAs let through. |
| **Enable Entry Backups**  WPForms > Settings > General, Lite Connect section | On only if you plan to buy a paid license | Entries are stored on WPForms servers for one year: mention it in your privacy policy. |
| **Load Assets Globally**  WPForms > Settings > General | Off (the default) | The vendor recommends it only for compatibility issues; when on, it loads the files on every page. |
| **Updates**  Plugins > Installed Plugins | Auto-updates on, version 2.0.2.2 or later | The payment flaws listed below are fixed as of this version. |

- Submit a test entry and check that the notification lands in the inbox, not in spam.
- Hit Reply on that notification: the suggested address should be the one typed into the form.
- On a payment form, match a test transaction against the Stripe or PayPal dashboard before opening the form to the public.
- Open each older form and look for the notice about legacy anti-spam protection.

For the other places bots get in, see our page on [anti-spam for WordPress](https://www.wp-masquerade.com/wordpress-anti-spam/).

## Payments, the weak spot of WPForms

The most serious WPForms vulnerabilities involve payments. CVE-2024-11205 let a mere Subscriber refund Stripe payments and cancel subscriptions in versions 1.8.4 to 1.9.2.1; version 1.9.2.2 fixed it. Before that, CVE-2024-3649 let a visitor change the price of a Stripe purchase up to version 1.8.7.2.

In 2026, the arrival of PayPal Commerce brought new flaws exploitable without an account: forgeable PayPal notifications (CVE-2026-4986, fixed in 1.10.0.5), Stripe refunds of payments made outside the form (CVE-2026-74991, fixed in 2.0.2) and a PayPal payment bypass (CVE-2026-82844, fixed in 2.0.2.2). CVE-2026-84744, fixed in 2.0.2.1, also allowed shortcodes to run through a redisplayed form.

The practical step is still auto-updates (see our guide to automatic plugin updates) and matching every notification against the actual payment; the full history is in our article on [WPForms security vulnerabilities](https://www.wp-masquerade.com/wpforms-security-vulnerabilities/). WP Masquerade, starting with its free version, removes some of the traces that point bots to WPForms (the next section lists which ones), which makes it harder to spot without replacing the patch.

## WPForms FAQ

**Does WPForms Lite save the messages it receives?**

Not in WordPress: it sends email notifications. Lite Connect can back up entries with the vendor for one year, and a paid license then lets you restore them to the site.

**Can you take payments with the free version?**

Yes, with Stripe, PayPal Commerce or Square. Without an active license, a 3% platform fee is added to every transaction, on top of the processor’s fees.

**How much does WPForms Pro cost?**

The entry plan, Basic, costs $99 per year before tax on one site, the price charged at renewal ($49.50 for the first year). The vendor advertises a 14-day refund window.

**Can I switch from Contact Form 7 to WPForms without starting over?**

Yes, WPForms includes an import tool for Contact Form 7 and Ninja Forms forms. Afterwards, check the notifications and anti-spam settings of each imported form.

## Key facts

- Category: Forms
- Vendor: WPForms LLC (Awesome Motive)
- Price: Free (Lite); Basic plan $99 per year before tax on one site ($49.50 for the first year)
- Active installations (wordpress.org): 5 000 000+
- Version: 2.0.3.1
- Official page: https://wordpress.org/plugins/wpforms-lite/

## What WP Masquerade hides

- Handled by the free version of WP Masquerade
- Removed by the free version: signed HTML comments
- With Pro: folder name, tag IDs
- Still visible: JavaScript variables, CSS classes