A real drag-and-drop canvas
Build a form visually with nine field types — text, textarea, email, number, date, select, radio, checkbox, file — no shortcode-guessing or page-builder workaround required.
Oiko / plugins / forms
Form builder
Oiko Forms
A drag-and-drop form builder that stores every entry, defends itself against spam by default, and hands you GDPR consent, export and erasure tools — without the upsell most free form plugins build toward.
free forever · no pro tier · no ads · nothing phones home
Price£0 — full feature set
Field types9, drag-and-drop canvas
Spam defenseshoneypot, time-trap, rate-limit
CAPTCHAoptional Cloudflare Turnstile
Release gateWP HealthKit audit
Spam-resistant by defaultA honeypot, a minimum-fill-time check and rate-limiting run on every form before Turnstile is even in the picture.
Entries you can act onEvery submission is stored with CSV export — not just emailed once and forgotten.
Consent, captured properlyThe exact consent text a visitor saw is stored with their entry — not a boolean re-checked against today's settings.
Itself auditedEvery tagged release passes WP HealthKit's own scanner before it publishes.
What it does
A form builder that doesn't hold anything back.
Entries, exports and spam protection are usually where a free form plugin starts asking for money. Forms ships all of it, from the first drag to the GDPR erasure request.
Entries, stored and exportable
Every submission is saved with its field values and available as CSV — the data outlives the notification email.
Hardened file uploads
Uploaded files are validated and stored the way a security audit expects, not merely accepted on faith.
Spam defenses, always on
A hidden honeypot field and a minimum-fill-time check run on every form for free. Add Cloudflare Turnstile per-form if a site needs a second layer.
GDPR consent, captured properly
An optional per-form consent checkbox whose exact wording at submission time is stored with the entry — a later copy edit never rewrites what an already-submitted entry appears to show.
Personal-data export & erasure
Wired into WordPress's own privacy tools, entry by entry, for any submission tied to a registered user.
A real mail sender
Notification emails go out with a proper From address, not the wordpress@yourdomain fallback most sites never notice is broken until it lands in spam.
Why it exists
The features stay free. The security isn't optional.
Most free form plugins hold back the parts that matter — entries, exports, real spam protection — for a paid tier. Forms ships all of it free, and every tagged release runs through the same WP HealthKit audit the rest of the Oiko line does.
A recent hardening pass added CSRF protection on CSV export, a multisite-aware uninstall, a guarded fallback for sites without the Sodium extension, and capped what had been an unbounded form-list query — exactly the kind of finding a security audit exists to catch before it ships, not after.
- 01CSV export had no CSRF protection → nonce-verified before every download.
- 02Uninstall only cleaned up the current site → now loops every site on a multisite network.
- 03Encryption assumed the Sodium extension was always present → falls back safely if it isn't.
- 04An unbounded form-list query → capped via a shared per-query limit.
Built the Oiko way
oiko-plugin-boilerplatePHP 8.3+ · WP 6.7+PHPUnit + WP_MockPHPCS / PHPStan cleanCSRF-checked CSV exportGDPR consent & erasure
Questions
Fair ones.
Do I need a CAPTCHA service to stop spam?+
No. A honeypot field and a minimum-fill-time check run on every form by default and catch most automated spam. Cloudflare Turnstile is available per-form as an extra layer, but it's optional.
What happens to the consent checkbox if I edit its wording later?+
Nothing, for entries already submitted. The exact text a visitor saw is stored with their entry at submission time — not a boolean re-evaluated against your current settings — so a later copy edit never changes what an already-submitted entry appears to show.
Does it work on a multisite network?+
Yes — uninstall loops every site on the network rather than cleaning up only the one it happened to run on, the multisite-aware behaviour a security audit checks for.
Also free