How it works
Begin with local spam controls
Free provides a honeypot, rate limits, link limits and optional self-hosted ALTCHA verification. Needs review lets your team inspect a held message before it sends a notification.
- Review limits for shared networks and expected traffic
- Accept legitimate held entries through the review workflow
- Pro adds Cloudflare Turnstile, a tested blocklist and per-form limits
Choose a retention policy
Choose a site retention period or keep received entries until manually deleted. Each form can use the site default or its own policy. New submissions keep the policy that applied when received, and due cleanup runs through WordPress scheduling.
- Received entries default to 365 days; named controls also offer manual deletion
- Spam, Needs review and Trash have separate thirty-day limits or an earlier applicable expiry
- Backups, downloaded exports and external services need their own retention decisions
Handle personal-data requests in context
WordPress personal-data export and erasure match exact submitted email addresses. Associated notification payloads, notes and attachments follow the relevant entry's erasure.
- Forms without an email question need manual review
- Per-form settings can reduce stored metadata
- Core has no analytics or telemetry; enabled delivery services receive the information needed for their feature
Set up a small support form
Privacy and spam decisions are easier before a real response arrives.
Ask for less
Use the email address needed for a reply and avoid questions unrelated to the support request.
Set the collection rules
Choose retention, review metadata options and confirm who may read submissions.
Check the held-message path
Test spam verification and review a controlled held message. Confirm that legitimate entries can be accepted without opening access to everyone.
An example workflow. Configure and test it in your own WordPress site.
Free and Pro for this workflow
Feature reference: Free 1.4.0 and Pro 1.3.2. Check published downloads for the version you can install.
Included in Free
- Local protection and optional self-hosted ALTCHA
- Held-message review, Spam and Trash workflows
- Global/per-form retention and WordPress personal-data tools
With Pro
- Optional Cloudflare Turnstile and blocklist controls
- Per-form spam limits
- The same privacy lifecycle for private uploads and advanced workflows
Plan your setup
- A browser-token verification method can hold submissions for review when the token is missing or verification is unavailable. Test the no-script path.
- Retention cleanup depends on a working WordPress scheduler. An exported or externally delivered copy is outside the plugin's cleanup boundary.
- Deleting the plugin preserves core data by default unless the explicit delete-data setting was enabled before uninstall.
Common questions
Are all spam controls external services?
No. Free includes local checks and an optional self-hosted ALTCHA route. Cloudflare Turnstile is an optional Pro service.
Does erasing an entry remove my backups too?
No. Site backups and copies held by recipients, exports or external services need their own handling.