Choose a verification route
Free includes basic local protection and optional self-hosted ALTCHA. Pro adds Cloudflare Turnstile, a blocklist tester and per-form spam limits.
- Open Settings → Spam protection and choose the route appropriate to the site.
- Review rate and link limits for shared networks and expected traffic.
- Configure any required keys for an optional external service before enabling it.
Test review and no-script behavior
A missing or failed browser-token verification can hold a message in Needs review, including when verification is unavailable. Held messages send no notification.
- Test both ordinary and held sample submissions on staging.
- Verify the native no-JavaScript path.
- Check that a reviewer can accept a legitimate held entry.
Choose retention before collecting data
Received entries default to 365 days. Per-form overrides are available; zero keeps received entries indefinitely. Spam, Needs review and Trash have separate thirty-day limits or an earlier applicable expiry.
- Open Settings → Privacy and review the global policy.
- Review form-specific retention and metadata settings.
- Keep background scheduling working so due cleanup can run.
Handle erasure and uninstall deliberately
WordPress personal-data tools match exact submitted email addresses. Forms without an email question need manual review. Deletion from WordPress does not erase external copies.
- Use the relevant export or erasure request and verify the associated entry content.
- Review backups, exported files, recipients and enabled services separately.
- Check the delete-data setting before uninstalling. Core preserves data by default.
Need help with your setup?
Open a private support request. Include the step you’re on and what you expected to happen.
Open my support requests