{"id":309730,"date":"2026-05-26T20:18:48","date_gmt":"2026-05-26T20:18:48","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/ultimate-form\/"},"modified":"2026-05-31T20:34:32","modified_gmt":"2026-05-31T20:34:32","slug":"ultimate-form","status":"publish","type":"plugin","link":"https:\/\/ro.wordpress.org\/plugins\/ultimate-form\/","author":23147258,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"2.8.1","stable_tag":"2.8.1","tested":"6.8.5","requires":"6.0","requires_php":"8.0","requires_plugins":null,"header_name":"Ultimate Form","header_author":"Delta Web Solution","header_description":"Fast, privacy-first multi-step form builder with drag-and-drop, conditional logic, email notifications and design configurator.","assets_banners_color":"f0f7fb","last_updated":"2026-05-31 20:34:32","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"","header_author_uri":"https:\/\/delta-web-solution.de","rating":5,"author_block_rating":0,"active_installs":0,"downloads":196,"num_ratings":1,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"2.5.6":{"tag":"2.5.6","author":"desktopmoe","date":"2026-05-26 20:18:12"},"2.5.7":{"tag":"2.5.7","author":"desktopmoe","date":"2026-05-26 21:53:26"},"2.7.0":{"tag":"2.7.0","author":"desktopmoe","date":"2026-05-28 16:49:42"},"2.7.1":{"tag":"2.7.1","author":"desktopmoe","date":"2026-05-28 23:12:12"},"2.7.2":{"tag":"2.7.2","author":"desktopmoe","date":"2026-05-29 00:03:11"},"2.7.3":{"tag":"2.7.3","author":"desktopmoe","date":"2026-05-29 00:26:01"},"2.8.1":{"tag":"2.8.1","author":"desktopmoe","date":"2026-05-31 20:34:32"}},"upgrade_notice":{"2.7.4":"<p>File uploads now work end-to-end (with download links in entries), conditional logic supports all operators, and the Entries screen gains search, filtering and pagination. Recommended for all users.<\/p>","2.7.3":"<p>Important bug-fix release: fixes settings being wiped when saving one tab, hidden confirmation fields, redirect-after-submit, and a spam false-positive. Recommended for all users.<\/p>","2.7.2":"<p>Bug-fix release: floating labels render correctly on the public form again, plus form-editor and template-slug fixes. Recommended for all users.<\/p>","2.7.1":"<p>Adds step-abandonment analysis to the Form Analytics dashboard \u2014 see exactly where visitors drop off. No breaking changes.<\/p>","2.7.0":"<p>New Form Analytics dashboard (privacy-first conversion tracking) plus a fully redesigned live form with floating labels. New tables are created automatically on update. No breaking changes.<\/p>","2.5.9":"<p>Visual update: unified admin colour scheme and a redesigned, clearer &quot;Create New Form&quot; screen. No breaking changes.<\/p>","2.5.8":"<p>Important bug-fix release: fixes form creation from templates, the email template editor, conditional logic saving, and the password strength meter. Strongly recommended for all installations.<\/p>","2.5.7":"<p>Minor maintenance release. No functional changes. Safe to skip if you are already on 2.5.6.<\/p>","2.5.6":"<p>Two more Plugin Check Tool compliance fixes (radio-card label escaping, rate-limit query annotation). Recommended for all installations.<\/p>","2.5.5":"<p>Compliance pass for the WordPress.org Plugin Check Tool: translators comments, <code>wp_rand()<\/code>, <code>wp_safe_redirect()<\/code>, escape-hardening, and gated debug logging. Recommended for all installations.<\/p>","2.5.4":"<p>Critical fix: form submissions now work in the free version (the REST submit route was previously only present in the Pro edition). Strongly recommended.<\/p>","2.5.3":"<p>Minor escape-hardening for two admin templates. Recommended for all installations.<\/p>","2.5.2":"<p>Security and compliance update: nonce check on the entry-detail screen to block CSRF state changes, removed invalid Plugin URI header, and contributor list updated. Recommended for all installations.<\/p>","2.5.1":"<p>Compliance and documentation update for the WordPress.org plugin directory. Expands the External Services section with per-service detail and adds recursive sanitization to all JSON-decoded administrator inputs. Recommended for all installations.<\/p>","2.5":"<p>Security update -- REST API endpoints now validate nonces and apply IP rate limiting. Update recommended for all installations.<\/p>"},"ratings":{"1":0,"2":0,"3":0,"4":0,"5":1},"assets_icons":{"icon-128x128.gif":{"filename":"icon-128x128.gif","revision":3549796,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-128x128.png":{"filename":"icon-128x128.png","revision":3549714,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.gif":{"filename":"icon-256x256.gif","revision":3549796,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3549714,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3549714,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3549714,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":{"ultimate-form\/form":{"name":"ultimate-form\/form","title":"Form"}},"tagged_versions":["2.5.6","2.5.7","2.7.0","2.7.1","2.7.2","2.7.3","2.8.1"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"Drag-and-drop form builder \u2014 field palette, live canvas and the field inspector","2":"Multi-step form on the frontend \u2014 floating labels and a clean progress bar","3":"Form Analytics \u2014 privacy-first conversion dashboard with the step-by-step funnel","4":"Design configurator \u2014 colours, typography and spacing with a live preview","5":"Entries management \u2014 search, filter and one-click CSV export"}},"plugin_section":[],"plugin_tags":[130308,358,3938,2253,30663],"plugin_category":[],"plugin_contributors":[264531],"plugin_business_model":[],"class_list":["post-309730","plugin","type-plugin","status-publish","hentry","plugin_tags-conditional-logic","plugin_tags-contact-form","plugin_tags-drag-and-drop","plugin_tags-form-builder","plugin_tags-multi-step-form","plugin_contributors-desktopmoe","plugin_committers-desktopmoe"],"banners":{"banner":"https:\/\/ps.w.org\/ultimate-form\/assets\/banner-772x250.png?rev=3549714","banner_2x":"https:\/\/ps.w.org\/ultimate-form\/assets\/banner-1544x500.png?rev=3549714","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/ultimate-form\/assets\/icon-128x128.png?rev=3549714","icon_2x":"https:\/\/ps.w.org\/ultimate-form\/assets\/icon-256x256.png?rev=3549714","generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p><strong>Ultimate Form<\/strong> is a powerful, free form builder for WordPress \u2014 and the only one with a built-in, <strong>privacy-first conversion dashboard<\/strong> that shows you exactly where visitors drop off, so you can fix the steps and fields that cost you leads.<\/p>\n\n<p>Build multi-step funnels, add conditional logic, collect file uploads, send email notifications and manage every submission \u2014 all from one plugin with <strong>no limit on the number of forms, fields or entries<\/strong>. No cookies, no account, no upsell wall around the basics.<\/p>\n\n<h4>Why Ultimate Form?<\/h4>\n\n<ul>\n<li><strong>It's genuinely unlimited<\/strong> \u2014 unlimited forms, steps, fields and submissions in the free version.<\/li>\n<li><strong>You can see what's working<\/strong> \u2014 most form plugins collect entries; Ultimate Form also tells you your conversion rate, your funnel and your worst-performing fields, with zero personal data.<\/li>\n<li><strong>It looks good out of the box<\/strong> \u2014 a clean, modern form with floating labels, a clear focus ring and a consistent brand colour system across the whole plugin.<\/li>\n<li><strong>It respects privacy by design<\/strong> \u2014 IP hashing, anonymous analytics, Do-Not-Track support and a consent-checkbox generator.<\/li>\n<\/ul>\n\n<h4>Key Features<\/h4>\n\n<ul>\n<li><strong>Drag &amp; Drop Builder<\/strong> with 25+ field types (text, email, phone, textarea, select, radio, checkbox, multi-select, date\/time, number, currency, URL, password, rating, range slider, color, file upload, multiple files, name, address, ZIP lookup, repeater, calculator, CAPTCHA, ...)<\/li>\n<li><strong>Multi-Step Forms<\/strong> with a configurable progress bar and step navigation<\/li>\n<li><strong>Form Analytics<\/strong> \u2014 privacy-first conversion dashboard: views, start &amp; conversion rate, step funnel, step-abandonment, field drop-off, validation hotspots, device &amp; traffic source \u2014 no cookies, no IP, fully anonymous<\/li>\n<li><strong>Conditional Logic<\/strong> \u2014 show\/hide fields and steps based on previous answers<\/li>\n<li><strong>File Uploads<\/strong> \u2014 single and multiple file fields with type and size validation; uploads appear as download links in each entry<\/li>\n<li><strong>Email Notifications<\/strong> \u2014 per-form templates for customer, admin and custom recipients<\/li>\n<li><strong>Design Configurator<\/strong> \u2014 live preview for colours, typography, spacing and logo<\/li>\n<li><strong>Entries Management<\/strong> \u2014 view, search, filter, star, paginate and export submissions as CSV<\/li>\n<li><strong>Save &amp; Continue<\/strong> \u2014 visitors can resume a long form where they left off<\/li>\n<li><strong>Webhook Integration<\/strong> \u2014 send form data to any external URL via HTTP POST<\/li>\n<li><strong>Honeypot Spam Protection<\/strong> \u2014 invisible spam protection on every form<\/li>\n<li><strong>GDPR Compliant<\/strong> \u2014 IP hashing, consent-checkbox generator, anonymous analytics<\/li>\n<li><strong>Translation Ready<\/strong> \u2014 every user-facing string is translatable<\/li>\n<li><strong>Shortcode Embed<\/strong> \u2014 <code>[ultimate_form id=\"X\"]<\/code> works with any theme or page builder<\/li>\n<li><strong>Elementor Widget<\/strong> \u2014 a dedicated widget to drop any form straight into your Elementor layouts<\/li>\n<li><strong>Iframe Embed<\/strong> \u2014 embed a form on external, non-WordPress websites with a ready-to-paste iframe snippet<\/li>\n<\/ul>\n\n<h4>Need More?<\/h4>\n\n<p><strong><a href=\"https:\/\/delta-web-solution.de\/wordpress-plugins\/ultimate-form\/\">Ultimate Form Pro<\/a><\/strong> adds powerful features for businesses:<\/p>\n\n<ul>\n<li>Stripe &amp; PayPal payment processing<\/li>\n<li>WooCommerce integration<\/li>\n<li>CRM integration (Brevo, HubSpot, ActiveCampaign, Pipedrive, Salesforce, Mailchimp)<\/li>\n<li>Native PDF generation from submissions<\/li>\n<li>Telegram, Discord &amp; Slack notifications<\/li>\n<li>Zapier \/ Make automation<\/li>\n<li>Form cloning, A\/B testing, submission limits<\/li>\n<li>GDPR data export &amp; erasure tools<\/li>\n<li>Signature field<\/li>\n<li>Priority support<\/li>\n<\/ul>\n\n<p><a href=\"https:\/\/delta-web-solution.de\/wordpress-plugins\/ultimate-form\/\">Get Ultimate Form Pro<\/a><\/p>\n\n<h3>External Services<\/h3>\n\n<p>This plugin does not communicate with any external service by default. All form submissions are stored locally in your WordPress database. The following optional features may connect to a third-party service, but only when explicitly enabled and configured by the site administrator:<\/p>\n\n<h4>1. Webhook Addon (Generic HTTP POST)<\/h4>\n\n<p><strong>What it does:<\/strong> Forwards form submission data to an arbitrary URL that the administrator configures inside the plugin settings (Settings \u2192 Addons \u2192 Webhook).<\/p>\n\n<p><strong>When data is sent:<\/strong> Only when (a) the Webhook addon is enabled, (b) a valid URL is provided by the administrator, and (c) a form submission is received that is mapped to the webhook.<\/p>\n\n<p><strong>What data is sent:<\/strong> The serialized form submission (form ID, submitted field values, submission ID, timestamp). The complete payload is the data the administrator configured the form to collect.<\/p>\n\n<p><strong>Where it is sent:<\/strong> The endpoint URL is entirely controlled by the administrator. The plugin does not ship with a pre-configured destination. There is no Ultimate Form vendor server involved at any point.<\/p>\n\n<p><strong>Service provider:<\/strong> N\/A \u2014 the destination is user-configured. The administrator is responsible for ensuring that the receiving endpoint complies with their privacy policy and applicable law.<\/p>\n\n<h4>2. Plugin Support Form (delta-web-solution.de)<\/h4>\n\n<p><strong>What it does:<\/strong> The plugin Help page contains a contact form that, when submitted by an administrator, sends an email to <code>ultimate@delta-web-solution.de<\/code> (the plugin vendor) using the WordPress <code>wp_mail()<\/code> function.<\/p>\n\n<p><strong>When data is sent:<\/strong> Only when the administrator clicks \"Send\" on the Help page support form.<\/p>\n\n<p><strong>What data is sent:<\/strong> The message text and reply-to email address typed by the administrator. Nothing is sent automatically.<\/p>\n\n<p><strong>Where it is sent:<\/strong> Routed via the local WordPress <code>wp_mail()<\/code> mailer to <code>ultimate@delta-web-solution.de<\/code>. No third-party API is involved.<\/p>\n\n<p><strong>Service provider:<\/strong> Delta Web Solution (the plugin author).<\/p>\n\n<ul>\n<li>Website: <a href=\"https:\/\/delta-web-solution.de\">https:\/\/delta-web-solution.de<\/a><\/li>\n<li>Terms of Use: <a href=\"https:\/\/delta-web-solution.de\/agb\">https:\/\/delta-web-solution.de\/agb<\/a><\/li>\n<li>Privacy Policy: <a href=\"https:\/\/delta-web-solution.de\/datenschutz\">https:\/\/delta-web-solution.de\/datenschutz<\/a><\/li>\n<\/ul>\n\n<h4>Note on the free version<\/h4>\n\n<p>The free Ultimate Form plugin does not contain any license server, telemetry, analytics or \"phone home\" code. All feature-detection happens locally inside the plugin code. There is no upgrade or activation check that contacts a remote server.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the plugin files to the <code>\/wp-content\/plugins\/ultimate-form<\/code> directory, or install via <strong>Plugins &gt; Add New<\/strong>.<\/li>\n<li>Activate the plugin through the <strong>Plugins<\/strong> menu in WordPress.<\/li>\n<li>Go to <strong>Ultimate Form<\/strong> in the admin sidebar to create your first form.<\/li>\n<li>Use the shortcode <code>[ultimate_form id=\"1\"]<\/code> to embed forms on any page or post.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"how%20many%20forms%20can%20i%20create%3F\"><h3>How many forms can I create?<\/h3><\/dt>\n<dd><p>There is no limit. You can create and publish as many forms as you need. The free plugin has no form quotas, time limits or feature gates.<\/p><\/dd>\n<dt id=\"can%20i%20build%20multi-step%20forms%3F\"><h3>Can I build multi-step forms?<\/h3><\/dt>\n<dd><p>Yes. Add as many steps as you like and turn on the progress bar. Visitors can move back and forth, and conditional logic can even skip whole steps based on earlier answers.<\/p><\/dd>\n<dt id=\"can%20visitors%20upload%20files%3F\"><h3>Can visitors upload files?<\/h3><\/dt>\n<dd><p>Yes. The free version includes single and multiple file-upload fields with file-type and size validation. Uploaded files are stored in your Media library folder and shown as download links on each entry.<\/p><\/dd>\n<dt id=\"does%20conditional%20logic%20work%20on%20the%20free%20version%3F\"><h3>Does conditional logic work on the free version?<\/h3><\/dt>\n<dd><p>Yes. You can show or hide individual fields and entire steps based on what the visitor selected earlier \u2014 no Pro upgrade required.<\/p><\/dd>\n<dt id=\"what%20does%20the%20form%20analytics%20dashboard%20show%3F\"><h3>What does the Form Analytics dashboard show?<\/h3><\/dt>\n<dd><p>Views, start rate, conversion rate, average time to complete, a step-by-step funnel, step-abandonment, the fields where people drop off, and device and traffic-source breakdowns \u2014 all anonymous and aggregated, with no cookies and no IP storage.<\/p><\/dd>\n<dt id=\"can%20i%20export%20my%20submissions%3F\"><h3>Can I export my submissions?<\/h3><\/dt>\n<dd><p>Yes. Entries can be searched, filtered and exported to CSV (UTF-8, spreadsheet-safe) at any time.<\/p><\/dd>\n<dt id=\"is%20the%20plugin%20translation%20ready%3F\"><h3>Is the plugin translation ready?<\/h3><\/dt>\n<dd><p>Yes. Every user-facing string is wrapped for translation, so you can localise the plugin into any language.<\/p><\/dd>\n<dt id=\"does%20the%20plugin%20send%20data%20to%20external%20servers%3F\"><h3>Does the plugin send data to external servers?<\/h3><\/dt>\n<dd><p>By default, no. All form submissions are stored in your WordPress database. The plugin does not contact any external server unless you explicitly enable and configure the Webhook addon. See the \"External Services\" section for full details.<\/p><\/dd>\n<dt id=\"is%20it%20gdpr%20compliant%3F\"><h3>Is it GDPR compliant?<\/h3><\/dt>\n<dd><p>Yes. IP addresses are hashed (not stored raw), a consent checkbox generator is included. No data leaves your server unless you explicitly enable an external integration.<\/p><\/dd>\n<dt id=\"which%20page%20builders%20are%20supported%3F\"><h3>Which page builders are supported?<\/h3><\/dt>\n<dd><p>The shortcode <code>[ultimate_form id=\"X\"]<\/code> works with Gutenberg, Elementor, Divi, Bricks, Beaver Builder, Oxygen and the classic editor. A dedicated Elementor widget is included as well, and you can embed forms on external (non-WordPress) sites via the built-in iframe embed.<\/p><\/dd>\n<dt id=\"what%20are%20the%20minimum%20requirements%3F\"><h3>What are the minimum requirements?<\/h3><\/dt>\n<dd><p>WordPress 6.0+ and PHP 8.0+. Recommended: WordPress 6.4+ and PHP 8.1+.<\/p><\/dd>\n<dt id=\"is%20there%20a%20pro%20version%3F\"><h3>Is there a Pro version?<\/h3><\/dt>\n<dd><p>Yes. Ultimate Form Pro adds payment processing, WooCommerce integration, CRM connections, PDF generation and more. The Pro version is hosted separately on the author's website and is NOT included in or required by the free plugin distributed via WordPress.org. Visit <a href=\"https:\/\/delta-web-solution.de\/wordpress-plugins\/ultimate-form\/\">delta-web-solution.de<\/a> for details.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>2.8.1<\/h4>\n\n<ul>\n<li>New: <strong>Email Profiles<\/strong> \u2014 reusable email setups (customer + admin notifications) with a live preview, configurable colours and an optional header gradient picker.<\/li>\n<li>New: <strong>Modernised field inspector<\/strong> \u2014 settings are now grouped into clean cards (Field basics \u00b7 Behaviour &amp; display \u00b7 Custom CSS) with rounded, consistent inputs.<\/li>\n<li>New: <strong>Design configurator<\/strong> improvements and a shared custom colour picker across the design and email screens.<\/li>\n<li>Improved: <strong>Accessibility<\/strong> \u2014 visible keyboard focus rings across the builder, design and frontend form.<\/li>\n<li>Fixed: <strong>Form submission reliability<\/strong> \u2014 the submission endpoint is now registered independently of optional integrations, so every form submits correctly.<\/li>\n<li>Fixed: the <strong>{field:email}<\/strong> placeholder in the email \"To\" field is now preserved on save.<\/li>\n<li>Fixed: field-palette category icons and several admin UI polish issues.<\/li>\n<\/ul>\n\n<h4>2.7.4<\/h4>\n\n<ul>\n<li>New: <strong>File uploads now work end-to-end<\/strong> \u2014 single and multiple file fields upload to your Media library folder (with file-type and size validation) and appear as download links on each entry.<\/li>\n<li>New: <strong>Repeater<\/strong> and <strong>ZIP lookup<\/strong> fields are now available directly in the builder's field palette.<\/li>\n<li>Fixed: <strong>conditional logic<\/strong> now supports every operator (equals, not equals, contains, greater\/less than, starts\/ends with, is empty \/ is not empty) for both field-level and step-level rules, and re-evaluates correctly across steps.<\/li>\n<li>Fixed: <strong>required validation<\/strong> for multi-checkbox groups, plus minimum\/maximum character-length checks on text fields.<\/li>\n<li>Fixed: <strong>Entries<\/strong> screen now supports search, status filtering and pagination, and the CSV export is hardened against spreadsheet formula injection.<\/li>\n<li>Fixed: the <strong>Design configurator<\/strong> no longer loses a custom font family on save, and the \"Reset\" button restores the true defaults again.<\/li>\n<li>Fixed: <strong>Save &amp; Continue<\/strong> is now stored per form and clears automatically after a successful submission.<\/li>\n<li>Improved: textarea line breaks are preserved in stored entries; the form focuses the first invalid field; double submissions are blocked; and several remaining hardcoded strings are now translatable.<\/li>\n<\/ul>\n\n<h4>2.7.3<\/h4>\n\n<ul>\n<li>Fixed: saving the General settings tab no longer wipes the Email-template settings (and vice-versa) \u2014 each tab now saves only its own fields. This also stops the admin notification address and the honeypot\/analytics toggles from being reset.<\/li>\n<li>Fixed: the \"Confirmation message\" and \"Redirect URL\" fields are visible again on the Settings screen (a broken script kept both rows hidden).<\/li>\n<li>Fixed: \"Redirect to URL\" after submission now actually redirects (the saved option was read under the wrong name).<\/li>\n<li>Fixed: spam protection no longer blocks legitimate submissions on forms that contain an unrelated field whose name ends in \"_token\".<\/li>\n<li>Fixed: leaving a field's min\/max length empty in the builder now means \"no limit\" again instead of forcing it to 0.<\/li>\n<li>Fixed: importing a form\/template with incomplete conditional-logic rules no longer creates broken rules or warnings.<\/li>\n<li>Fixed: entry detail no longer double-encodes form titles that contain \"&amp;\" or special characters.<\/li>\n<li>Improved: a saved global e-mail heading is now used for customer confirmations; hardened a few output paths against PHP 8.1 notices.<\/li>\n<\/ul>\n\n<h4>2.7.2<\/h4>\n\n<ul>\n<li>Fixed: floating labels now display correctly on the public form \u2014 the field label sits inside the field as a placeholder and lifts up on focus\/fill (a bulletproof CSS rule was forcing the label to stay bold and static on forms that use the Design configurator).<\/li>\n<li>Fixed: removed a broken script on the form editor screen that threw a JavaScript console error (a stray template artifact).<\/li>\n<li>Fixed: creating a form from a template now generates a clean slug (e.g. \"contact\") instead of carrying the internal template prefix (e.g. \"tpl_contact\").<\/li>\n<li>Fixed: the form-editor preview button now reads \"Submit\" instead of a leftover checkout label.<\/li>\n<\/ul>\n\n<h4>2.7.1<\/h4>\n\n<ul>\n<li>New: <strong>Step-abandonment analysis<\/strong> in Form Analytics \u2014 a visual funnel showing exactly which step visitors reach before leaving an unfinished form, with the drop-off rate and the field they last touched at each step.<\/li>\n<li>Improved: clearer \"where visitors stop\" reporting to pinpoint the steps and fields that cost you conversions.<\/li>\n<\/ul>\n\n<h4>2.7.0<\/h4>\n\n<ul>\n<li>New: <strong>Form Analytics<\/strong> \u2014 a privacy-first conversion dashboard. See views, start rate, conversion rate, average time-to-complete, a step-by-step funnel, where visitors drop off, which fields throw the most errors, plus device and traffic-source breakdowns. No cookies, no IP, no personal data \u2014 anonymous and aggregated, with an automatic data-retention cleanup and a Do-Not-Track option.<\/li>\n<li>New: privacy controls under Settings \u2192 \"Analytics &amp; privacy\" (enable\/disable tracking, honour Do-Not-Track, set retention days).<\/li>\n<li>Design: the public-facing form is fully redesigned \u2014 modern floating labels that sit inside each field and lift up on focus, softer inputs, a clearer focus ring, and primary buttons with subtle depth and a smooth hover lift.<\/li>\n<li>Added: a trust line under every form (\"Spam-protected \u00b7 GDPR-compliant\").<\/li>\n<li>Improved: the entire plugin (admin + frontend) now shares one consistent brand colour system.<\/li>\n<li>Fixed: the focus ring and the red \"invalid field\" border are reliably visible again (a defensive style reset was hiding them).<\/li>\n<li>Maintenance: uninstall now also removes view counters, analytics tables, the retention cron and orphaned per-field options.<\/li>\n<li>Note: floating labels apply to text, email, phone, URL, number, password, textarea, select and date\/time fields; choice, file, rating and composite fields keep their static labels for clarity and accessibility.<\/li>\n<\/ul>\n\n<h4>2.5.9<\/h4>\n\n<ul>\n<li>Design: unified the entire admin colour scheme to a single brand blue (previously 5 different blue tones were mixed across screens)<\/li>\n<li>Design: redesigned the \"Create New Form\" screen \u2014 colourful template icons, a feature highlight bar, a clear \"start from scratch\" entry, hover states and full-width gallery<\/li>\n<li>Improved: template meta now uses correct singular\/plural (\"1 step\" vs \"3 steps\") and is fully translatable<\/li>\n<li>Improved: replaced inconsistent emoji template icons with crisp inline SVG icons<\/li>\n<\/ul>\n\n<h4>2.5.8<\/h4>\n\n<ul>\n<li>Fix: creating a form from a template now opens the editor correctly instead of a blank screen (import routine now returns the new form ID)<\/li>\n<li>Fix: the email template editor now saves all fields \u2014 greeting, footer, recipient, CC, BCC, custom HTML and field selection were previously discarded on save<\/li>\n<li>Fix: conditional logic rules are now stored correctly (the save handler read the wrong field keys, so rules were saved empty and never applied on the frontend)<\/li>\n<li>Fix: the password field strength meter now renders and works (a duplicate switch case had disabled it)<\/li>\n<li>Improved: admin notification emails now set Reply-To to the submitter's address, so replying goes straight to the lead<\/li>\n<li>Improved: deleting a form now also removes its entries, entry fields and view stats (no more orphaned rows)<\/li>\n<li>Security: email From header is stripped of CR\/LF to prevent header injection via stored settings<\/li>\n<\/ul>\n\n<h4>2.5.7<\/h4>\n\n<ul>\n<li>Maintenance: removed non-WordPress.org contributor handle from the Contributors header (silences the import warning shown only to plugin authors)<\/li>\n<\/ul>\n\n<h4>2.5.6<\/h4>\n\n<ul>\n<li>Compliance: radio-card label now escapes the raw option value via <code>esc_html()<\/code> at the output site (no longer relies on a pre-escaped variable Plugin Check cannot trace)<\/li>\n<li>Compliance: the TTL-preserving rate-limit counter increment on <code>wp_options<\/code> now carries an explicit Plugin Check annotation explaining why the transient API cannot be used here<\/li>\n<\/ul>\n\n<h4>2.5.5<\/h4>\n\n<ul>\n<li>Compliance: added <code>\/* translators: *\/<\/code> annotations to every <code>__()<\/code>\/<code>esc_html__()<\/code> call that uses placeholders (Plugin Check requirement)<\/li>\n<li>Compliance: replaced <code>rand()<\/code> with <code>wp_rand()<\/code> in the math-captcha renderer<\/li>\n<li>Compliance: every <code>wp_redirect()<\/code> in admin page callbacks replaced with <code>wp_safe_redirect()<\/code><\/li>\n<li>Compliance: explicit output escaping for <code>$total_unread<\/code> and radio-card <code>alt<\/code> attributes<\/li>\n<li>Compliance: <code>error_log()<\/code> debug calls gated behind <code>WP_DEBUG<\/code> + <code>WP_DEBUG_LOG<\/code> (no production logging)<\/li>\n<li>Documentation: class-level PHPCS justifications added to <code>UltimateForm_Admin<\/code> and <code>UltimateForm_Form_Manager<\/code> explaining the plugin's custom-table architecture, the nonce-verification helper indirection, and the intentional cache bypass<\/li>\n<\/ul>\n\n<h4>2.5.4<\/h4>\n\n<ul>\n<li>Fix: registered the public REST route <code>ultimateform\/v1\/checkout<\/code> that the frontend form engine posts submissions to (this route was previously only shipped with the Pro edition, which left the free version unable to submit forms)<\/li>\n<li>Improved: client IP resolution falls back through CF-Connecting-IP, X-Forwarded-For and REMOTE_ADDR, with strict IPv4\/IPv6 validation<\/li>\n<li>Improved: confirmation message is now passed through <code>wp_kses_post()<\/code> before output<\/li>\n<\/ul>\n\n<h4>2.5.3<\/h4>\n\n<ul>\n<li>Hardened output escaping in the upgrade comparison table (per-cell if\/else instead of conditional echo expressions)<\/li>\n<li>Field renderer attribute output split into separate echo statements with explicit per-line phpcs annotations<\/li>\n<\/ul>\n\n<h4>2.5.2<\/h4>\n\n<ul>\n<li>Security: added nonce verification to the entry-detail admin screen before marking an entry as read (prevents CSRF state changes via crafted GET URLs)<\/li>\n<li>Compliance: removed the Plugin URI header (no broken external link in the directory listing)<\/li>\n<li>Compliance: contributor list now includes the WordPress.org account that owns the plugin<\/li>\n<\/ul>\n\n<h4>2.5.1<\/h4>\n\n<ul>\n<li>Security: recursive sanitization for all JSON-decoded administrator inputs (logic, conditions, visible_fields, import payloads)<\/li>\n<li>Security: all REST endpoints use a custom permission callback with rate limiting (no <code>__return_true<\/code>)<\/li>\n<li>Compliance: removed <code>load_plugin_textdomain()<\/code> call (WordPress 4.6+ auto-loads translations)<\/li>\n<li>Compliance: every PHP file with executable code starts with an <code>ABSPATH<\/code> direct-access guard<\/li>\n<li>Compliance: file\/path resolution uses <code>plugin_dir_path()<\/code>, <code>plugin_dir_url()<\/code> and <code>wp_upload_dir()<\/code> only (no hardcoded <code>site_url()<\/code> \u2192 <code>ABSPATH<\/code> string replacements)<\/li>\n<li>Documentation: External Services section expanded with per-service data flow, destination and provider information<\/li>\n<li>Documentation: clarification that the free plugin contains no license server calls or telemetry of any kind<\/li>\n<\/ul>\n\n<h4>2.5<\/h4>\n\n<ul>\n<li>Security: replaced permissive permission callbacks with nonce validation and IP rate limiting on all REST endpoints<\/li>\n<li>Improved: inline scripts and styles replaced with properly enqueued assets via <code>wp_enqueue_script()<\/code> \/ <code>wp_add_inline_script()<\/code><\/li>\n<li>Improved: all administrator-facing output properly escaped via <code>esc_html()<\/code>, <code>esc_attr()<\/code> and <code>esc_url()<\/code><\/li>\n<li>Plugin version constant updated throughout<\/li>\n<\/ul>\n\n<h4>2.4<\/h4>\n\n<ul>\n<li>Split save button: Save as Draft vs Publish in form editor<\/li>\n<li>Toast notifications redesigned (fixed full-width banner bug)<\/li>\n<li>Delete form action fixed (double event handler removed)<\/li>\n<\/ul>","raw_excerpt":"Free drag-and-drop form builder: multi-step forms, conditional logic, file uploads, privacy-first analytics, email notifications and CSV export.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ro.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/309730","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ro.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/ro.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/ro.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=309730"}],"author":[{"embeddable":true,"href":"https:\/\/ro.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/desktopmoe"}],"wp:attachment":[{"href":"https:\/\/ro.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=309730"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/ro.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=309730"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/ro.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=309730"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/ro.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=309730"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/ro.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=309730"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/ro.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=309730"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}