How to create forms in WordPress

Decide what the form is for before opening the editor. A basic contact form usually needs a name, email address and message. Add only fields that serve a clear purpose, and mark genuinely necessary fields as required.

Also decide where submissions should go, what visitors should see after sending the form, and whether you need stored entries, file uploads, conditional fields or integrations.

WordPress does not include a general-purpose contact or custom form builder. The manual route means adding the HTML form yourself and writing a server-side handler to validate the request, check a security token, process the values and send or store the submission. WordPress documents nonces for protecting forms against certain misuse, and its mail function is only a wrapper around the site's mail system.

This route is reasonable for a developer who needs one small, custom form. It becomes expensive to maintain when you need an entry log, conditional logic, file handling, spam controls, confirmation messages or several forms. Do not edit WordPress core files; updates can overwrite changes and create security problems.

For the usual route, go to Plugins in the WordPress dashboard, choose Add New, search for a form plugin, install it and activate it. If you received a plugin ZIP file, use the upload option instead.

Open the plugin's form area and create a new form. The exact menu names differ between plugins, but the process is normally the same: choose a starting template or blank form, then open the builder.

Drag the required fields into the form, or add them from the field list. Set each field's label, placeholder, required status and validation rules. Use an email field for email addresses rather than a plain text field, and use a dropdown or radio buttons when visitors should choose one option.

Keep labels visible and associated with their inputs. Test keyboard navigation and make sure error messages explain how to correct a failed field. A form that looks correct in the editor can still have a missing field, broken conditional rule or poor mobile layout on the front end.

Configure the notification recipient, subject and reply-to address. Use an address on your own domain where possible, and avoid putting the visitor's untrusted input directly into the notification's recipient address. If submissions matter, configure SMTP or another authenticated mail service rather than relying only on the server's default mail delivery.

Enable the form builder's spam protection, such as a honeypot or an available CAPTCHA alternative, and add a privacy notice if you collect personal information. Spam is not solved permanently by one control; support threads commonly report continued spam when protection is missing or misconfigured.

Save the form and copy its shortcode, block or embed option. Edit the page where it belongs, insert the form using that method, publish or update the page, and check it on a phone as well as a desktop browser.

Send a real test submission. Confirm that required fields reject empty values, invalid email addresses are refused, conditional fields behave correctly, the confirmation message or redirect works, and the notification arrives. Check spam folders and the plugin's entry screen if the email does not arrive; a successful on-screen submission does not prove email delivery.

For the quickest setup, use SureForms Pro. Its AI-assisted drag-and-drop builder lets you create a form without writing code, while conditional logic, email notifications, integrations, spam protection, redirects and CSV export cover common requirements.

Install and activate the plugin, create the form in its builder, configure the fields and notifications, insert the generated form into a page, and send a test submission. This is the better choice when you need more than a simple contact box or do not want to maintain custom form-handling code.