How to create custom forms in WordPress
The short answer
For a simple contact form, WordPress 7.0 can use its experimental Form block; for a fully custom workflow, you need code or a form plugin. The manual code route gives control but requires validation, spam protection, email delivery setup and maintenance.
What you need
- A self-hosted WordPress site with admin access
- A page where the form should appear
- An email address that can receive submissions
- A staging site or recent backup for coded changes
The fast route
Get Super Forms
Let Super Forms do it
Drag-and-drop builder with conditional logic and multi-step forms, suited to complex forms without coding.
Sources
- developer.wordpress.org /block-editor/reference-guides/core-blocks/core-blocks-widge…
- developer.wordpress.org /reference/functions/wp_mail/?utm_source=openai
- developer.wordpress.org /apis/security/nonces/
Questions
- Can WordPress create a form without a plugin?
- Yes, WordPress can create a basic form with its experimental Form block, or you can add custom HTML and write your own server-side handler. HTML alone only displays fields; it does not securely validate, store or email submissions. A coded solution therefore needs nonce checks, sanitisation, spam controls and a reliable mail setup.
- Does the WordPress Form block save submissions?
- The core Form block is designed around submission methods such as email, but you should not assume it provides the entry management features of a form plugin. Check the block’s available settings and test where submissions go before publishing. If you need searchable entries, exports, user accounts or complex workflows, use a dedicated form solution or build storage deliberately.
- Why are my WordPress form emails not arriving?
- A form email can fail because the server mail environment is not configured, the message is rejected by a mail provider, or it is filtered as spam. WordPress’s <code>wp_mail()</code> function reports whether the mail system accepted the request, not whether the recipient received it. Use authenticated SMTP or a transactional provider and check your domain’s email authentication records.
- How do I protect a custom WordPress form?
- Protect a custom form by checking a WordPress nonce, validating every submitted value on the server, sanitising data for its intended use, limiting abusive requests and adding a honeypot or CAPTCHA. Nonces help protect requests from unwanted reuse, but WordPress states that they are not a complete replacement for authorisation, validation or other security controls.
- Should I code a form or use a form plugin?
- Code a form when it is small, stable and you or your developer can maintain the handler. Use a plugin when you need conditional logic, multi-step screens, file uploads, integrations, stored entries or non-technical editors to change fields. Coding avoids plugin-specific interfaces but leaves you responsible for security, accessibility, email delivery, updates and testing.