SIForm

A visual drag-and-drop form builder for WordPress — with entries, payments, workflows and integrations. Thank you for your purchase. This guide covers everything from installing the plugin to connecting payment gateways.

Requirements

Payments, integrations and Envato updates need your site to reach the internet over HTTPS. Payment gateways also require your site itself to use HTTPS.

Installation & updates

Install

1. Unzip the file you downloaded from CodeCanyon. Inside is siform.zip — that is the plugin.
2. In WordPress go to Plugins → Add New Plugin → Upload Plugin, choose siform.zip and click Install Now.
3. Click Activate. A new SIForm menu appears in the admin sidebar.

Alternatively, unzip siform.zip and upload the siform folder to wp-content/plugins/ by FTP, then activate it.

Automatic updates

1. Go to SIForm → Modules → License & updates.
2. Enter your purchase code (CodeCanyon → Downloads → SIForm → License certificate & purchase code).
3. Enter an Envato personal token created at build.envato.com with the permissions “View your purchases” and “Download your purchased items”.
4. Click Activate. New versions then appear under Dashboard → Updates like any other plugin.

Updating by hand

Download the new version from CodeCanyon and upload siform.zip again from Plugins → Add New Plugin → Upload Plugin; WordPress offers to replace the current version. Your forms and entries are kept.

Your first form

1. Go to SIForm → Forms and click New form.
2. Start from one of 112 templates (in 18 categories, with search), a blank form, or describe the form in a sentence and let the assistant draft it.
3. Drag fields from the left panel onto the canvas. Drop a field beside another to place them in columns.
4. Click a field to edit it in the right panel. Use the Settings tab of the right panel for the whole form: submit button, confirmation message, email notifications, limits and scheduling.
5. Click Preview to try the form, then Publish. A draft form is never shown to visitors.

The builder saves your changes as you go; press Ctrl+S to save immediately and Ctrl+Z to undo.

Fields & field settings

Fields are grouped into Basic (text, email, number, dropdown, radio, checkbox, date…), Advanced (file upload, signature, rating, image choices, autocomplete…), Layout (sections, page breaks, HTML) and Payment (product, quantity, total, coupon, payment method).

Each field’s settings are split into tabs:

Date fields

A Date field uses SIForm's calendar: it opens under the field (Picker → Calendar that opens under the field) or is always shown (Calendar always shown). The browser's own date picker is also available. People can pick with the mouse, touch or keyboard (arrows, Page Up / Page Down, Home / End, Enter), or type the date.

• Show dates as — the visitor's language, or a fixed format such as 31/12/2026 or 12/31/2026. Answers are always saved as 2026-12-31; emails show them in your site's date format.
• Week starts on — your site's setting (Settings → General) or a day you choose.
• Earliest / Latest date — no limit, a fixed date, today or a number of days, weeks, months or years from today (for example "18 years before today" for an age check), or relative to another date field ("1 day after Check-in").
• Days that can be picked — untick days of the week, for example weekends.
• Dates that can't be picked — one per line: a date (2026-12-25) or a span (2026-12-24..2026-12-26). Dates that can always be picked override both the weekdays and the blocked dates.
• Pick a date range — the visitor picks a start and an end date (saved as start/end), with an optional shortest and longest length in days. A range can't include a blocked date.
• Most entries a day — like 20 places a day: once a date has that many entries, it is greyed out in the calendar and refused by the server (trashed entries don't count). For single dates, not ranges.
• Default — a date, today or today+1d.

All of these are checked again on your server when the form is sent, using your site's date, so they can't be bypassed.

Data: pre-filling and options

Fill value from

Add one or more sources. They are tried from top to bottom; the first one that has a value fills the field. If none has a value, the Fallback value is used.

Options from (choice fields)

Dropdowns, radio buttons, checkboxes, multi-selects and autocomplete fields can take their options from:

• WordPress posts or pages — any public post type, sorted by title or date; the value is the post ID.
• Categories, tags or terms — any public taxonomy; the value is the term slug.
• WooCommerce products — shown when WooCommerce is active; the value is the product ID.
• JSON API or GraphQL API — enter the address, the path to the list in the response (for example data.items), and which keys hold the label and value.
• JSON list or CSV list — paste the options.

Options are built by your server, cached (10 minutes for WordPress content; your choice for APIs) and sent with the form. Answers are checked on submission: a visitor can only submit one of the listed options. If an API can’t be reached, the options typed under General are shown instead. Click Test source to check a source before publishing.

Logic & calculations

Under a field’s Logic tab, choose Enable conditional logic, pick whether to show or hide the field, and add rules (“Country is Nepal”, “Budget is greater than 1000”…). Page breaks can be skipped with logic too, so visitors only see the steps that apply to them.

Number and total fields can calculate a value with a formula such as {price} * {quantity}. Field keys go in braces; the result updates as the visitor types.

In a formula a date counts as a number of days, so {checkout} - {checkin} gives the nights between two dates, and a date range gives its length in days. Date functions: today(), days(a, b), age({birthday}), weekday(d) (0 = Sunday), year(d), month(d), day(d). Conditions can also compare dates: is a date before, is a date after and is the date, with a date, today or today+7d.

Design

Open the Design tab of the right panel to style the whole form without code: theme colours, layout and spacing, typography (any Google Font, served from your own site — visitors never contact Google), fields, buttons and messages. Sections and steps get their own panels when the form uses them. Custom CSS is last, for anything else.

Adding a form to your site

On SIForm → Forms, open a form’s menu and choose Embed for ready-to-copy codes.

The form always fits the width of its container and grows to its full height automatically.

Entries

SIForm → Entries lists every submission. Search, filter by form, date or status, star entries, add notes, print, and export to CSV or Excel (.xlsx — numbers stay numbers, long answers wrap, the header row stays in view). In both, an answer that begins like a spreadsheet formula (=, +, -, @) is kept as text, so opening the file never runs it. Deleted entries go to Trash first. The unread count appears on the Entries menu item.

• Internal notes — in an entry, write a note for your team (Ctrl + Enter adds it). Notes show who wrote them and when; their author, or a SIForm administrator, can edit or delete them. Visitors never see notes, and they are not printed.
• Print / PDF — prints the entry as a clean document with the form's field labels, its number and dates. On the list, Print prints the selected entries (or the page), each on its own page. Use your browser's "Save as PDF" for a PDF.

Notification emails

Email designer — Settings → Email → Open the email designer sets how every email your forms send looks, with a live preview (desktop or phone) using a real form's field labels:

• Style: start from Modern, Minimal, Classic or Bold, then change anything.
• Logo & header: upload a logo (PNG, JPG, GIF or WebP, up to 2 MB; it goes into your Media Library) or use an image address; size and position; header above the card or as a coloured band; text under the logo.
• Colours: accent (or the form's own), page background, card, border, headings, text, labels and links.
• Text & layout: email-safe fonts, text size, email width, corner rounding, accent bar, entry number and date line.
• Answers: stacked, two columns or boxed; optionally leave out unanswered questions.
• Button: an optional button, for example "View the entry" linking to {entry_url}.
• Footer: your text (company, address), up to six links, and the site address.
• Custom HTML: write the whole email yourself, or start from the visual design. Tags: {logo} {heading} {meta} {message} {all_fields} {button} {footer} {site_name} {site_url} {accent} {year}, plus every field tag. Scripts, frames, forms and event handlers are removed when the email is sent.

Send a test (above the preview) sends the email as it looks now — even unsaved — to you, or to up to three addresses you type, marked “[Test]”, with each answer shown as its field’s label. It never goes to the notification’s Cc or Bcc.

Every HTML email also carries a plain-text copy, made from the same content: email apps that show only text, and spam filters, expect one. A notification set to the Plain design is sent as plain text only — the message and the answers, no HTML at all.

Right-to-left languages: on a site in Arabic, Hebrew, Persian or another right-to-left language, emails are laid out right to left (developers can change this with the siform_email_rtl filter).

Email an entry again: open an entry and choose Email again — pick one of the form’s emails and send it again with the entry’s answers, to its own recipients or to addresses you type (then without its Cc/Bcc). A note is added to the entry saying what was sent to whom.

In the form builder, each notification's Design can use the Site design, a Custom design of its own (opens the same designer), or Plain text.

In the builder, Tools → Form settings → Email notifications: each notification can start from a template (admin notification, confirmation to the person, short auto-reply, hand-off to a team), which fills in the recipients, subject and message from the form's own fields. Everything stays editable: click a chip to insert a field or tag at the cursor; set Reply-To, Cc and Bcc; and under Design choose the layout, the heading and the accent colour for that email. Preview email shows it exactly as it is sent, with each answer shown as [Field label].

Form notifications and workflow emails use a branded layout: your site's icon and name, the form title and entry number, the message, and the answers in a table with the field labels ({all_fields}), then the footer from Settings → Email. Choose Simple under Settings → Email → Email layout to send just the message.

One question at a time

Turn on Tools → Form settings → One question at a time (or pick that layout when you start a form). Each question gets the form to itself; people press Enter or OK to move on (Ctrl + Enter in a long answer), and the arrows go back and forward. Text, headings and images above a question show with it; a section or repeater is one question. Pages, conditional logic (questions it hides are skipped), calculations, file uploads and checks work as usual, and a question with an error stays until it is fixed. The last question's button sends the form.

• Move on after a single choice is picked — radio buttons, ratings, NPS and similar go to the next question by themselves.
• Number the questions — and a progress bar with “3 of 8”.
• Button text — instead of “OK”.
• Start with a welcome screen — a title, a short text and a start button before the first question.

Save & resume, unfinished forms

In the builder, Tools → Form settings → Save & resume:

• Show a "Save and continue later" button — the visitor gets a link (copy it, or have it emailed) that reopens the form with their answers, on the page they were on, on any device. You can change the button text.
• Save automatically while people fill it in — answers are saved as the visitor goes (and when they leave the page), so nothing is lost if the tab closes.
• Follow up forms that are left unfinished — a saved form with no activity for the number of minutes you choose (60 by default) is marked Unfinished. Any notification set to When it's sent: A form is left unfinished is then sent once; it can include {resume_url}, the link back to the form. The Recover an unfinished form template fills one in for you.
• Only save once an email address is filled in — automatic saving waits until there's someone to follow up with (on by default). The button always works.
• Keep saved forms (days) — older saved and unfinished forms are deleted automatically (30 days by default).

Passwords, payment details and CAPTCHA answers are never saved. The link contains a random key; only a hash of it is used to look it up, and the key itself is stored encrypted. When the form is submitted from a link, a normal entry is created and the saved copy is closed (its answers are removed and the link stops working).

SIForm → Entries → Saved & unfinished lists saved and unfinished forms: the form, the person's email, the state, how many questions were answered, where they stopped, and when it was last saved. You can delete any of them. Pick a form to see how many people started it, how many finished, the finish rate, and the questions where people most often stopped. They are not entries, so they don't appear in the entries list, exports or reports; privacy exports and erasure requests include them.

Letting people change their entry

In the builder, Tools → Form settings → Entry editing, turn on Let people change their entry after sending it. The person opens the form again with their answers filled in, changes them and sends it; the same entry is updated (no second entry).

• Who can change an entry — Edit link, or the logged-in sender (default); Only with the edit link; or Only the logged-in sender (the link then works only while they're logged in to your site).
• Allow changes for — the number of hours after sending during which changes are allowed; 0 means any time. The form says until when.
• Show "Edit your answers" after sending — a button on the confirmation. To email the link, put {edit_url} in a notification, for example the confirmation to the person.
• Fields that can be changed — leave all unticked to allow every field, or tick the ones people may change; the others are shown locked and keep their answers whatever is sent.
• Message after changes are saved — shown instead of the form's usual confirmation.

The changed form is checked like a new one (required fields, formats, files, CAPTCHA). Entry limits and the duplicate check don't apply, since nothing new is added. Files can be kept, added or removed; removed files are deleted. Passwords are never sent back to the browser and stay as they were unless a new one is typed. Forms that take payment can't be edited.

Each change is recorded in the entry's Timeline (which answers changed, from what to what), and the entry is marked unread again. To be told about changes, add a notification with When it's sent: An entry is changed. In an entry, Copy edit link copies the person's link so you can send it to them again. The link contains a random key; only a hash of it is used to check it, and the key itself is stored encrypted.

Showing entries on your site

Nothing is shown until you allow it, per form: in the builder, Tools → Form settings → Show entries on your site.

• Who can see entries — No one (default), Logged-in people see their own, or Everyone.
• Answers that can be shown — tick the answers that may appear. Only these are ever shown, searched, filtered or charted. Passwords and payment details are never shown.

The same section lists ready-made shortcodes to copy. Put one in any page or post:

Totals and charts need Everyone. With Logged-in people see their own, lists show only the visitor's own entries and ask others to log in. Searching, sorting and pages use the page's address, so several lists can share a page. Editors see a short note where a shortcode can't show anything and why; visitors see nothing.

Options from another form's entries

A dropdown, radio, checkbox or autocomplete field can take its options from another form's entries: Field → Data → Options from → Entries of another form. Choose the form, the answer each option shows (and the one it saves, if different), and optionally Only entries where an answer matches a fixed value or this form's answer. For example, choosing a Country lists only that country's cities. The other form must share its entries with Everyone and the answers used must be ticked there. Each value appears once, and the submitted choice is checked on the server against the same list.

Accounts, posts, gated content and files

Actions after sending

In the builder, Tools → Form settings → Actions after sending, add what a submission does on your site:

• Create an account — a WordPress user from the answers: email (required), username (or made from the email), first and last name, password (or an email with a link to set one), and profile fields. Only roles without editing or admin powers can be given (for example Subscriber). Choose what happens when the email already has an account (ask them to log in, or accept the entry without an account) and when the visitor is already logged in (do nothing, or update their profile). The new user can be logged in straight away. The password is used once and never kept in the entry.
• Create a post — any public post type, as a draft, pending review or published, with a title, content and excerpt from merge tags ({field_key}, {all_fields}…), categories or tags from an answer, a featured image from an image upload, and custom fields. The content is cleaned like the post editor's. Tick Update the post when the entry is changed to keep it in step with entry editing.
• Start a privacy request — "send me my data" or "delete my data", for the email given. WordPress emails the person a link to confirm it; it then waits for you under Tools → Export Personal Data or Erase Personal Data, like any request made there.

Problems such as an email that already has an account, a taken username or a short password are shown to the visitor before anything is saved. The entry's Timeline shows what was created, with links.

Gated content

Hide part of a page until the visitor has sent a form. Turn on Form settings → Gated content → Use this form to unlock content, then wrap the content:

[siform_gate form="form_x" message="Fill in the form to get the guide."]…the content…[/siform_gate]

Visitors see the message and the form; after sending, the page reloads with the content. It stays open for the number of days you choose (in a signed cookie that points at the real entry: trashing the entry locks it again), and logged-in people who sent the form see it on any device. Pages with a gate ask caching plugins not to cache them.

PDF and CSV files

Each notification can attach the entry as a PDF and/or a CSV file (Email notifications → Attachments), and — on forms with a Table field — each table's rows as a spreadsheet of its own. In an entry, PDF downloads the same document. The files are made on your server; passwords and payment details are left out, and spreadsheet formulas in answers are kept as text. Attachments wait in a private folder until the email has gone and are removed after a week.

Western European text uses the PDF's built-in fonts. For other alphabets (Greek, Cyrillic, Devanagari, Chinese, Japanese, Korean, Thai…), SIForm downloads the matching free Noto font from Google Fonts once to wp-content/uploads/siform-fonts/pdf/ (your server fetches it; visitors never contact Google) and embeds only the letters used. A site can use its own .ttf with the siform_pdf_font filter. Arabic and Indic scripts are shown letter by letter, without joined forms; for those, use Print in the entry and your browser's "Save as PDF".

Appointments and bookings

1. Add a service

SIForm → Bookings → Services → Add a service. A service is what people book, for example "Consultation, 30 minutes":

• Length, and a time every N minutes (empty = one after another).
• People per time — 1 for appointments; more for classes or group sessions.
• Free time before / after — kept clear around each booking (preparation, cleaning).
• Opening hours per day of the week (several ranges a day are fine), in the service's time zone (the site's by default).
• Days that are different — holidays (closed) or days with other hours.
• Booking rules — how far ahead people must book (hours) and may book (days), how long a picked time is held while the form is filled in, a reminder (hours before), and whether people may cancel or change the time themselves, up to how many hours before.

2. Put a Booking field on a form

Add the Booking field (Advanced) and choose the service. Visitors see a calendar where only days with free times can be picked, then that day's times — shown in their own time zone, with a note when it differs from the service's. Picking a time holds it for a few minutes, so two people can never take the same time; when the form is sent the booking is confirmed (checked again on the server). The entry's answer reads like "Consultation · 21 October 2026, 10:00 – 10:30 (Europe/London)".

3. Emails

Merge tags: {booking_service}, {booking_date}, {booking_time}, {booking_when}, {booking_manage_url} (the person's page to change or cancel) and {booking_ics_url} (a calendar file). Under Attachments, a notification can attach the appointment as a .ics calendar file. When it's sent also offers: Before the appointment (reminder) — sent the number of hours before set on the service — A booking is cancelled and A booking is moved to another time. Ready-made templates: Booking confirmation, Booking reminder, Booking cancelled.

4. Changing and cancelling

The manage link opens a page with the booking, Add to calendar, Change the time (only free times are offered) and Cancel booking — when the service allows it and it is early enough. The entry's answer follows a change. In SIForm → Bookings you see the bookings by date, filter by service, status and period, open the entry, or cancel one (its time becomes free again). Deleting an entry cancels its booking. Changing an entry later (entry editing) keeps its booking; the manage link moves it.

Privacy: exports include a person's bookings; erasing removes their name, email and link but keeps the time, which is your calendar.

Quizzes, summaries and choices

Quiz

In Tools → Form settings → Quiz turn on Score this form as a quiz. Then on each question: for radio, checkbox, dropdown and image choices, tick the right option next to it (checkboxes: tick every right one — all of them, and nothing else, must be picked); for text and number fields, write the right answers, one per line (case and extra spaces don't matter). Each question is worth 1 point unless you set Points.

After sending, people see their score — and, if you choose, which answers were right. Set a pass mark (%) for a pass/fail message. Answers are marked on your server: the form visitors get never contains the right answers, and a score sent from the browser is ignored. The score is kept with the entry (shown in its details) and emails can use {quiz_score}, {quiz_total}, {quiz_percent} and {quiz_result} (Passed / Not passed). A changed entry is marked again.

Summary field

The Summary field (Advanced) lists the answers given so far — option labels, dates in the field's format, files by name — so people can check before sending. Each row has a Change button that goes back to that question's page. It shows its own page and the ones before it, or the whole form. Passwords show as dots; fields hidden by logic are left out.

Places per option, and "Other"

On a radio, checkbox or dropdown field, Limit how many can choose each option lets you set places next to each option (empty = no limit) — workshop seats, say. Full options are shown as "(full)" and can't be picked; Show how many places are left adds "3 left". The server counts the entries (those in the trash don't count) and refuses a full option even if the page was opened before it filled up.

Radio and checkbox fields can Add an "Other" option with a text box: typing in the box picks it, and what is typed is the answer.

Submit button rules

Form settings → Submit button rules shows, hides, enables or disables the submit button with the same rules as conditional logic — for example, show it only when "I agree" is ticked. The rules guide people in the browser (pressing Enter doesn't get around them); answers that must be given should be required fields, which the server checks.

Entry limits, confirmation page and spam

Entry limits

Form settings → Limits & scheduling, besides the maximum number of entries and one per logged-in user:

• One submission per email address — checked against the form's entries (any case).
• One submission per browser — remembered with a cookie, so it can be undone by clearing cookies.
• Most per day from one IP address.
• Your own message when a limit is reached.

Show a page after sending

Form settings → Confirmation → Type: Show a page from this site sends people to one of your published pages (a thank-you page with its own design) instead of a message or a typed address.

Disallowed words and Stop Forum Spam

SIForm → Settings → Spam protection:

• Disallowed words — one word or phrase per line; submissions containing any of them are refused (any case, also inside longer words). You can also use WordPress's own list (Settings → Discussion → Disallowed Comment Keys).
• Check Stop Forum Spam — free, no key: the visitor's IP address and email are looked up on stopforumspam.com, and the submission is refused when its confidence is at least the % you set (80 by default refuses well-known spammers only). Answers are kept for a day; if the service can't be reached, the submission is allowed.

Invisible reCAPTCHA (v3)

Under Settings → Spam protection → CAPTCHA, Google reCAPTCHA v3 (invisible) asks nothing of the visitor: Google scores each submission from 0.0 (a bot) to 1.0 (a person), and your server refuses those below Lowest score that counts as a person (0.5 suits most sites). Use reCAPTCHA v3 keys — v2 keys do not work with it. Tokens made for another page or action are refused too. Forms still turn it on with Require a CAPTCHA.

Countries

Form settings → Access rules → Countries: let anyone in, block the countries you list, or accept only them; and choose what happens when the visitor's country can't be told (let them submit, by default, or refuse). The country comes from your host or CDN — Cloudflare, Amazon CloudFront, Google App Engine or a server GeoIP module tell the server where each visitor is; SIForm looks nothing up itself. Developers can supply their own lookup with the siform_visitor_country filter.

Visitor journey

SIForm → Settings → General → Visitor journey (off by default): each entry then lists the pages of your site the person opened in that browser tab before sending, with times, and the site they came from. Only page addresses (without anything after ?) and titles are kept, in the browser until a form is sent. Mention it in your privacy policy.

Confirmations and emails by answer

Other confirmations (Form settings → Confirmation): add confirmations with rules, in order — the first whose rules match is shown, else the form's own. Each can show a message, a page from your site, or go to an address. Messages can use answers, like Thanks {name}!. The server chooses, with the same rules as conditional logic.

Each email notification can be sent only in some cases ("Is sent only when" / "Is not sent when" + rules and groups), and can choose who gets it by the answers: add recipients, each with rules — everyone whose rules match gets it; when none match, it goes to the notification's To address. For example, Sales when the topic is Sales, Support (and a lead) when it's Support or the order is over 100.

Sign-in forms and new accounts

Sign-in form

Add an Email (or Text) field, a Password field and, optionally, a "Remember me" checkbox, then Form settings → Actions after sending → Sign the person in and choose them. WordPress checks the password, so security plugins that limit sign-in attempts still work; a wrong password says only that the details don't match. Afterwards people go back to the page the form is on (signed in), or to an address on your site. A sign-in is never stored as an entry and sends no emails. It can show a "Forgot your password?" link, and people already signed in see "You're signed in as … · Sign out" instead of the form.

New accounts that wait

On Create an account, choose when the account can be used: straight away, after they open a link we email them (it works for 7 days; only a hash of it is stored), or after someone approves it. Until then the account can't sign in anywhere (wp-login.php too) and is told why. Approve or decline in Users → Waiting for approval; the site admin is emailed when someone is waiting, and the person is emailed when approved — with a link to set a password if the form didn't ask for one. Developers can change these emails with the siform_account_email filter.

Polls and personality quizzes

SIForm → Polls and SIForm → Quizzes

Each has its own screen in the SIForm menu, with its own search and a New poll / New quiz button. The list shows every poll (votes, leading answer) or quiz (attempts, average score, pass rate or most common result); open one for its results — every answer as bars, scores by band and how often each question was answered right, or how many got each personality result. A quiz with questions that have no right answer is flagged in the list.

The quiz editor is made for quizzes: a title and introduction, then questions — one answer, several answers, or a typed answer — each with its answers and a tick for the right one(s), points and an optional explanation. Then the pass mark and its texts, showing the right answers, sharing, and asking for the person’s name and email. A personality quiz lists its results instead, and each answer chooses the result it leads to. A quiz can’t be saved while a question has no right answer (or, for personality quizzes, an answer leads nowhere); it says which. Design in form builder opens the same quiz in the builder for its look; anything added there stays.

The poll editor: the question, its answers (one or several choices, and an “Other” answer), when results show (after voting, also through a “See results” link, or never), bars or a pie, vote counts, and one vote per person.

With an AI model connected (Settings → AI assistant), AI Generate writes quiz questions with their right answers marked, or personality results. The built-in engine makes the quiz’s outline; tick the right answers in the quiz editor.

Polls

On a radio, checkbox, dropdown or image-choice question, set Poll results to show how everyone answered after sending (bars with percentages, the person's own answer marked), and optionally a See results link before voting. "Other" answers count as one bar (what was typed isn't shown). For one vote per person, use Form settings → Limits (per browser, per IP address or per user). Password-protected forms never show results publicly.

Personality quizzes

In Form settings → Quiz, choose A result that fits the answers, then add results (title, text — answers can be used in it — and optionally a page of its own). On each question, choose which result each option points to; a question's Weight makes it count more. People get the result their answers point to most (a tie goes to the result listed first). Emails can use {quiz_outcome} and {quiz_outcome_text}; the entry shows the result. Visitors' copy of the form never says which option leads where.

Leaderboard

In the quiz editor (SIForm → Quizzes → Edit, scored quizzes), Show a leaderboard of the best scores, then put [siform_leaderboard form="form_x" limit="10" period="all"] on any page (period: all, month or week). Best scores come first; the same score goes to whoever got there first. Names come from Ask for their name first and are shortened ("Ana K.") unless you choose full names or none. No other answer is ever shown.

More field options

• Password: ask for it twice ("Type your password again"). Passwords are never stored with the entry (nor card details or CAPTCHA answers): an account created from the form still gets the password, but the entry, exports and backups never hold it.
• Address: Choose the state from a list — for the United States, Canada, Australia and India the state or province is a list (it follows the country chosen); other countries keep a text box.
• Email: ask for it twice ("Type your email again"); only these domains and never these domains (one per line; a domain covers its subdomains; checked by the server too).
• Phone: International — a country list with calling codes (names in the visitor's language), a country chosen at first; the answer is kept as +977 9812345678.
• Text and paragraph: minimum and maximum words (Validation), and a live count under the box ("12 / 50 words").
• Repeater: keeps its minimum rows; Rows allowed come from another answer, like "Number of guests".
• Hidden: Filled in by the server — the visitor's country (as your host or CDN reports it), the sender's IP address, browser, date and time sent, the page's address or title, the logged-in user's ID, email or username, or the entry number. Whatever the browser sent for it is replaced.
• Entry numbers (Form settings → Submission): each entry gets a number of its own, like INV-0042 (text before it, start, digits). Given in order and never twice; {entry_number} in emails; shown in the entry.
• Spam (Settings → Spam protection → When a check says spam): keep it in Entries → Trash, marked "Spam" with what caught it, instead of refusing it. The sender sees the usual thanks and nothing else happens (no emails, workflows or integrations).
• Form pages tell page caches (and CDNs) not to keep them, so forms keep working on cached sites.
• Field completion (builder → Analytics): Likert and card choices show their top answers, ratings, NPS, Likert and sliders their average, and each Matrix row the column most people chose.

Reports and scheduled exports

SIForm → Settings → Reports:

• Summary report — every week or month, an email with each form's views, entries and conversion rate, and how entries changed from the period before.
• Scheduled exports — a form's new entries as a spreadsheet (CSV), every day, week or month, to the addresses you choose. Each covers what came in since the last one; when nothing new came in, no email is sent. Answers are in words, passwords and payment details are left out, and cells that look like formulas are kept as text.

They go out at about 7:00 site time — weekly ones on the first day of the week (Settings → General), monthly ones on the 1st. Send a test now sends the email for the period just gone. The settings show when each runs next and ran last.

Payments

1. Enable the Payments module (SIForm → Modules; it is on by default).
2. In the builder, open the form’s Settings → Payments and connect a gateway with its keys. Keys are encrypted when saved and never displayed again.
3. Copy the webhook URL shown there into the gateway’s dashboard. It has the form https://your-site.com/wp-json/siform/v1/payments/webhook/<gateway>.
4. Add product/price fields and a Payment Method field to the form.

Supported: Stripe, PayPal, Square, Authorize.Net, Razorpay, Mollie, Paystack, Flutterwave, Paddle, Lemon Squeezy, GoCardless, 2Checkout, Braintree, Elavon (Converge), bank transfer, pay offline, and a custom gateway.

Elavon (Converge): enter your account ID, a user ID that may use the Hosted Payment Page, and its PIN (stored encrypted). Visitors pay on Converge’s own page and come straight back; your server then asks Converge for an approved sale with that order’s reference and amount before the entry counts — nothing the browser brings back is trusted. Refunds go back to the same card. Converge only accepts requests from IP addresses it knows: ask Elavon to allow your server’s address. US dollars and Canadian dollars.

Paystack and Flutterwave require the payer’s email: add an Email field to forms that use them.

WooCommerce product options

With WooCommerce active, edit a product and choose a published form under Product options (SIForm). Its fields show above the product’s Add to cart button: text, email, phone, number, URL, paragraph, dropdown, radio, checkboxes and date (headings and text for layout; uploads and payment fields are left out). The answers are checked on your server with the form’s own rules; a choice must be one of the form’s options. Priced choices — a dropdown, radio or checkboxes field with Each option adds a price turned on — add their price to the line, taken from the form, never from the browser; the product page shows a running “Options: +…” total as they are chosen. The answers show in the cart and checkout, are kept on the order (and in its emails), and are stored as an entry of the form once the order is placed, with the classic checkout or the block checkout (the form’s own emails are not sent for these). Different answers make separate lines in the cart. On shop and category pages such a product’s button reads Select options and opens the product page, so nothing is added to the cart before its options are chosen.

Workflows

In the builder, click Workflows in the top bar to run steps when a form is submitted, a payment succeeds, an entry is changed (entry editing), a form is left unfinished, an account is created (Actions after sending), or a booking is confirmed, cancelled or moved: send an email or SMS, post to Slack or Discord, call a webhook, wait, or branch. Workflows run on your server in the background, retry when a service is briefly down, and keep a run history. Test run replays a saved workflow on the form’s latest entry.

Integrations

Connect email marketing (Mailchimp, Brevo, Kit, EmailOctopus, CleverReach, iContact, Sendy, Emma…), CRMs (HubSpot, Pipedrive, Salesforce, Zoho, Insightly, OnePage CRM, Pipeline CRM, amoCRM/Kommo, Salesflare…), spreadsheets and databases (Google Sheets, Airtable, Notion), business apps (Help Scout, FreshBooks, Recurly, Zoho Creator, Formstack Documents), chat and alerts (Slack, Microsoft Teams, Telegram, Pushover, ClickSend SMS…), calendars, cloud storage and automation apps (Zapier, Make, n8n, Pabbly). For apps that use OAuth, click Connect and sign in; otherwise paste an API key. Then map form fields to the app’s fields. Each app’s guide in the connection dialog links to where its keys are found.

Only the integrations you need: SIForm → Modules lists every integration when you pick Integrations in its Modules | Integrations switch (shown while the Integrations module is on), each with its own switch and the same All | On | Off filter, plus All on / All off for everything or one category. A switched-off integration is not offered in the form builder, and a form already connected to it sends nothing (its connection shows switched off, and a delivery already queued finishes as skipped) until you switch it on again. Everything starts on. The Integrations module on the Features tab still turns the whole feature off.

Google Sheets: connect with Google, then give the spreadsheet ID and the tab. Each entry is added as a new row. The first row names the columns by field name (entry_id, submitted_at, form and each field); any field not there yet gets a new column at the end, so you can reorder the columns or add your own in the sheet. Values are written exactly as typed — an answer that looks like a formula stays text. Airtable adds a record to the table (name the Airtable fields like the form’s fields, or map them); Notion adds a page to the database, titled after the person and the form, with every answer inside.

SMTP & email delivery

Most web servers send email in a way that inboxes distrust, so notifications land in spam or never arrive. SIForm → SMTP sends email through a real mail server or service instead.

Set it up

1. Open SIForm → SMTP → Overview and click Setup wizard.
2. Choose a mailer: an SMTP server (presets for Gmail, Outlook, Zoho, Yahoo, iCloud, Amazon SES, Brevo, Mailgun), Gmail / Google Workspace, Microsoft 365 / Outlook or Zoho Mail (connected with your own OAuth app — the wizard shows the redirect address to paste), or a service's API: SendGrid, Mailgun, Brevo, Postmark, SparkPost, Resend, SMTP2GO, Mailjet, Elastic Email, MailerSend, Mandrill, SMTP.com, SendLayer, Amazon SES.
3. Enter its details, set the sender (From email and name, optionally forced for every email), and use Check connection — it tests the details without sending anything and explains what to fix.
4. Send a test email. The result shows the conversation with the server and a DNS check of your sending domain (SPF, DKIM, DMARC) with plain-language fixes.
5. Turn it on. Choose whether it sends SIForm's email only or all email from this site. SIForm SMTP works on its own: it needs no other plugin, and it sends the email it is set to send whichever other plugins are installed.

Connections, backup and smart routing

Add more connections on SMTP → Mailer. Pick one as the backup: when the main connection fails, the email is sent again through it. SMTP → Smart routing sends particular emails through a particular connection — for example "subject contains Invoice" → Postmark. Rules are checked top to bottom; conditions in a group must all match, and any group can match.

Email log, reports and alerts

• SMTP → Email log lists every email with its status and any error: filter, search, view, resend, delete, or export to CSV, Excel or .eml. Keeping email content, saving attachments and open/click tracking are optional (SMTP → Preferences); content is not kept unless you turn it on.
• SMTP → Reports shows sent, failed, open and click figures per day, per subject and per connection. A weekly summary email and a WordPress dashboard widget are on by default and can be turned off.
• SMTP → Alerts tells you when an email fails — by email (up to three addresses), Slack, Discord, Microsoft Teams, a custom webhook, Twilio SMS or WhatsApp. At most one alert per channel every 10 minutes.

Preferences, notifications and tools

• Do Not Send stops all email except tests — useful on a staging copy. Optimize sending queues email and sends it in the background so pages respond faster; rate limits cap email per minute, hour, day, week and month (extra email waits in the queue).
• SMTP → Notifications (manage notifications) turns off particular WordPress emails (comment notices, password and email changes, update reports, new-user and new-site emails, personal-data emails).
• SMTP → Tools: debug events, the sending queue, settings export/import, and Reset (every SMTP setting back to its default; the email log is kept).
• Developers: settings can be locked in wp-config.php with SIFORM_SMTP_* constants (for example SIFORM_SMTP_MAILER, SIFORM_SMTP_HOST, SIFORM_SMTP_PASS, SIFORM_SMTP_KEY); WP-CLI: wp siform mail test <email>, wp siform mail status, wp siform mail log.

Multisite networks

SIForm works on WordPress multisite, activated on one site or for the whole network.

• Network activation sets SIForm up on every site at once, and every site added later is set up as it is created. Deleting a site removes its SIForm data with it.
• Each site is separate. Forms, entries, files, payments, settings and the email log belong to the site they were made on, and that site's administrators manage them. A site's administrators have no SIForm access on other sites.
• Email for the whole network. A network administrator can set SMTP once in Network Admin → SIForm SMTP (mailer, connections, smart routing, alerts, notifications, sender and preferences) and turn on Use these settings for every site in the network. While it is on, every site sends with those settings, and each site's own SMTP settings show read-only with a note. Each site still has its own email log, reports, queue and test email. Turn it off and every site goes back to the settings it had saved for itself.
• Licence and updates are the network's: plugin updates are network-wide, so the purchase code is entered once, by a network administrator (on the main site, SIForm → Modules → License & updates). Site administrators see that it is managed for them.

Maps & address search

The Map field shows a map with a pin. People search for an address or place (suggestions appear as they type), click or drag the pin, or press Use my location (the browser asks their permission first). The answer is the address and the point — Kathmandu (27.70833, 85.32058) — and emails link it to OpenStreetMap. In the field's settings: where the map starts (type a city or address; SIForm looks it up once and keeps it), zoom, height, the location button, and whether placing the pin fills in its address. The map can be moved by dragging or the arrow keys, and zoomed with + and −.

The Address field can Suggest addresses as people type: choosing a suggestion fills in the street, city, state, postcode and country. Suggestions follow the country already chosen, when there is one.

SIForm → Settings → Maps & addresses:

• Search with — OpenStreetMap (Photon by Komoot, free, no key), Google Places (your own API key, with "Places API (New)" and "Geocoding API" turned on; stored encrypted and used only by your server), or off (people place the pin by hand). Test search checks it.
• Map pictures — the tile server the map is drawn from: OpenStreetMap's, unless you enter your own provider's https://…/{z}/{x}/{y}.png address and its credit. OpenStreetMap's own server is meant for light use; busy sites should use a tile provider.

Searches go through your server, which keeps each answer for a week and limits how often one visitor may search; only published forms with a map or address search can use it.

Conversion tracking & offline forms

Conversion tracking

Form settings → Conversion tracking (on by default): when the form is sent, SIForm tells the page it sits on, which passes it to the tags you already have there — nothing is added to your site, and nothing is sent anywhere by SIForm:

• Google Tag Manager: dataLayer.push({ event: 'siform_submission', siform_form_id, siform_form_title }) — make a Custom Event trigger on siform_submission.
• Google Analytics 4: gtag('event', 'generate_lead', { form_id, form_name }).
• Meta Pixel: fbq('track', 'Lead', { content_name }).
• Your own code: window.addEventListener('siform:submitted', e => e.detail.formId).

Each event name can be changed per form. Only the form's id and title are passed on, never the answers. It works for forms on your pages and for the HTML embed on other websites.

Offline forms

Form settings → Submission → Keep the answers if the connection drops: if Submit can't reach your site (no network — not a refusal), the visitor is told the answers are kept on their device, and they are sent as soon as the connection is back: straight away if the page is still open, or the next time they open the form. Each is stored once however often it is resent. Kept answers are let go after two weeks. Not used on paid forms or with a CAPTCHA, which need the connection.

Spam protection & uploads

SIForm → Settings → Spam protection: every form is protected by a signed time check and a per-visitor limit on submissions per minute, and by a hidden honeypot field (on by default; per form under the builder’s Settings → Security & spam). You can add Google reCAPTCHA, hCaptcha, Cloudflare Turnstile, Akismet or CleanTalk.

SIForm → Settings → Uploads: allowed file types and sizes, where files are stored (your site, Amazon S3, Cloudflare R2, Google Drive, Dropbox, OneDrive, or Vimeo for videos), and optional virus scanning. Files are checked by their real type, not by their name.

Vimeo: videos go to your Vimeo account, sent in pieces (an interrupted transfer carries on where it stopped), and the entry links to the video there; other files sent with them stay on your site. Use a personal access token from developer.vimeo.com/apps with the Upload scope (and Edit, to file them in a folder), and choose who can watch them — private to you by default. Raise Max upload size for long videos.

Multilingual sites

With WPML (with String Translation) or Polylang, every label, option, message and email of a form is registered for translation when you save the form. Translate them in WPML or Polylang; visitors see the form in the language of the page it is on. The builder’s Settings → Translation section shows the active plugin, your languages, and a link to the form’s strings. Right-to-left languages are supported.

AI assistant & MCP

The assistant drafts forms, emails, workflows and calculations from a description. It runs on your site with a built-in engine; for richer results, add an API key for OpenAI, Anthropic, Google Gemini, Mistral, Groq, DeepSeek, xAI, Together, OpenRouter or a local Ollama server under SIForm → Settings → AI assistant.

AI Generate in the builder

AI Generate (bottom of the field list, or the command palette) opens the AI assistant with two tabs. The badge at the top says what will answer: your AI model, or the built-in engine.

• Create a form — describe the form (or pick an example) and choose Generate. You see each step as it happens: reading the description, asking your model (with the seconds taken), building the form. Then a preview — title, what it contains and its fields — and you choose Replace current form or Add as new pages.
• Improve this form — your model reviews the form and suggests clearer labels, useful placeholders and help text, which fields should be required, and up to three missing fields. Suggestions are grouped by field with the reason; untick any you don’t want, then Apply. Without a model, the built-in engine tidies labels and placeholders.

Your AI model is always tried first. If none is set, or it fails (an expired API key, no credit, a timeout), the built-in engine answers instead and a warning says why, so you can fix it under Settings → AI assistant. Cancel stops a request at any time. Nothing changes until you apply a result, and one Ctrl+Z undoes it.

The MCP server (SIForm → Modules → MCP) lets AI agents such as Claude create forms, read entries and get embed codes, using a WordPress application password and only the permissions you grant.

Offer them as WordPress abilities (on the same screen, WordPress 6.9 or later) registers the same tools with WordPress's Abilities API — siform/list-forms, siform/create-form… in the "SIForm" category — for AI features and agents that use WordPress's own registry. They follow the same read-only mode, tool switches, permissions, rate limit and activity log.

Settings, roles & modules

• Settings → General — branding (white label): the name SIForm goes by on your site (WordPress menu, page titles, these screens, the editor block, the Elementor widget, and optionally the Plugins screen), a menu icon and a logo; then default status for new forms, date format, and what happens to data when the plugin is deleted.
• Settings → Email — sender name and address for notifications.
• Settings → Security & Roles — which WordPress roles can view forms, edit forms, read entries, manage payments and change settings.
• Settings → Import / Export — export forms (with or without their entries) to one file, import that file on any site, or import entries from a CSV file. See Export & import.
• Settings → Audit Log and System Info — who changed what, and your server details for support.
• SIForm → Modules — turn whole features (payments, workflows, integrations, analytics, PDF…) on or off, and each integration (its Modules | Integrations switch picks the list — Integrations is there while that module is on — and All | On | Off filters it).

Export & import

Export

On SIForm → Settings → Import / Export choose Export forms…, pick all forms or some, and whether to include their entries (answers, read/unread, stars, notes and dates — and, if you like, entries in the trash). You can also export one form from its menu on the Forms page, or several by selecting them and choosing Export. Exports of any size are written by the server in one go.

Payment and integration keys are never included — enter them again after importing on another site. Uploaded files are not included.

Import

Choose Import from a file… (or Import on the Forms page) and drop a SIForm export. Before anything is added you see each form, its number of fields and entries, and whether it is already on this site. For forms that are already here, choose Import as a copy, Replace (the form is updated; its existing entries stay) or Skip. New forms keep their status; copies start as drafts. Older SIForm exports and single-form files work too.

Import entries from a CSV file

Choose Import a CSV file… (or Import CSV on the Entries page), pick the form and drop the file. The first row must name the columns. Each column is matched to a field where the names agree; change any of them, map a date column to Date submitted, or leave a column out. Comma-, semicolon- and tab-separated files work, including quoted values with commas and line breaks.

Privacy & data removal

• Entries are stored in your own WordPress database. Gateway keys and integration tokens are encrypted.
• Tools → Export Personal Data and Tools → Erase Personal Data include SIForm: a person’s entries (found by their email) are exported or deleted along with their uploaded files. Payment records are kept for accounting with the name and email removed.
• Settings → Privacy → Policy Guide contains suggested text about forms for your privacy policy.
• Deleting the plugin keeps your data unless SIForm → Settings → General → Delete data on uninstall is set to Remove everything.

Outside services are contacted only when you set them up; the full list is in readme.txt under “External services”.

Translating SIForm

SIForm is translation-ready (text domain siform). The template is siform/languages/siform.pot.

1. Open the .pot file in Poedit (or use the Loco Translate plugin) and create a translation for your language.
2. Save it as siform-<locale>.po and .mo, for example siform-de_DE.mo.
3. Put both files in wp-content/languages/plugins/ so updates don’t overwrite them.

The same file translates both the PHP and the builder’s interface.

For developers

WP-CLI

wp siform form list [--status=published] [--search=quote] [--format=table|csv|json|yaml|ids]
wp siform form get <id> [--format=json]
wp siform form export [<id>...] [--entries] [--trashed] [--file=forms.json]
wp siform form import forms.json [--existing=copy|replace|skip] [--no-entries] [--dry-run]
wp siform form delete <id>... [--force] [--yes]
wp siform entry list <form> [--status=unread] [--search=text] [--per-page=20] [--page=1] [--format=count]
wp siform entry export <form> [--from=2026-01-01] [--to=2026-12-31] [--file=entries.csv]
wp siform mail test|status|log

Exports are the same files Settings → Import / Export reads. Commands run as the first administrator unless you pass --user.

PHP

// Render a form anywhere in a theme.
echo siform_render( 'form_xxxxxxxxxxxx' );

// Last check before an entry is saved — return a WP_Error to refuse it.
add_filter( 'siform_validate_submission', function ( $valid, $values, $form ) {
	return $valid;
}, 10, 3 );

// The form document sent to visitors.
add_filter( 'siform_public_schema', function ( $schema, $form ) {
	return $schema;
}, 10, 2 );

// Serve a form that is not stored in the database (a demo, say): return the
// form array — uuid, title, status 'published', schema… — or null to load as usual.
// $context is 'public' for what visitors see, 'admin' for the builder and other admin screens.
add_filter( 'siform_pre_get_form', function ( $pre, $uuid, $with_schema, $context ) {
	return $pre;
}, 10, 4 );

// An entry was changed from the front end (entry editing).
add_action( 'siform_entry_edited', function ( $entry_id, $form, $values, $old, $changed ) {}, 10, 5 );

// A form created an account, or created / updated a post (Actions after sending).
add_action( 'siform_user_registered', function ( $user_id, $form, $values, $entry_id ) {}, 10, 4 );
add_action( 'siform_post_saved', function ( $post_id, $form, $values, $entry_id, $updated ) {}, 10, 5 );

// Use your own font in entry PDFs (return a .ttf path).
add_filter( 'siform_pdf_font', function ( $path, $family, $bold ) {
	return $path;
}, 10, 3 );

// The date date fields treat as today (Y-m-d).
add_filter( 'siform_dates_today', function ( $today ) {
	return $today;
} );

// Appointments: a booking was confirmed, cancelled ('person' or 'staff') or moved.
add_action( 'siform_booking_confirmed', function ( $booking_id, $entry_id, $form ) {}, 10, 3 );
add_action( 'siform_booking_cancelled', function ( $booking_id, $entry_id, $by ) {}, 10, 3 );
add_action( 'siform_booking_rescheduled', function ( $booking_id, $entry_id ) {}, 10, 2 );

// What is kept with an entry besides its answers (a quiz score, say).
add_filter( 'siform_submission_meta', function ( $meta, $form, $values ) {
	return $meta;
}, 10, 3 );

// The account emails: activation link, approval request, approved.
add_filter( 'siform_account_email', function ( $mail, $kind, $user_id ) {
	return $mail; // { to, subject, message }
}, 10, 3 );

// A waiting account became usable ('link' or 'admin').
add_action( 'siform_account_activated', function ( $user_id, $by ) {}, 10, 2 );

// Is this submission stored and emailed? (False for a sign-in.)
add_filter( 'siform_store_submission', function ( $store, $form, $values ) {
	return $store;
}, 10, 3 );

// Teach the server an operator added in the browser (registerOperator).
add_filter( 'siform_rule_operator', function ( $result, $rule, $value ) {
	return $result; // null = unknown
}, 10, 3 );

// What the visitor's browser gets back after sending.
add_filter( 'siform_submission_response', function ( $response, $form, $values, $entry_id ) {
	return $response;
}, 10, 4 );

// A started form went quiet (save & resume, abandonment).
add_action( 'siform_partial_abandoned', function ( $partial_id, $form, $values ) {}, 10, 3 );

// More merge tags for emails, filled before field tags.
add_filter( 'siform_merge_tags', function ( $text, $form, $values, $entry_id, $escape ) {
	return $text;
}, 10, 5 );

// Files to attach to a notification (name => path).
add_filter( 'siform_notification_files', function ( $files, $form, $values, $entry_id, $ntf ) {
	return $files;
}, 10, 5 );

REST API

All endpoints live under /wp-json/siform/v1/ and use WordPress authentication (cookies with a nonce, or application passwords). Every route checks the SIForm capability for its action.

Troubleshooting & FAQ

Everything in WordPress is slow (each page takes 2 seconds or more)

On Windows and some local servers, a database host of localhost makes every request wait about 2 seconds while the connection tries IPv6 first. In wp-config.php, change define( 'DB_HOST', 'localhost' ); to define( 'DB_HOST', '127.0.0.1' );. Also make sure PHP's OPcache is enabled. SIForm itself loads forms in one request and serves fonts as plain files, so it benefits directly.

The builder is blank or keeps loading

Clear any page cache for /?siform-app=1 and exclude it from caching and JavaScript “optimisation” plugins (combine/minify/defer). SIForm loads its own modules and must not be combined.

Payments stay “pending”

The gateway hasn’t reached your webhook URL. Check the URL in the gateway dashboard, that your site uses HTTPS, and that no firewall blocks /wp-json/. Open the order in Entries to see its payment log.

Emails are not arriving

WordPress sends email through your server, which many hosts block or mark as spam. Set up SIForm → SMTP with a mail service, use a sender address on your own domain, and run the domain check on SMTP → Test email.

Stored keys stopped working after moving the site

Keys are encrypted with the salts in wp-config.php. If the new site has different salts, enter the keys again.

The form is cut off on another website

Use the snippet from Embed → Other website, which includes the resize script, rather than a bare <iframe>.

Support & credits

For help, use the Support tab on the item’s CodeCanyon page. Please include the details from SIForm → Settings → System Info. Support covers questions about SIForm’s features and fixing bugs; it does not include custom development.

Credits

SIForm’s code is original and licensed under the GNU General Public License v2 or later (see licensing/). It bundles no third-party libraries. Google Fonts are licensed by their designers under the SIL Open Font License or Apache License 2.0 and are downloaded only when a form uses them.

Changelog

1.0.0 — First release.