A contact form can seem to work perfectly for months while no message ever arrives. The visitor clicks “Send”, the confirmation message appears, and the email gets lost somewhere between your server and the inbox.
The WordPress documentation says it in black and white: when its sending function returns “true”, it does not mean the recipient received the message. It only means the message was handed to the sending layer.
A form is also an open door into your database, available to anyone without an account. In 2025, all it took was an administrator deleting a spam entry in a very widespread plugin to risk losing the site’s configuration file. We tell that story below.
This comparison therefore judges the ten form plugins that matter in 2026 on what really makes the difference: notification deliverability, spam protection, handling of personal data, conditional logic, payments and accessibility.
How we ranked them
The first criterion is what happens after submission: are entries stored in your database, for how long, and does the plugin help you send notifications that actually arrive. The second is spam protection and its privacy cost, since many solutions send visitor data to a third party.
Then come conditional logic (showing a field based on an answer), free with some and paid with others, and payments, often presented as free while they take a commission. The last criterion is accessibility: a statement published by the vendor, an independent test, default settings.
Install counts and prices were read in October 2026 on WordPress.org and on official pricing pages. Many vendors show a discounted first-year price: we give the renewal price when it is published.
1. WPForms: the most guided, with no storage in the free version
What it does
WPForms, from Awesome Motive, is one of the most installed form builders, with more than 5 million sites for its Lite version. Its drag-and-drop editor and template library let you build a form in minutes.
Strengths
Its onboarding, guided by a template library, is one of the simplest in this comparison. Modern honeypot-based spam protection is on by default, and reCAPTCHA, hCaptcha, Turnstile or Akismet are available from the free version. Dedicated GDPR settings let you turn off cookies and IP address storage.
Limits
The free version does not store entries: you only receive the notification email. An optional feature, Lite Connect, backs up a copy on WPForms’ servers for one year. Conditional logic, file uploads and multi-step forms are paid, and payments in the free, Basic or Plus versions carry a 3% fee.
On accessibility, WPForms publishes no statement, and its terms of service explicitly disclaim any guarantee of WCAG compliance. In 2024, the vendor declined to take part in the test run by Equalize Digital, a session sponsored by Ninja Forms, one of the plugins tested.
Price and audience
The Basic plan costs $49.50 for the first year, then $99. WPForms suits beginners and small businesses that want guidance and accept a subscription to keep entries.
2. Gravity Forms: the professional benchmark, accessible by default
What it does
Gravity Forms, from Rocketgenius, is a paid-only plugin, absent from the official directory. It is the tool for complex forms: workflows, calculations, registrations, integrations with dozens of services.
Strengths
Conditional logic is part of the core, from the cheapest license. Personal data settings let you skip IP storage, delete entries automatically after a set number of days and hook into WordPress’s export and erasure tools.
Gravity Forms is also the vendor most committed to accessibility. Its version 3.0, released on July 28, 2026, turns accessible settings on by default for every new form. In Equalize Digital’s 2024 test, it was the best by default.
Limits
No free version, and payment add-ons require the Pro license. Major versions do not update automatically. In July 2025, manual downloads and Composer installs of two versions were tampered with by malicious code for a day or two; updates from the dashboard were not affected, and the vendor reset all its customers’ passwords.
Price and audience
The Basic license costs $59 per year for one site. Gravity Forms suits agencies, complex business processes and sites with accessibility obligations.
3. Fluent Forms: conditional logic and payments for free
What it does
Fluent Forms, from WPManageNinja, with more than 700,000 installs, offers for free what others charge for: conditional logic, entry storage and export, a GDPR consent field and many anti-spam protections.
Strengths
Since version 6.0, the free version accepts Stripe payments, with a 1.9% fee that the Pro version removes. Spam protection combines a honeypot, a token, Akismet, CleanTalk, reCAPTCHA, hCaptcha and Turnstile. Every feature is included in each paid plan, with no complicated tiers.
Limits
Multi-step forms, calculations, automatic entry deletion and conditional email routing are Pro features. The vendor’s accessibility guide is a how-to rather than a conformance statement; the autocomplete attribute on personal fields, which used to require code, can be set in the editor since version 6.2.15 (September 2026).
Price and audience
The single-site license lists at $79 per year, with lifetime options. Fluent Forms suits tight budgets that want conditional logic and payments without paying.
4. Formidable Forms: when the form becomes an application
What it does
Formidable Forms, from Strategy11, with more than 300,000 installs, goes beyond forms: calculators, directories, front-end display of submitted data through its “Views”. The free version stores entries in your database.
Strengths
For a site that collects data and has to display it back (quotes, simulators, directories), it is one of the most complete options. Anti-spam protections are complete, and settings let you skip IP tracking or not store submissions at all.
Limits
Conditional logic requires a paid license. Stripe payments carry a 3% fee in the free, Basic or Plus versions, up to the Business plan. The vendor claims every form is WCAG-compliant by default, but Equalize Digital’s 2024 test found a structure that made screen readers repeat a group label on every field.
Price and audience
The Basic plan costs $39.50 for the first year, then $79. Formidable suits sites that turn their forms into business tools.
5. Ninja Forms: unlimited entries and privacy tools
What it does
Ninja Forms, with more than 600,000 installs, stores every submission in your database for free and without limit. Its model rests on a free core and paid add-ons, sold individually or in bundles.
Strengths
Its privacy tools are among the most complete: integration with WordPress’s export and erasure tools, front-end actions for visitors to request export or deletion of their data, and a per-field option not to keep personal data. The honeypot is active on every form, and the vendor publishes an accessibility statement based on external audits.
Limits
Conditional logic, multi-step forms, file uploads and payments are paid add-ons. The latest version requires WordPress 6.9, which rules out older sites.
Price and audience
The Plus plan costs $59.40 for the first year, then $99, for three sites. Ninja Forms suits sites that want unlimited entries and free GDPR tools, buying only the add-ons they need.
6. Forminator: the most complete free version
What it does
Forminator, from WPMU DEV, with more than 600,000 installs, offers conditional logic, Stripe and PayPal payments, entry storage, quizzes and polls for free. We found no mention of a payment fee, either on its listing or in its documentation.
Strengths
Its per-form privacy settings are precise: automatic deletion of submissions beyond a certain age, handling of account erasure requests, and what happens to uploaded files when an entry is deleted. All the common anti-spam protections are there.
Limits
Its security record is the heaviest in this comparison: besides the 2025 flaw described below, three critical unauthenticated flaws were fixed between August and September 2026 (arbitrary file upload, PHP object injection, shortcode execution), with about fifteen security releases in a month. Advanced features (Stripe subscriptions, PDF generation, e-signature) go through the Pro version.
Price and audience
Pro starts at $50 per year for one site. Forminator suits demanding users who want maximum features without paying, as long as they update it quickly.
The Forminator case: when deleting spam could delete the site
This affair, documented by Wordfence and by the US National Vulnerability Database (NVD), shows better than any other why a form is a security component in its own right.
The discovery
On June 20, 2025, a researcher reported a flaw in Forminator through Wordfence’s bug bounty program. The report was validated the next day, the vendor was contacted on June 23, and Wordfence protected its paying customers from June 26 with a firewall rule.
The mechanism
Forminator stored field values without sanitizing them. An attacker could therefore send, in a simple “Name” field, a value disguised as an attached file pointing to any file on the server. Nothing happened on submission.
The trap went off later, when the entry was deleted. The plugin then erased every file listed, without checking the field type, the extension or the folder. The deletion could come from an administrator cleaning up spam, or from the automatic deletion of old entries, a feature designed precisely to respect data retention periods.
The ideal target was wp-config.php. Without it, WordPress goes back to installation mode, and the attacker can connect the site to a database they control: a complete takeover. Wordfence pointed out that deleting a submission that looks like spam is a very likely situation.
The fix
WPMU DEV released the fixed version 1.44.3 on June 30, 2025, ten days after the report. From then on, only file upload or signature fields can trigger a deletion, and only for files located in the uploads folder. The public advisory came out on July 1. The Pro version was not affected, and Wordfence reported no active exploitation.
What to take away
Routine hygiene, cleaning up spam and automatically deleting old entries, was the trigger here. The lesson goes beyond Forminator: a form is an anonymous write channel into your database. Update your form plugin automatically, store only what is useful, and apply the other WordPress security measures, firewall and backups first.
7. Contact Form 7: lightweight, hand-coded, no storage
What it does
Contact Form 7, by Takayuki Miyoshi, is the most installed form plugin for WordPress, in the 10+ million sites band. It is entirely free and is configured by writing the form tags yourself.
Strengths
It is lightweight, respects the theme’s styles and does nothing beyond what is asked: by default it does not track visitors, stores no data and sets no cookies. It offers a Stripe module with no extra fee, and its author recommends Cloudflare Turnstile against spam. Equalize Digital’s test credited it with the best date picker.
Limits
It stores no messages: you need to add Flamingo, from the same author. It has no conditional logic and no visual editor. And version 6.2, announced for October 2026, requires PHP 8.3 and WordPress 7.1: older sites will stay on the 6.1 branch.
Price and audience
Free. Contact Form 7 suits developers who want full control of the code and a no-frills contact form.
8. SureForms: forms as native blocks
What it does
SureForms, from Brainstorm Force, arrived in the directory in April 2024 and already has more than 500,000 installs. Its forms are native WordPress editor blocks, which fits naturally with block themes.
Strengths and limits
Entries stay on your site, and the vendor states it stores no submissions on its servers. On the other hand, conditional logic is paid, and free Stripe payments carry a 2.9% fee, removed by any paid license. The product is young, and the vendor says it tests every release for accessibility without targeting a specific WCAG level.
Price and audience
The cheapest license, Team, costs $99 for the first year, then $149, for five sites. SureForms suits block-theme sites and users of Spectra, the same vendor’s block builder, which we cover in our comparison of WordPress page builders.
9. Jetpack Forms: Jetpack’s simple block
What it does
Jetpack Forms does not exist as a separate plugin: it is a free module of Jetpack, installed on more than 3 million sites. It adds a form block, templates (including multi-step), an AI assistant and a responses page in the admin, with CSV or Google Sheets export.
Strengths and limits
It is the simplest option for a site already on Jetpack. But it requires a WordPress.com connection, spam protection relies on Akismet, which receives the form data and is only free for personal sites, and file uploads require the Jetpack Complete plan. Conditional logic was merged into the code in late September 2026 and was not yet in the stable release at the time of writing.
Price and audience
Free with Jetpack. It suits sites already using Jetpack that want a simple contact form.
10. WS Form: the accessibility pick
What it does
WS Form, from Westguard Solutions, is a developer-oriented builder, with a free Lite version and a very complete Pro version. Its user base is modest (10,000+ installs), but its rating in the directory is among the best.
Strengths and limits
With Gravity Forms, it was one of only two plugins in Equalize Digital’s 2024 test whose vendor published accessibility information, and it explicitly aims for WCAG compliance. It blocks duplicate submissions and offers all the common anti-spam protections. Conditional logic is included from the Personal license; payments require the Freelance plan (PayPal) or the Agency plan (Stripe), or an add-on bought separately.
Price and audience
The Personal license costs $59 per year for one site, conditional logic included. WS Form suits sites with accessibility obligations and a developer on hand.
Why form emails disappear
The best form plugin is useless if its notifications end up in spam. The cause almost always lies in the sending itself.
wp_mail and PHP’s mail function
By default, WordPress hands its emails to PHP’s mail() function, from the address wordpress@yourdomain. PHP’s own documentation warns that a message accepted for delivery is not a message delivered. And WordPress’s code acknowledges that some hosts block this address if it does not exist.
Gmail, Yahoo and Outlook tightened their rules
Since February 1, 2024, Gmail has required every sender to use SPF or DKIM authentication, valid reverse DNS, an encrypted connection and a spam complaint rate below 0.3%. Bulk senders, above 5,000 messages a day, must also publish a DMARC policy. Google stepped up enforcement from November 2025, and Yahoo has applied very similar requirements since February 2024.
Microsoft followed for Outlook.com from May 5, 2025, for domains sending more than 5,000 messages a day, ultimately choosing to reject non-compliant messages rather than file them as junk.
SPF, DKIM, DMARC and Reply-To
The most common mistake is putting the visitor’s address in the “From” field. If that visitor writes from a Yahoo address, whose domain publishes a DMARC reject policy, your server sends a message impersonating Yahoo that will be refused. Contact Form 7’s best practices say it plainly: use an address from your own domain as the sender, and put the visitor’s address in “Reply-To”.
SMTP plugins
A plugin such as WP Mail SMTP, FluentSMTP or Post SMTP sends emails through an authenticated delivery service (Amazon SES, Mailgun, Postmark, a Google Workspace account…). Note that it does not create DNS records: SPF, DKIM and DMARC must be published for the sending domain, with your DNS provider. Your WordPress host also plays a part, through the reputation of its IP addresses.
Test the sending
Do not trust the confirmation message. Submit your form with a Gmail address and an Outlook address, check that the notification arrives in the inbox rather than in spam, then open the message headers: authentication results should show SPF and DKIM as passed for your domain. FluentSMTP and Post SMTP keep a sending log and can alert you when a delivery fails for free (in WP Mail SMTP these are paid features), which beats discovering the problem weeks later through a lost customer.
How to choose
By need
- The most complete without paying: Fluent Forms, or Forminator if you apply its security updates the same day.
- Accessibility obligations: Gravity Forms, or WS Form with a developer.
- Payments: check the fee. Contact Form 7, the higher plans of WPForms and Formidable, and any paid license of SureForms or Fluent Forms take none.
- Full control of the code: Contact Form 7, plus Flamingo.
- A block-theme site: SureForms or Jetpack Forms.
- Data to display back: Formidable Forms.
The personal data question
In France, the data protection authority (CNIL) asks sites to inform visitors at the foot of the form: purpose, legal basis, recipients, retention period, and to flag required fields. Choose a plugin that automatically deletes entries after the stated period, after testing on a copy what that deletion actually removes. Our guide to GDPR and consent on WordPress covers the rest.
A checklist before going live
Whatever plugin you choose, run through these points before opening a form to the public:
- The sender address belongs to your domain, and the visitor’s address is in Reply-To.
- SPF and DKIM are published for that domain, and a test message passes both.
- Every field has a visible label, required fields are flagged, and errors are announced in text, not only in color.
- At least one non-interactive spam protection (honeypot, time check) is on before adding a challenge.
- The privacy notice under the form states purpose, recipients and retention period.
- Entries are deleted automatically after that period, and the deletion was tested on a copy.
- The plugin updates automatically, and you know where its submissions are backed up.
Summary table
| Plugin | Entries in free | Conditional logic | Payment fee in free | Entry price (Oct. 2026) |
|---|---|---|---|---|
| WPForms | No | Paid | 3% | $49.50 first year |
| Gravity Forms | Not applicable (paid) | Included | Not applicable | $59 per year |
| Fluent Forms | Yes | Free | 1.9% | $63 first year |
| Formidable Forms | Yes | Paid | 3% | $39.50 first year |
| Ninja Forms | Yes, unlimited | Paid add-on | Payments as add-ons | $59.40 first year |
| Forminator | Yes | Free | None mentioned | Free, $50 per year |
| Contact Form 7 | With Flamingo | No | None | Free |
| SureForms | Yes | Paid | 2.9% | $99 first year (5 sites) |
| Jetpack Forms | Yes | Announced | No payments in the block | Free |
| WS Form | Yes | Pro version | Pro version | $59 per year |
Frequently asked questions
Do I need an SMTP plugin?
For a business site, almost always. It sends notifications through an authenticated service, which significantly improves their chances of arriving. It must be paired with SPF and DKIM records published for your domain.
Which plugin is the most accessible?
Gravity Forms, which now turns its accessible settings on by default, and WS Form are the most committed. No plugin makes a site compliant on its own: the theme, colors and content matter just as much. According to the 2026 WebAIM Million study, form fields without labels remain one of the most widespread accessibility errors on the web. Our guide to WordPress accessibility fixes covers the points to check.
Is reCAPTCHA compatible with GDPR?
It sends visitor data, including the IP address, to Google, which must appear in your privacy policy. Akismet and Turnstile also send data to their providers. A honeypot field, on by default with several vendors, sends nothing.
How long should I keep entries?
As long as their purpose requires, for example handling a contact request, then delete them. State that period to the visitor and use your plugin’s automatic deletion, after checking on a test copy what it actually deletes.
Are “free” payments really free?
Rarely: WPForms and Formidable take 3%, SureForms 2.9% and Fluent Forms 1.9% in their free or entry versions, on top of Stripe’s fees. With regular revenue, a paid license often works out cheaper.
Conclusion
A good form is one whose messages arrive, whose entries are protected and then deleted on time, and that everyone can fill in. The plugin choice comes after: Fluent Forms, or Forminator updated without delay, for the most for free, Gravity Forms for demanding projects, Contact Form 7 for restraint.
The Forminator affair, and the critical flaws fixed in 2026, are a final reminder that a form remains an anonymous entry point into your database. It deserves the same care as the rest of the site: prompt updates, minimal data, backups.
Sources
- WordPress Developer Resources. wp_mail()
- PHP Manual. mail()
- Google. Email sender guidelines
- Google. Email sender guidelines FAQ
- Yahoo. Sender Best Practices
- Microsoft (April 2025). Outlook’s New Requirements for High-Volume Senders
- Contact Form 7. Best practice to set up mail
- Wordfence (July 1, 2025). 600,000 WordPress Sites Affected by Arbitrary File Deletion Vulnerability in Forminator
- NVD (July 2025). CVE-2025-6463
- Gravity Forms (July 11, 2025). Security incident notice
- Gravity Forms (July 28, 2026). Gravity Forms 3.0
- WPForms. Using Lite Connect Entry Backups
- WPForms (October 2026). Pricing
- Formidable Forms. Stripe forms
- SureForms. Understanding payment processing fees
- Ninja Forms. Accessibility Statement
- Contact Form 7. Save submitted messages with Flamingo
- Equalize Digital (October 2024, updated July 2025). How Accessible are WordPress Forms by Default?
- WebAIM (2026). The WebAIM Million
- CNIL. Examples of personal data collection forms (in French)
- Gravity Forms (July 16, 2025). Security Update and Password Reset Information
- NVD (August 18, 2026). CVE-2026-15748, Forminator
- NVD (September 19, 2026). CVE-2026-92229, Forminator
- CNIL. RGPD en pratique : communiquer en ligne
LaFactory designs, builds and maintains WordPress and WooCommerce sites, forms and email deliverability included, and develops its own plugins. Talk to us about your WordPress project.