SOBI FORMS
Plugin v1.11.0
Features
Full product reference—or switch to marketing mode for the short pitch.
Forms & management
| Feature | Description |
|---|---|
| Multiple forms | Run as many forms as you need from one plugin. Create, edit, duplicate, and delete forms without touching code. The forms list is sorted by last updated. |
| Form templates | Start from Contact, Quote, Job, Event, or Support templates in the forms list—or begin with an empty canvas. |
| Admin title + fixed slug | Give each form a clear admin name and a URL-safe slug. The slug is locked after creation so shortcodes and embeds never break when you rename the title. |
| List search | Find forms quickly in the admin list by searching the title, slug, or notification recipient email. |
| Submit button label | Customize the submit button text per form—"Send", "Request a quote", "Subscribe", and so on. |
| AJAX save | Save builder changes instantly without a full page reload. Keyboard shortcut: ⌘/Ctrl+S. |
Builder
Layout & editing
| Feature | Description |
|---|---|
| Document-first canvas | Build forms in a focused canvas on the left while field and form settings stay in a sidebar on the right—similar to editing a document, not clicking through nested admin tabs. |
| Add field | An always-visible control above the submit button opens the field picker so you can add fields without hunting through menus. |
| Reorder fields | Drag and drop to reorder fields on the canvas. Powered by @dnd-kit for smooth, predictable sorting. |
| Multi-column layout | Place up to 3 fields side by side (e.g. First name | Last name | Company). Drag a field beside another to create a row, drag column separators to resize, and double-click a separator to equalize widths. Title, paragraph, textarea, and file fields stay full width. |
| Multi-step forms | Insert a New step layout block to split the form into visitor pages with Next / Back, per-step validation, and a progress indicator (max 10 steps). One submission at the end — same inbox, emails, and automations. |
| Conditional logic | Show only when… in the field gear menu. Match all or Match any (up to five rules). Number fields support greater/less comparisons. Instant front-end updates; server drops hidden field values before inbox, emails, webhooks, and CRM sync. Multi-step aware (same or earlier steps only). |
| Field menu (⚙) | Open a compact menu on any field to mark it required, show or hide the label, delete, or duplicate—without leaving the canvas. |
| Settings sections | Sidebar settings are grouped into collapsible sections so you can focus on one area at a time. |
| Lucide icons | Consistent Lucide iconography across the builder and submissions inbox for a cleaner, more modern admin UI. |
| Sidebar inputs | All sidebar controls share unified styling. Discreet inline hints warn you when a setting needs attention. |
| Select fields | Dropdown fields show a chevron indicator so visitors immediately recognise them as select inputs. |
| Embed overlay | Copy the shortcode or follow Gutenberg block instructions from a built-in overlay—no hunting through docs while you build. |
Field types
| Feature | Description |
|---|---|
| Short text, email, link | Collect short text, email addresses, and URLs with dedicated field types and appropriate validation. |
| Long text | Multi-line textarea for messages, descriptions, or longer free-form answers. |
| Phone | Country prefix selector with E.164 formatting—all countries supported. |
| Number & date | Numeric input with optional min/max limits, and a dedicated date field with min/max date constraints. |
| Dropdown | Single-select dropdown with editable options. |
| Single choice | Radio options rendered as visual tiles on the front-end. |
| Checkboxes | Multi-option checkboxes or a simple consent checkbox. |
| File upload | Let visitors attach one file per field. Ideal for CVs, briefs, or supporting documents. |
Layout blocks
| Feature | Description |
|---|---|
| Title block | Add section headings inside the form to structure longer flows. Display-only—not submitted with the entry. |
| Paragraph block | Insert instructions, disclaimers, or helper text between fields. Display-only—not submitted. |
Per-field options
| Feature | Description |
|---|---|
| Label visibility | Show or hide the field label on the front-end—handy when the placeholder or surrounding copy is enough context. |
| Number limits | Set minimum and maximum values on number fields to prevent out-of-range submissions. |
| Date limits | Set minimum and maximum dates on date fields to constrain selectable ranges. |
| Text / email limits | Enforce minimum and maximum character counts on text and email fields for cleaner, more predictable data. |
| Phone default country | Set a default country prefix for phone fields. Visitors can change it on the front-end. |
| Textarea | Allow visitors to resize the textarea and cap its length so long messages stay within your limits. |
| Choice options | Edit select, radio, and checkbox options inline on the canvas or from the field settings menu. |
| File field | Restrict allowed file extensions via a searchable multi-select and set a max file size (default 5 MB, capped by your server limits). |
| Inline links | Insert, edit, and remove http(s) links in Paragraph text, consent checkbox labels, and multi-checkbox option labels. Select text in the canvas, then use the Link bubble—pick a published WordPress page or paste a URL. |
| Link behaviour | Links open in a new tab (noopener noreferrer). Clicking a link inside a checkbox label does not toggle the checkbox—ideal for privacy policy / terms links. |
| Link storage | Stored as sanitized HTML (<a> and <br> only). Inbox, exports, and emails use plain text for field values. |
Prefill & hidden data
| Feature | Description |
|---|---|
| URL prefill | Pre-populate scalar fields from URL query parameters on the client—useful for campaign links and still friendly to page caching. |
| Hidden fields | Capture UTM tags, referral codes, or internal IDs invisibly on the front-end. Configure inbox label, URL param, and optional default in a sidebar table. Always submitted; visible in the inbox and notification emails. |
Per-form settings
Availability
| Feature | Description |
|---|---|
| Pause | Stop accepting submissions immediately—useful for sold-out offers, maintenance, or manual review periods. |
| Auto-close | Schedule an automatic close date and time using your WordPress site timezone. The form stops accepting entries when the deadline hits. |
| Submission limit | Cap total submissions (e.g. 100 spots). Shows progress as N / max with no automatic reset—ideal for limited registrations. |
| Unavailable message | Show visitors a custom message when the form is paused, closed, or full instead of a generic error. |
After submit
| Feature | Description |
|---|---|
| What the visitor sees | Choose an inline success message on the same page, or redirect to any published WordPress page. These options are mutually exclusive. |
| Save to inbox | Store submissions in the built-in inbox. Includes auto-purge / retention when enabled on the form. |
| Send admin notification | Email up to 10 recipients when a new submission arrives. |
| Send user confirmation | Send a thank-you email to the visitor using a designated email field on the form. |
| Custom email content | Edit admin and visitor subject and HTML body per form (After submit → Content). Placeholders such as {{form.title}}, {{field.<id>}}, and {{all_fields}}. Leave a field blank to keep the default. Send a test email to the logged-in admin. |
| Action picker | Add or remove delivery actions via a picker. Actions run in a fixed order. At least one delivery path is required: inbox, admin email, or an active automation (webhook, Brevo, or Mailchimp). Confirmation alone does not count. Inline warnings on save if misconfigured. |
Automations
| Feature | Description |
|---|---|
| Add automation | Builder sidebar → Automations. Mix unlimited webhooks with native Brevo and Mailchimp connectors on the same form. Pause any automation without deleting it. |
| Unlimited webhooks | Add as many HTTPS endpoints as you need per form (staging + production, CRM + Slack, Zapier / Make / n8n). Each has a name, URL, HMAC secret, Run test, and pause toggle. |
| HMAC signing | Every webhook POST includes X-Sobi-Signature (Stripe-style HMAC-SHA256). Per-automation secret on the Security tab—copy or regenerate without changing the URL. |
| Brevo | Upsert contacts into a Brevo list. Map the form email field and optional contact attributes. Optional Require double opt-in (Brevo DOI template + redirect URL). Add a test contact from the builder. Requires an API v3 key under Settings → Integrations → Brevo. |
| Mailchimp | Upsert members into a Mailchimp audience. Map merge fields and optionally require double opt-in for new subscribers. Add a test member from the builder. Requires a Marketing API key under Settings → Integrations → Mailchimp. |
Advanced
| Feature | Description |
|---|---|
| Custom error message | Replace the default submission error text with your own copy—useful for brand voice or clearer next steps. |
Embed & integration
| Feature | Description |
|---|---|
| Shortcode | Embed any form with `[sobiforms id="3"]` or `[sobiforms slug="contact"]`. Use id or slug—whichever fits your workflow. |
| Gutenberg block | Drop in the Sobi Forms Contact block and pick a form visually—no shortcode memorisation required. |
| Page builders | Works anywhere shortcodes work: Elementor, Divi, classic widgets, and other builder plugins. |
Visitor experience
| Feature | Description |
|---|---|
| AJAX submit | Visitors submit without a full page reload—faster, smoother, and less disruptive to the browsing experience. |
| Validation | Instant HTML5 checks in the browser, then strict server-side JSON schema validation so bad data never reaches your inbox. |
| Nonce loading | Security tokens load on hover or focus so cached pages stay fast while submissions remain protected. |
| Closed form | When a form is paused or past its deadline, visitors see your custom unavailable message instead of the form. |
| Choice UI | Radio options render as visual tiles; checkboxes support multi-select lists or a single consent checkbox. |
| Responsive columns | Multi-column rows use CSS grid on the front-end and stack vertically below 600px so forms stay readable on mobile. |
| Front-end CSS | Ships with minimal, neutral styles. Developers can disable plugin CSS entirely via the `sobiforms_enqueue_front_assets` filter. |
| JavaScript | Vanilla JS on the public site—no React, no jQuery. Keeps the front-end footprint small and predictable. |
| Asset loading | CSS and JS load only on pages that actually render a form. Every other page on your site stays untouched. |
Inbox & submissions
Layout & navigation
| Feature | Description |
|---|---|
| Split view | Browse submissions in a list on the left and read the full entry on the right—like Gmail or Linear. Columns are resizable. |
| React app | List and detail mutations happen without a full page reload. Toast feedback confirms actions. |
| Views | Tabs for All, Unread, and Starred. Spam and Trashed are top-level views for quick triage. |
| Per-form filter | Narrow the inbox to a single form with a compact dropdown—handy on sites running many forms. |
| Search | Full-text search across submission content so you can find a lead without scrolling. |
| Pagination | Loads 50 submissions per page to keep the admin fast even with large volumes. |
| Admin badge | An unread count on the Sobi Forms admin menu so new submissions are hard to miss. |
Submission detail
| Feature | Description |
|---|---|
| Field data | See every submitted field plus metadata such as date received and which form it came from. |
| Source page | Records the page title and pathname at the moment of submission (query strings excluded—use hidden fields for UTM tracking). |
| Legacy submissions | Older entries submitted before source-page tracking show "Not recorded" instead of leaving a blank. |
| Admin note | Add private team notes on any submission. Never shown on the front-end or in notification emails. |
| File attachments | View the uploaded filename and download the file from the inbox—admin-only, capability-checked. |
Workflow
| Feature | Description |
|---|---|
| Read / unread & star | Mark submissions read or unread and star important leads for quick filtering. |
| Spam queue | Move suspected spam into a dedicated view. Webhooks, Brevo, and Mailchimp do not fire on spam ingest. |
| Soft delete | Delete moves submissions to Trashed (recoverable). Permanent delete is only available from the Trashed view. |
| Auto-read | Opening a submission automatically marks it as read—except when browsing the Trashed view. |
| Row checkbox | The row checkbox auto-selects when you open a submission, making bulk actions faster. |
| Checkboxes UI | Custom Lucide checkboxes replace native browser checkmarks for a consistent admin look. |
| Mark all as read | Clear your entire unread queue in one click when you have caught up. |
| Bulk actions | Select multiple submissions and mark read, spam, trash, restore, or delete permanently. |
| Move all matching to trash | Bulk purge all submissions matching the current filters in one action. |
| Dashboard widget | A WordPress dashboard widget surfaces recent unread submissions as soon as you log in. |
Email & delivery
| Feature | Description |
|---|---|
| Admin notification | Send formatted HTML emails to your team when a submission arrives. Uses wp_mail() by default, or SMTP when routing is enabled. |
| Recipients | Route notifications to up to 10 email addresses per form—sales, support, and ops can all stay in the loop. |
| File fields in email | Emails include the filename and a link back to the inbox rather than attaching files directly—safer for deliverability. |
| Visitor confirmation | Send visitors a simple thank-you email confirming their message was received. Does not repeat submitted field contents. |
| Sender | Emails are sent using your site name as the sender—not the generic "WordPress" label. |
| Reply-To | When the form includes an email field, replies go straight to the visitor so you can continue the conversation in your inbox. |
| Delivery modes | Email only, inbox only, webhook / ESP only, or any combination—configured per form via After submit and Automations. |
| Mail failures | A mail transport failure after a valid submit does not show an error to the visitor. Admins troubleshoot via Settings → SMTP → Logs. |
Settings & integrations
Sobi Forms → Settings
SMTP (Core Settings)
| Feature | Description |
|---|---|
| SMTP account | Connect one SMTP provider per site so form emails are delivered through your own mail server. |
| Settings & Logs tabs | Configure SMTP in a side drawer with Settings and Logs tabs. |
| Delivery logs | Failed notification and confirmation deliveries are logged for 30 days with error code and message. Retry resends the stored email snapshot. |
| Activate SMTP routing | Master toggle for mail delivery. When off, falls back to wp_mail() instantly—credentials stay saved. |
| Testing | Run a connection test and send a test email from the admin before going live. |
| Credentials | Passwords are stored encrypted. Optionally define SOBIFORMS_SMTP_PASSWORD in wp-config.php for extra control. |
Webhooks (Integrations)
| Feature | Description |
|---|---|
| Overview & Logs | Settings → Webhooks lists forms with webhook automations. Logs tab shows failed deliveries (URL, HTTP status, error) with Retry. |
| Per-form setup | Configure via Automations → Add automation → Webhook. Unlimited URLs per form; saved when the URL is valid. |
| Payload | Stable v1 JSON (sobiforms_webhook_version: 1) with form.submission.created events, form metadata, submission id, field values, and source page. Uploaded files are referenced as { id: null, name, url, mime_type }. |
| HMAC signing | Every request is signed (X-Sobi-Signature). Receivers that ignore extra headers keep working. |
| Run test | Send sample field values in the same JSON shape as a real submission—map keys in Zapier, Make, or webhook.site before go-live. Save the form first after adding fields. |
| Spam handling | Webhooks do not fire on spam ingest. They fire once when a submission is marked as not spam. Flag cleared on delivery failure. |
| Delivery logs | Failures only, 30-day retention. Manual Retry from stored URL and payload. Resolved rows stay visible until purge. |
| Async delivery | Delivered via WP-Cron so visitors are not held up. On low-traffic sites, may wait until the next WP request. |
Brevo (Integrations)
| Feature | Description |
|---|---|
| API connection | Settings → Integrations → Brevo: store an encrypted API v3 key (or SOBIFORMS_BREVO_API_KEY in wp-config.php). Test connection. Connection is active when a key is set—pause per form instead of a site-wide toggle. |
| Contact upsert | Valid (non-spam) submissions create or update a contact on the selected Brevo list. Map email plus optional attributes from your Brevo account. |
| Logs & Retry | Failed, skipped, and warning runs in Settings → Brevo → Logs. Retry replays the stored snapshot. |
| Double opt-in | Optional per automation: enable Require double opt-in, pick a Brevo DOI confirmation template (Marketing → Templates, with a Double opt-in link button), and set a redirect URL after confirmation. Brevo sends the email; the contact joins the list only after they click the link. |
Mailchimp (Integrations)
| Feature | Description |
|---|---|
| API connection | Settings → Integrations → Mailchimp: Marketing API key including datacenter suffix (e.g. -us14). Encrypted, or SOBIFORMS_MAILCHIMP_API_KEY. Test connection. |
| Audience upsert | Valid submissions create or update an audience member. Map the email field and merge tags from that audience. |
| Require double opt-in | Optional per automation. Mailchimp confirmation for new subscribers only (pending). Existing unsubscribed contacts stay unsubscribed. |
| Logs & Retry | Failed, skipped, and warning runs in Settings → Mailchimp → Logs. Retry replays the stored snapshot. |
Exports (Core Settings)
| Feature | Description |
|---|---|
| CSV & JSON | Background export jobs per form under Settings → Exports—no page timeout. CSV uses flat columns with UTF-8 BOM for Excel and JSON-encoded multi-values; JSON uses structured records with native types. |
| Filters & preview | Filter by inbox view (all non-spam, unread, read, starred). See a row-count preview before starting a job. |
| Job status | Track each export from Pending → Processing → Ready (or Failed / Expired). Jobs run via WP-Cron so large exports stay reliable. |
| Download & retention | Secure admin-only download via signed nonces. Files retained 7 days with automatic cleanup; optional email when ready or failed (initiating admin only). Excludes trashed submissions by default. |
| File fields in exports | Exported file fields include a signed admin download URL—not the file contents—so attachments stay private. |
Anti-spam & security
| Feature | Description |
|---|---|
| Honeypot | A hidden trap field catches bots without showing visitors an ugly CAPTCHA. |
| WordPress nonce | Every submission is verified with a WordPress security token to block forged requests. |
| Rate limiting | Default 10 submissions per hour per hashed IP. Configurable under Settings → Spam protection; set to 0 to disable. |
| Cloudflare Turnstile | Optional invisible-mode Turnstile. Siteverify on submit. Failed bot checks get a discreet success message with no delivery. |
| Server validation | All data is validated against a strict JSON schema on the server—client-side checks alone are not enough. |
| File uploads | Server-side MIME checks, getimagesize() for images (SVG excluded), and a blocklist of dangerous extensions. |
| Private storage | Uploads live in uploads/sobiforms/ with .htaccess deny-all on Apache so files are not publicly browsable. |
| File download | Only logged-in admins with the right capability can download files, with path verification on every request. |
| Akismet (optional) | When enabled under Settings → Spam protection, suspected spam is quarantined in the inbox with no admin email and a discreet success message for the visitor. |
| Admin actions | Every admin action checks user capabilities and WordPress nonces before anything changes. |
| POST guard | Checks post_max_size before nonce validation on empty POST bodies with a content-length header—clearer errors on large uploads. |
Data & privacy
| Feature | Description |
|---|---|
| Custom tables | Form, submission, mail log, webhook log, and export job data live in dedicated tables—not scattered across wp_postmeta or wp_options. |
| Soft delete | Submissions have a trashed_at column for recoverable soft-delete. Permanent delete only from the Trashed view. |
| IP storage | Visitor IPs are stored as SHA-256 hashes only. Raw IP addresses are never saved. |
| Admin notes | Internal team notes stay inside the inbox. They are never exposed on the front-end or included in emails. |
| Retention | Automatically delete old submissions after a set period to support privacy frameworks like GDPR. Configured per form; manual purge also available. |
| Telemetry | No usage data is sent back to the plugin author. Your submissions stay on your server. |
| Akismet | Submission content is sent to Akismet only when you explicitly enable the integration under Settings → Spam protection. |
| Turnstile | When enabled, the Cloudflare Turnstile script loads on form pages and tokens may be verified with Cloudflare. |
| Brevo | Contact data is sent to Brevo only when you add an API key and a Brevo automation on a form. Brevo is a third-party processor. |
| Mailchimp | Member data is sent to Mailchimp only when you add an API key and a Mailchimp automation on a form. Mailchimp is a third-party processor. |
Performance
| Feature | Description |
|---|---|
| Front-end weight | About 5 KB of gzipped JS and CSS on pages that render a form (~21 KB unminified source)—light enough to protect Core Web Vitals. |
| Script loading | Scripts load in the footer with defer on WordPress 6.3+ so they do not block page rendering. |
| Conditional enqueue | Assets load only when the first form on a page is rendered—not site-wide. Zero assets on pages without a form. |
| Early enqueue | On singular posts, assets can load earlier when a shortcode or block is detected—reducing flash of unstyled content. |
| Object cache | Form definitions are cached to avoid repeated database reads on every page view. |
| Inbox queries | Tab counts use aggregate queries; list rows skip the heavy data column until you open a submission. |
| Builder admin | The React builder (~39 KB gzipped, ~138 KB minified) loads only on the form edit screen. |
Admin & resources
| Feature | Description |
|---|---|
| Admin menu | Submissions, Forms, Settings, and Resources are organised in a clear top-level menu. |
| Spam protection | Settings → Spam protection — rate limit, Akismet, and Cloudflare Turnstile in one place. |
| Resources → Usage | Shortcode and Gutenberg block documentation. |
| Requirements | Requires WordPress 6.0 or newer and PHP 7.4 or newer. |
Key messages
| Angle | Line |
|---|---|
| Performance | Zero impact on pages without a form; ~5 KB gzipped when a form is shown. |
| Workflow | Gmail-style inbox + dashboard widget — never miss a lead. |
| Simplicity | Modern builder with templates and multi-column layout; shortcode or block everywhere. |
| Integrations | Unlimited HMAC-signed webhooks, native Brevo & Mailchimp, SMTP, CSV/JSON exports, visitor confirmation, Akismet spam quarantine. |
| vs heavy plugins | No React on the front, no forced reCAPTCHA. |
Core Features & Form Builder
| Feature | Description |
|---|---|
| Blazing Fast React Builder | Zero-reload canvas, drag-and-drop, ⌘/Ctrl+S, instant AJAX saving. |
| Multi-column layout | Up to 3 fields per row; drag to resize; double-click to equalize; stacks on mobile. |
| Multi-step forms | New step blocks with Next / Back, progress indicator, and per-step validation. |
| Conditional logic | Show only when… — Match all / Match any; hidden values never reach inbox or integrations. |
| Form templates | Contact, Quote, Job, Event, and Support starters—or start blank. |
| Smart Form Scheduling | Pause manually or auto close at a date/time with custom unavailable messages. |
| Flexible Embeds | Gutenberg block, id/slug shortcodes, Elementor, Divi, and any shortcode-compatible builder. |
| Field types + layout blocks | 10+ input types, title/paragraph blocks with inline links (page picker), file upload, hidden fields, URL prefill. |
Submission Inbox
| Feature | Description |
|---|---|
| SaaS-grade split view | React list + detail with resizable columns — like Gmail or Linear. |
| Instant triage | All / Unread / Starred / Spam / Trashed, search, per-form filter, bulk actions. |
| Admin notes & source page | Private annotations and frozen page context per submission. |
| CSV/JSON exports | Background jobs under Settings → Exports; filter by view, 7-day retention, optional email when ready. |
| Dashboard widget | Unread badge on admin menu + home screen widget for new leads. |
Security & Privacy
| Feature | Description |
|---|---|
| Silent anti-spam | Honeypot, nonces, rate limits (10/hour default), optional Akismet and Turnstile. |
| Privacy by design | Hashed IPs, custom tables, soft-delete trash, no telemetry, configurable purge. |
| File uploads | Validated, private storage, admin-only downloads. |
SMTP, Automations & Delivery
| Feature | Description |
|---|---|
| Native SMTP | SMTP routing with delivery logs and retry. Encrypted credentials. |
| Unlimited signed webhooks | HMAC-signed JSON to Zapier, Make, n8n, or any API—unlimited URLs per form, Run test, logs, retry. |
| Mailchimp integration | Native audience connector: map merge fields, optional double opt-in for new subscribers, logs and Retry. Free in core. |
| Brevo integration | Native list connector: upsert contacts, map attributes, optional double opt-in (DOI template + redirect), test from the builder, logs and Retry. Free in core. |
| Hybrid delivery | Inbox, email, webhooks, Brevo, Mailchimp—or any combination per form. |
| Custom emails | Admin and visitor subject/body with placeholders. Up to 10 recipients, Reply-To, site-name sender. |
