Description
Wonyx Form Builder is a visual WordPress form builder by Wonyx IT Solutions. It includes responsive field layouts, multi-step forms, conditional logic, email notifications, SMTP delivery, email OTP verification, entry management, exports, webhooks, reporting and optional third-party integrations.
Developed by Ankush for Wonyx IT Solutions. Official website: https://www.mywonyx.com/
Main features include:
- Drag-and-drop visual builder with responsive desktop, tablet and mobile widths.
- Text, email, phone, textarea, dropdown, checkbox, radio, date, time, file, signature, consent, rating, NPS, calculation, repeater and other advanced fields.
- Multi-step forms, progress indicators and conditional show/hide/enable/disable logic.
- Email notifications, autoresponders, WP Mail, SMTP and fallback SMTP.
- Optional email OTP verification before submission.
- Anti-spam controls, rate limits, honeypot, duplicate checks and optional CAPTCHA providers.
- CRM-style entries, statuses, notes, assignees, PDF output, CSV/Excel-compatible export and reports.
- JSON/TXT form import/export. Sensitive credentials and secret-bearing endpoints are excluded from exports.
- Optional popup and slide-in display modes.
- Optional Google Places, Google Sheets/App Script, email marketing and webhook integrations.
- WordPress privacy exporter/eraser integration for stored form entries.
Use the shortcode:
[wonyx_form id="1"]
Popup example:
[wonyx_form id="1" mode="popup" trigger="Get A Quote"]
The legacy [ankush_form] shortcode alias is kept only for backward compatibility with sites upgraded from earlier private builds. The older short-prefix [afb_form] alias has been removed to avoid namespace collisions.
Source Code and Build Process
The JavaScript files assets/admin.js and assets/front.js are the human-readable source files used directly by WordPress. They are maintained directly in this plugin and are not generated from another source tree, minified, bundled or transpiled. No npm, webpack, gulp or other build step is required to regenerate them.
The plugin does not bundle third-party JavaScript libraries. Optional third-party services are loaded only when the administrator enables the corresponding integration and are documented under External Services below.
External Services
Wonyx Form Builder works without third-party services. The services below are contacted only when a site administrator explicitly enables and configures the related feature. Site owners are responsible for disclosing enabled services and obtaining any consent required by applicable law.
Google reCAPTCHA
Used only when reCAPTCHA is enabled for spam protection. The visitor’s CAPTCHA token and IP address may be sent to Google for verification.
Service: https://www.google.com/recaptcha/about/
Terms: https://policies.google.com/terms
Privacy: https://policies.google.com/privacy
hCaptcha
Used only when hCaptcha is enabled for spam protection. The visitor interacts with hCaptcha and verification data may be sent to Intuition Machines.
Service: https://www.hcaptcha.com/
Terms: https://www.hcaptcha.com/terms
Privacy: https://www.hcaptcha.com/privacy
Cloudflare Turnstile
Used only when Turnstile is enabled for spam protection. Verification data may be sent to Cloudflare.
Service: https://www.cloudflare.com/products/turnstile/
Terms: https://www.cloudflare.com/website-terms/
Privacy: https://www.cloudflare.com/turnstile-privacy-policy/
Google Maps Platform / Places
Used only when Google Places address autocomplete is enabled. Address queries and related browser data are handled by Google Maps Platform.
Service: https://developers.google.com/maps
Terms: https://cloud.google.com/maps-platform/terms
Privacy: https://policies.google.com/privacy
Google Sheets / Apps Script
Used only when the administrator supplies an Apps Script Web App URL and enables the integration. Configured submission fields are sent to that administrator-controlled endpoint.
Service: https://developers.google.com/apps-script
Terms: https://policies.google.com/terms
Privacy: https://policies.google.com/privacy
Mailchimp
Used only when enabled with an API key and audience. The configured contact email is sent to Mailchimp.
Service: https://mailchimp.com/
Terms and privacy information: https://mailchimp.com/legal/
GetResponse
Used only when enabled with an API key and campaign. The configured contact email is sent to GetResponse.
Service: https://www.getresponse.com/
Terms and privacy information: https://www.getresponse.com/legal
Campaign Monitor
Used only when enabled with an API key and list. The configured contact email is sent to Campaign Monitor. The plugin does not assert tracking consent on behalf of the visitor.
Service: https://www.campaignmonitor.com/
Terms and privacy information: https://www.campaignmonitor.com/policies/
Webhooks and automation endpoints
Generic form webhooks, Google Apps Script endpoints, and Zapier/Make/Pabbly-style automation webhooks are contacted only when an administrator enters an endpoint URL and enables the feature. The configured form submission payload is sent to that administrator-selected endpoint. Terms and privacy policies depend on the endpoint/service selected by the site owner.
SMTP servers
If Custom SMTP is selected, email content and recipient/sender metadata are transmitted to the SMTP server configured by the site administrator. Terms and privacy policies depend on that SMTP provider.
Privacy
The plugin stores form submissions in the WordPress database. Depending on form configuration, entries may contain names, email addresses, phone numbers, addresses, uploaded files, signatures, referral data, campaign parameters and an IP address.
IP collection, partial/abandoned entry capture and campaign tracking are optional. New forms have campaign tracking disabled by default. WordPress privacy export and erase requests can export or anonymize stored entries associated with a requested email address. Local files stored by upload/signature fields in matching entries are also removed when possible.
Wonyx Form Builder itself does not send usage telemetry to Wonyx IT Solutions.
Installation
- Upload the
wonyx-form-builderfolder to/wp-content/plugins/, or install the ZIP from Plugins > Add New > Upload Plugin. - Activate Wonyx Form Builder.
- Open Wonyx Form Builder > Forms and create or import a form.
- Configure fields, styling, email delivery and any optional integrations.
- Add the generated
[wonyx_form id="..."]shortcode to a page, post or supported page builder.
If upgrading from an older private build stored in an ankush-form-builder folder, deactivate the older package before activating this WordPress.org-ready package. The plugin migrates its legacy tables/settings to the new Wonyx-prefixed storage on activation.
FAQ
-
Does the plugin require a paid license?
-
No. Features included in this plugin are not gated by a plugin license or time-limited trial.
-
Does it work without external services?
-
Yes. Normal form creation, local entry storage and WP Mail delivery work without configuring the optional external integrations.
-
Are API keys and SMTP passwords included in exported form files?
-
No. Passwords, API keys, shared secrets, webhook authorization headers and secret-bearing endpoint URLs are removed from JSON/TXT exports. Re-enter those credentials after importing a form on another site.
-
Can I verify a visitor’s email before submission?
-
Yes. Enable Email OTP Verification on an email field. The form sends a six-digit code using the configured email delivery method and validates the verification server-side.
-
Does the plugin add a powered-by link to public forms?
-
No.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Wonyx Form Builder” is open source software. The following people have contributed to this plugin.
ContributorsTranslate “Wonyx Form Builder” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
3.7.7
- Sanitized and validated Test Email SMTP JSON before any values reach PHPMailer, including strict host, port, username and encryption handling.
- Applied the same SMTP validation to saved delivery settings and live/fallback SMTP transport setup.
- Validated decoded form-schema JSON before context-specific schema sanitization and storage.
- Restricted background images to HTTP(S) URLs and CSS-encoded all string/url delimiters before generating inline background-image CSS.
3.7.6
- Restricted saved font-family values to a fixed allowlist and generate CSS only from plugin-owned font stacks.
- Hardened privacy erasure so uploaded files are deleted only when a stored data key uniquely identifies an upload/signature field, preventing duplicate-label confusion.
3.7.5
- Removed the auxiliary SOURCE.md file from the production package; source/build documentation remains in readme.txt.
3.7.4
- Removed arbitrary Custom CSS storage/output in favor of the visual styling controls.
- Removed the short
afb_formlegacy shortcode alias to avoid declaration collisions. - Documented the directly maintained, human-readable JavaScript source files and build process.
- Hardened form export JSON encoding.
3.7.1
- Fixed the automated Plugin Check DirectDB warning by replacing the dynamic Entries query with one fully prepared fixed-shape query.
- Hardened entry CSV, Excel and REST filtering so user-controlled form IDs and limits are passed only through prepared placeholders.
- Updated the WordPress.org Tested up to header to WordPress 7.1 after publication compatibility review.
3.7.0
- Prepared the package for WordPress.org submission with the canonical
wonyx-form-builderfolder, main file and text domain. - Removed the arbitrary Custom JavaScript feature and ignores/purges that legacy setting when older forms are loaded or imported.
- Migrated short internal database/option/action prefixes and admin page slugs to unique Wonyx identifiers with legacy table/settings migration.
- Replaced raw external script tags with WordPress enqueue APIs for CAPTCHA providers.
- Added WordPress privacy exporter, safe entry anonymization eraser and privacy-policy helper content.
- Limited privacy file cleanup to URLs stored by actual file/signature fields so unrelated uploads cannot be removed.
- Disabled campaign tracking by default for new forms.
- Redacted SMTP passwords, API keys, shared secrets and secret-bearing endpoints from form exports.
- Added spreadsheet-formula injection protection to entry exports.
- Stopped trusting unverified forwarding headers for the default visitor IP used in rate limiting.
- Removed automatic Campaign Monitor tracking-consent assertions.
- Added GPL metadata and a concise WordPress.org readme with external-service disclosures.
Older release notes are available in changelog.txt.