MIS Webform

FAQ

How do I add a form to a page?

Copy the shortcode shown next to your form in the MIS Webform admin screen (for example
[mis-webform id=”1″]) and paste it into a page, post, or any widget/block that supports shortcodes.

Where are submissions stored?

Submissions are stored in your WordPress database and are viewable under
MIS Webform → Submissions, where they can also be exported to CSV.

Each submission also records the visitor’s IP address and browser user agent string, mainly
useful for spam investigation. These are kept indefinitely along with the submission unless
you delete it yourself – there is currently no automatic expiry. If you’re subject to GDPR or
similar privacy regulations, factor this into your own data retention policy, and delete old
submissions manually via MIS Webform → Submissions when they’re no longer needed.

How are file uploads validated?

Each file upload field lets you set allowed file extensions and a maximum size. On submission,
MIS Webform checks both the filename’s extension and the file’s actual content against that
allowlist (using WordPress’s own wp_check_filetype_and_ext()) – a file renamed to spoof its
extension (e.g. a disguised executable) is rejected even if the filename alone looks fine. This
content-based check is strongest when your host has the PHP fileinfo extension enabled,
which is the default on nearly all WordPress hosting – if your host has disabled it, file-type
validation falls back to WordPress core’s own weaker built-in checks.

Does this plugin load anything from third-party servers?

By default, no – all CSS/JS assets, including the date/time picker library, are bundled with the
plugin and served from your own site.

The one exception is Google reCAPTCHA, which is entirely optional and off by default. If you
choose to enable it for a form (under that form’s Spam Protection settings), the plugin will:

• Load Google’s reCAPTCHA widget script (https://www.google.com/recaptcha/api.js) on pages
  where that form appears.
• Send the visitor’s reCAPTCHA response, together with their IP address, to Google’s
  recaptcha/api/siteverify endpoint when the form is submitted, to verify it wasn’t a bot.

This only happens for forms where you’ve explicitly turned reCAPTCHA on and entered your own
Google reCAPTCHA site/secret keys – if you never enable it, no data ever leaves your site for
this purpose. If you do enable it, consider mentioning Google reCAPTCHA in your site’s privacy
policy, as its use is subject to Google’s Privacy Policy
and Terms of Service.

Does MIS Webform include AI features?

The free version does not – it’s a complete, standalone form builder with no external account or
service required. An AI Form Generator is available in MIS Webform Pro,
which is documented separately since it involves a connected account and third-party AI service.

What happens to my data if I uninstall the plugin?

Your forms and submissions are kept by default, even if you delete the plugin – deactivating
never touches your data, and deleting it only removes the plugin’s files unless you’ve
explicitly opted in to full cleanup. If you do want your forms and submissions removed when you
delete the plugin, check MIS Webform → Settings → “Delete all MIS Webform forms and submissions when
uninstalling” before deleting it. This is off by default specifically so you don’t lose
customer/contact data by accident.