MIS Webform is a full-featured form builder for WordPress, with no artificial limits on forms,\nfields, or submissions in the free version. Build a simple contact form in a minute, or a\nmulti-page application form with conditional logic, file uploads, and a signature field \u2014 all\nfrom one field-type registry of 38+ options, with 8 ready-made templates to start from, and\ndrag-to-reorder fields in the builder. Submissions are stored securely (uploaded files are never\npublicly accessible), exportable to CSV, and integrated with WordPress's own Export\/Erase\nPersonal Data privacy tools.<\/p>\n\n
Free version features:<\/p>\n\n
Need more? MIS Webform Pro<\/a> adds an AI Form Generator\nand webhooks.<\/p>\n\n This plugin connects to one third-party service, and only when a site owner explicitly enables\nit - it is off by default and no data is sent anywhere for this purpose unless you turn it on.<\/p>\n\n Google reCAPTCHA v2<\/strong> - used for optional spam protection on a per-form basis, under that\nform's Spam Protection settings.<\/p>\n\n No other external service is contacted by this plugin. All other assets (CSS, JavaScript,\nincluding the date\/time picker library) are bundled with the plugin and served from your own\nsite. Plugin activation itself does not contact any external server.<\/p>\n\n This plugin bundles flatpickr<\/a> 4.6.13 (MIT license) for its date\/time\npicker fields.<\/p>\n\n\n Copy the shortcode shown next to your form in the MIS Webform<\/strong> admin screen (for example\n [mis-webform id=\"1\"]) and paste it into a page, post, or any widget\/block that supports shortcodes.<\/p><\/dd>\n Submissions are stored in your WordPress database and are viewable under\nMIS Webform \u2192 Submissions<\/strong>, where they can also be exported to CSV.<\/p>\n\n Each submission also records the visitor's IP address and browser user agent string, mainly\nuseful for spam investigation. These are kept indefinitely along with the submission unless\nyou delete it yourself - there is currently no automatic expiry. If you're subject to GDPR or\nsimilar privacy regulations, factor this into your own data retention policy, and delete old\nsubmissions manually via MIS Webform \u2192 Submissions<\/strong> when they're no longer needed.<\/p><\/dd>\n Each file upload field lets you set allowed file extensions and a maximum size. On submission,\nMIS Webform checks both the filename's extension and<\/em> the file's actual content against that\nallowlist (using WordPress's own By default, no - all CSS\/JS assets, including the date\/time picker library, are bundled with the\nplugin and served from your own site.<\/p>\n\n The one exception is Google reCAPTCHA, which is entirely optional and off by default. If you\nchoose to enable it for a form (under that form's Spam Protection settings), the plugin will:<\/p>\n\n This only happens for forms where you've explicitly turned reCAPTCHA on and entered your own\nGoogle reCAPTCHA site\/secret keys - if you never enable it, no data ever leaves your site for\nthis purpose. If you do enable it, consider mentioning Google reCAPTCHA in your site's privacy\npolicy, as its use is subject to Google's Privacy Policy<\/a>\nand Terms of Service<\/a>.<\/p><\/dd>\nExternal services<\/h3>\n\n
\n
https:\/\/www.google.com\/recaptcha\/api.js<\/code>) on pages where that form appears. When a\nvisitor submits the form, their reCAPTCHA response token and IP address are sent to Google's\nverification endpoint (https:\/\/www.google.com\/recaptcha\/api\/siteverify<\/code>) to confirm the\nsubmission wasn't from a bot.<\/li>\nCredits<\/h3>\n\n
\n
mis-webform<\/code> folder to the \/wp-content\/plugins\/<\/code> directory, or install the plugin\nthrough the WordPress plugins screen directly.<\/li>\n[mis-webform id=\"X\"]<\/code> shortcode into any page, post, or widget area.<\/li>\n<\/ol>\n\n\n\n
How do I add a form to a page?<\/h3><\/dt>\n
Where are submissions stored?<\/h3><\/dt>\n
How are file uploads validated?<\/h3><\/dt>\n
wp_check_filetype_and_ext()<\/code>) - a file renamed to spoof its\nextension (e.g. a disguised executable) is rejected even if the filename alone looks fine. This\ncontent-based check is strongest when your host has the PHP fileinfo<\/code> extension enabled,\nwhich is the default on nearly all WordPress hosting - if your host has disabled it, file-type\nvalidation falls back to WordPress core's own weaker built-in checks.<\/p><\/dd>\nDoes this plugin load anything from third-party servers?<\/h3><\/dt>\n
\n
https:\/\/www.google.com\/recaptcha\/api.js<\/code>) on pages\nwhere that form appears.<\/li>\nDoes MIS Webform include AI features?<\/h3><\/dt>\n