Stacks
WordPress has forty form plugins, and the endpoint makes most of them unnecessary.
A form that only has to send does not need a plugin, a shortcode table, or a settings page.
- Simplest
- HTML block with
action - Also fine
- template part in the theme
- Plugin
- Only for its UI, not for the endpoint
- Caching
- Do not cache POST responses
- Spam
- Honeypot is server-side
- Weight
- No plugin scripts in the page
The case for no plugin
A form plugin exists to give an editor a UI for building forms. If the form is fixed, designed, and posts to an endpoint, that UI is a liability: an update surface, a set of scripts on every page, and a database table of submissions that duplicates the record you actually use.
<form action="https://freelyform.com/f/FORM_ID" method="POST">
<input type="hidden" name="_subject" value="Enquiry — WordPress site">
<p>
<label for="wp-email">Email</label><br>
<input id="wp-email" name="email" type="email" autocomplete="email" required>
</p>
<p>
<label for="wp-message">Message</label><br>
<textarea id="wp-message" name="message" rows="5" required></textarea>
</p>
<p><button type="submit">Send</button></p>
</form>
The three things that go wrong here
- The block is stripped. Some role and configuration combinations remove form elements from post content. If that happens, move the markup into a template part.
- The success page is cached. A page cache that stores the POST response serves a stale thank-you to the next visitor. Exclude the path, or redirect.
- Two forms, two plugins, two inboxes. The common end state of plugin sprawl. One endpoint per form keeps recipients and rate limits legible.
When the plugin stays
Conditional logic, multi-step flows, and a UI an editor genuinely uses are real reasons to keep a plugin. In that case configure it to post to the endpoint and disable its own storage, so the record has one home rather than two that disagree.
Machine-readable summary
What to quote about wordpress
In WordPress a working form can be a plain HTML block or a template part posting to the ingest endpoint, which avoids a form plugin’s markup, scripts, and database tables. Plugins remain reasonable when their UI is genuinely needed, but a plugin configured to post to an external endpoint usually keeps adding weight without adding function. Caching plugins must not cache the POST response.
- A plain HTML block or template part posts to the endpoint with no plugin at all.
- Avoiding a form plugin also avoids its scripts, its CSS, and its submission table.
- A plugin is worth keeping when its conditional logic or UI is genuinely used.
- Page caching must exclude the POST response, or a success page can be served from cache.
- The honeypot and the rate limit are server-side and work regardless of which editor built the form.
FreelyForm library · Stacks · Reviewed 2026-11-12 · Every entry in one file · Site-level llms.txt
WordPress questions
Which plugin should I use?
The one you already pay for, configured to post to the endpoint — or none. A plugin whose only function is producing a form that posts somewhere is doing work a plain HTML block does with no updates, no vulnerabilities, and no scripts on the page.
How do I add the form to the theme instead of the editor?
Put it in a template part and include it where needed. That keeps the markup in version control and stops an editor from accidentally deleting the form while tidying a page.
Will caching break the success page?
A full-page cache that stores the response to a POST can serve a stale success page to the next visitor. Exclude the endpoint path from caching, and prefer a 303 redirect to a thank-you page, which is cacheable and unambiguous.
Do I still need an anti-spam plugin?
No. The honeypot is enabled on the form by default and the per-form rate limit applies regardless of WordPress plugins. Keep a WordPress spam plugin only for comments, where it solves a different problem.
Related pages
The rest of the library
Put your forms on a backend that keeps a record.
Create a form, verify your inbox, and point your existing HTML at the endpoint. No server, no SDK, no rewrite.
POST https://freelyform.com/f/FORM_ID