WPForms Setup: Build a Contact Form, Notifications and Spam Protection

This article is a localized edition of the Japanese original. Read the Japanese original

WPForms is a plugin for building forms with drag and drop. Even the free edition distributed on WordPress.org, "WPForms Lite", lets you build a contact form and receive notification emails. The paid editions (Pro and others) add saving submissions (entries), multiple notification emails, conditional logic and more.

Screen names in this article were checked against the files of WPForms Lite 2.0.4 as distributed on WordPress.org, and its translations, as of November 2026. The steps focus on the free edition.

What the free edition (Lite) can and cannot do

First, check the limits of the free edition.

Because the free edition does not save submissions on your site, if a notification email does not arrive, you lose that inquiry. Before publishing the form, confirm that notification emails arrive (see below).

1. Install and activate

In the admin, go to "Plugins → Add New", search for "WPForms", then install and activate "WPForms Lite". With WP-CLI:

wp plugin install wpforms-lite --activate

For a paid edition, download the zip file from the official WPForms site and install it from "Plugins → Add New → Upload Plugin".

2. Build a form from a template

1. Open "WPForms → Add New".
2. Enter a form name, then click "Use Template" on "Simple Contact Form" in the template list. This creates a form with name, email and message fields.
3. On the "Fields" screen, drag fields from the list on the left to add them. Click a field to set its label, whether it is required, its description and so on.
4. Click "Save" at the top right.

Each field gets a number (field ID). You use these numbers in notification emails, so note the number shown like "(ID #1)" in the heading of the field options when you click a field.

3. Embed the form in a page

Use one of these methods to show it on a page.

• The "Embed" button in the form builder: choose an existing page or create a new page to embed the form in.
• Block editor: on the page edit screen, add the "WPForms" block and choose the form.
• Shortcode: in the Classic Editor or widgets, write the following shortcode (123 is the form ID, which you can find under "WPForms → All Forms").

[wpforms id="123"]

4. Set up the notification email

In the form builder, go to "Settings → Notifications" to set up the email you receive when the form is submitted. Check that "Enable Notifications" is on.

In the "Simple Contact Form" template, the name is ID 1, the email is ID 2 and the message is ID 3, and Send To, Reply-To and Email Message already contain the same values as the examples in the table above.

{admin_email} and {field_id="1"} are placeholders called "Smart Tags". You can pick them from "Show Smart Tags" next to each field.

If you put the sender's address (the email field) in "From Email", the receiving side is more likely to mark the email as spam. Use an address on your site's domain as the From address, and set the reply address with "Reply-To".

An automatic reply to the person who submitted the form is created as a second notification, so it is a paid feature.

5. Set what happens after submission (confirmation)

Under "Settings → Confirmations", choose what to show after submission in "Confirmation Type".

If you track completed submissions in ads or analytics, prepare a thank-you page with "Show Page" so you can measure views of that page.

6. Set up spam protection

Configure this under "Settings → Spam Protection and Security". The free edition has the following options.

• Enable anti-spam protection: detects spam with a mechanism that visitors do not see. It is on by default for new forms.
• Enable Akismet anti-spam protection: appears when the Akismet plugin is active and set up.
• Enable minimum time to submit: rejects submissions sent sooner than the given number of seconds after the form was opened. It works well against automated spam.
• CAPTCHA: you can use hCaptcha, reCAPTCHA or Cloudflare Turnstile. First choose the type under "WPForms → Settings → CAPTCHA" and save the Site Key and Secret Key you got from the service, then enable it in the form settings.

Rejecting submissions that contain specific words (the keyword filter) is a paid feature. To do the same in the free edition, set an error with the wpforms_process hook, which runs while a submission is processed. Add the code to your child theme's functions.php or to a plugin such as Code Snippets.

<?php
// Reject submissions that contain the listed words (works in WPForms Lite too)
add_action( 'wpforms_process', function ( $fields, $entry, $form_data ) {
	$blocked_words = [ 'casino', 'viagra' ];

	foreach ( $fields as $field ) {
		$value = ( isset( $field['value'] ) && is_string( $field['value'] ) ) ? $field['value'] : '';

		foreach ( $blocked_words as $word ) {
			if ( '' !== $value && false !== stripos( $value, $word ) ) {
				// Setting an error stops the submission and shows this text above the form
				wpforms()->obj( 'process' )->errors[ $form_data['id'] ]['header'] = 'Your message contains words that are not allowed.';
				return;
			}
		}
	}
}, 10, 3 );

To use it for one form only, change the hook name to wpforms_process_123 (123 is the form ID).

7. Confirm notification emails arrive before going live

After publishing the form, submit it once yourself and check that the notification email arrives. If it does not, the problem is often WordPress's email sending itself, and switching to SMTP usually helps. The checks are the same as sections 4 to 6 of "What to check when Contact Form 7 email does not arrive", even though that article covers a different form plugin. How to set up SMTP is explained in "How to send WordPress email via SMTP".

Notes

• The free edition does not save submissions on your site. Send notification emails to an address you check regularly.
• If you turn on entry backups (Enable Entry Backups) under "Lite Connect" in "WPForms → Settings", submissions are stored outside WordPress (on the WPForms side) and can be imported when you switch to a paid edition. Backups are kept for one year. This means handing inquiries, which are personal data, to an outside service, so decide in light of your privacy policy.
• If you use a caching plugin and run into problems such as submissions failing or the CAPTCHA not showing, exclude the page with the form from caching and test again.

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)