Wiwi Forms – Form Builder

What it does not do: it will not delete anything unless you set a retention period — left at zero, entries are kept indefinitely. It also does not register with WordPress’s own personal-data export and erase tools, so a subject access or erasure request has to be handled by hand.

Does Wiwi Forms contact any external service?

One optional setting performs a lookup. “Email domain check”, which is off by default, asks whether the domain of a submitted email address is able to receive mail. That is a DNS lookup for MX, A and AAAA records, made by your own server through whatever resolver your host uses. Only the domain part of the address is looked up, never the full address, and each answer is cached for a day. Turning the setting off stops the lookups entirely.

Wiwi Forms uses no tracking cookies, sessions, or localStorage. On non-JavaScript submissions, it sets one functional cookie containing a random token for up to five minutes so the form can be re-populated after the redirect. The cookie is HTTP-only, SameSite=Lax, and Secure on HTTPS. Forms remain compatible with page caching solutions.

The front end loads no jQuery. The admin settings screen uses WordPress’s bundled colour picker, which depends on jQuery.

Rule packs are pasted and installed explicitly by an administrator; Wiwi Forms does not download them from a remote service. Regular expressions are available only to imported Wiwi rule packs, not owner-authored rules. Their count and length are capped, they are validated during import, and runtime matches use PCRE resource limits plus a timed cooldown if a subject causes an error.

Install and activate Wiwi Forms separately on each site. Network activation is not supported.