OptionWeb

OW Forms is a modern WordPress form builder for sites that prioritize performance, accessibility, and GDPR compliance. Built by OptionWeb for production use on client sites, it ships with a JSON-driven schema engine, a REST-based submission pipeline, and a curated set of 16 field types — text, email, tel, URL, number, textarea, select, radio, checkbox, checkbox-group, date, time, datetime, file upload, hidden, and rating — plus auto-injected GDPR consent and anti-spam fields.
The anti-spam stack runs four layers in parallel: a visually-hidden honeypot input that bots fill but humans never see, a time-trap that rejects submissions completed faster than a configurable threshold, a multi-provider CAPTCHA layer (Cloudflare Turnstile, Google reCAPTCHA v3, hCaptcha, or Friendly Captcha), and optional OW Shield IP reputation scoring with a disposable-email blocklist. Every signal is logged so you can tune thresholds without flying blind. Submissions that score above 80 are silently rejected — no error message, no honeypot leak.
GDPR compliance is native, not bolted on. Every form gets a consent checkbox linked to your privacy policy, IP addresses can be stored pseudonymized or not at all, user agents are SHA-256 hashed by default, and a daily cron purges submissions older than your retention window (CNIL default: 1095 days). When OW Consent is active, OW Forms wires into its DSAR endpoint — erasure requests automatically delete matching submissions by email hash, with full audit trail. Submission emails are SHA-256 hashed with a plugin-owned salt (option <code>owfo_dsar_salt</code>, generated once at activation) so the database never holds plaintext PII linkable across systems, and DSAR erasure keeps working even after <code>wp config shuffle-salts</code>.
The one-click Contact Form 7 importer parses every CF7 form in your database, builds the equivalent OW Forms schema (preserving recipient, subject, and field types), and rewrites every <code>[contact-form-7 id="..."]</code> shortcode in your posts to <code>[owfo_form id="..."]</code>. Email notifications support HTML or plain text with <code>{{token}}</code> interpolation, optional auto-reply, signed outbound webhooks (HMAC-SHA256), and a Gutenberg block in addition to the shortcode and REST API.
<h3>External services</h3>
OW Forms relies on optional third-party CAPTCHA services to protect form submissions 
from spam. None of these services are contacted unless you explicitly enable a 
CAPTCHA provider in OW Forms → Settings → Anti-spam.
The OW Shield integration is fully local — when the OW Shield plugin is installed 
and active on the same site, OW Forms reads its IP reputation score from the local 
database/cache. No request leaves your server for this lookup; OW Shield itself 
may contact its own reputation service, which is disclosed in the OW Shield readme.
The Friendly Captcha widget JavaScript is bundled with OW Forms under 
 assets/js/vendor/ (no external CDN is hit at page render). Source: the upstream 
MIT-licensed package at https://github.com/FriendlyCaptcha/friendly-challenge — 
the files shipped here are the official npm <code>friendly-challenge@0.9.18</code> build 
outputs (<code>widget.module.js</code> and <code>widget.module.min.js</code>, unmodified, renamed to 
 friendly-challenge-0.9.18.module.js / <code>friendly-challenge-0.9.18.module.min.js</code> 
to make the version explicit in the filename). Both the minified and the 
human-readable non-minified source are shipped per WordPress.org Plugin Check 
requirements.
When a CAPTCHA provider is enabled, OW Forms loads the vendor’s JavaScript widget 
on pages that render a form, and posts the challenge solution back to the vendor’s 
verification API when a visitor submits the form. The data sent to the vendor is 
limited to: (a) the challenge token generated client-side by the vendor’s widget, 
(b) the visitor’s IP address (passed through to the vendor for fraud scoring), and 
(c) the site’s API secret key configured in the settings.
<h4>Cloudflare Turnstile</h4>
<ul>
<li>What it is: a CAPTCHA / bot-mitigation service by Cloudflare, Inc.</li>
<li>When data is sent: only when <code>spam_captcha_provider</code> is set to <code>turnstile</code>, and 
only on form submission. The widget JS is also loaded on every page that renders 
a form.</li>
<li>Data sent: Turnstile challenge token, visitor IP, your Turnstile secret key.</li>
<li>Terms of service: https://www.cloudflare.com/website-terms/</li>
<li>Privacy policy: https://www.cloudflare.com/privacypolicy/</li>
</ul>
<h4>Google reCAPTCHA v3</h4>
<ul>
<li>What it is: an invisible CAPTCHA / risk-scoring service by Google LLC.</li>
<li>When data is sent: only when <code>spam_captcha_provider</code> is set to <code>recaptcha_v3</code>, and 
only on form submission. The widget JS is also loaded on every page that renders 
a form (this is how reCAPTCHA v3 builds its risk score).</li>
<li>Data sent: reCAPTCHA token, visitor IP, your reCAPTCHA secret key. Google may 
also collect additional telemetry as described in their privacy policy.</li>
<li>Terms of service: https://policies.google.com/terms</li>
<li>Privacy policy: https://policies.google.com/privacy</li>
</ul>
<h4>hCaptcha</h4>
<ul>
<li>What it is: a privacy-focused CAPTCHA service by Intuition Machines, Inc.</li>
<li>When data is sent: only when <code>spam_captcha_provider</code> is set to <code>hcaptcha</code>, and 
only on form submission. The widget JS is also loaded on every page that renders 
a form.</li>
<li>Data sent: hCaptcha token, visitor IP, your hCaptcha secret key.</li>
<li>Terms of service: https://www.hcaptcha.com/terms</li>
<li>Privacy policy: https://www.hcaptcha.com/privacy</li>
</ul>
<h4>Friendly Captcha</h4>
<ul>
<li>What it is: a privacy-first, proof-of-work CAPTCHA service by Friendly Captcha GmbH 
(Germany). No user puzzle, no tracking cookies.</li>
<li>When data is sent: only when <code>spam_captcha_provider</code> is set to <code>friendly_captcha</code>, 
and only on form submission. The widget JS itself is bundled with OW Forms (not 
loaded from an external CDN); only the verification request reaches the vendor.</li>
<li>Data sent: Friendly Captcha challenge token, visitor IP, your Friendly Captcha 
secret key.</li>
<li>Terms of service: https://friendlycaptcha.com/legal/terms/</li>
<li>Privacy policy: https://friendlycaptcha.com/legal/privacy-end-users/</li>
</ul>
<h4>Outgoing webhook (admin-configured)</h4>
<ul>
<li>What it is: a URL of your choosing that OW Forms POSTs to after each submission. 
No data leaves your site until you fill the <code>webhook_url</code> setting in OW Forms → 
Settings → Notifications.</li>
<li>When data is sent: on every form submission, immediately after the admin 
notification email is dispatched. Non-blocking — your visitor’s submission 
response is not delayed by the webhook endpoint’s latency.</li>
<li>Data sent: form id, submission id, sanitized field payload (the same data 
stored in your <code>wp_owfo_submissions</code> table), site URL, ISO 8601 timestamp. 
If a webhook secret is configured, an <code>X-OWFO-Signature</code> HMAC-SHA256 header 
is added so the receiver can verify the payload origin.</li>
<li>Vendor: whoever owns the URL you configured. OW Forms has no built-in vendor 
for this — it is your responsibility to ensure the receiving endpoint complies 
with applicable privacy regulations for your submissions.</li>
</ul>

OW Forms

Modern, lightweight WordPress form builder with native GDPR compliance, anti-spam stack, and Contact Form 7 importer.

Web Guy

keith graham

Hitesh Chandwani

Mortgage Calculator

Trumani

Keith P. Graham

Block Spam

<a href="https://github.com/webguyio/dam-spam/issues" rel="nofollow ugc">💬 Ask Question</a> | <a href="mailto:webguywork@gmail.com" rel="nofollow ugc">📧 Email Me</a>
A simplified, restored, and preserved version of the original Stop Spammers plugin.
🥪 <a href="https://github.com/sponsors/webguyio" rel="nofollow ugc">Buy Me a Sandwich</a>
Development for Stop Spammers has slowed down; I recommend switching to <a href="https://damspam.com/" rel="nofollow ugc">Dam Spam</a>.
🧐 <a href="https://github.com/webguyio/dam-spam/issues/8" rel="nofollow ugc">Why, What Happened?</a>
However, rest-assured that if you can’t migrate to Dam Spam, I’ll still continue making sure that Stop Spammers is safe, stable, and supported.
🛟 <a href="https://github.com/webguyio/dam-spam/issues" rel="nofollow ugc">Get Support</a>

Stop Spammers Classic


Canning a response to contact you externally is no way to keep a plugin alive.



Hopefully more people realize this.


Poor Support

A simplified, restored, and preserved version of the original Stop Spammers plugin.

OW Forms vs Stop Spammers Classic