SOBI FORMS
Plugin v1.7.0
Features
Full product reference—or switch to marketing mode for the short pitch.
Forms & management
| Feature | Description |
|---|---|
| Multiple forms | Run as many forms as you need from one plugin. Create, edit, duplicate, and delete forms without touching code. The forms list is sorted by last updated. |
| Form templates | Start from Contact, Quote, Job, Event, or Support templates in the forms list—or begin with an empty canvas. |
| Admin title + fixed slug | Give each form a clear admin name and a URL-safe slug. The slug is locked after creation so shortcodes and embeds never break when you rename the title. |
| List search | Find forms quickly in the admin list by searching the title, slug, or notification recipient email. |
| Submit button label | Customize the submit button text per form—"Send", "Request a quote", "Subscribe", and so on. |
| AJAX save | Save builder changes instantly without a full page reload. Keyboard shortcut: ⌘/Ctrl+S. |
Builder
Layout & editing
| Feature | Description |
|---|---|
| Document-first canvas | Build forms in a focused canvas on the left while field and form settings stay in a sidebar on the right—similar to editing a document, not clicking through nested admin tabs. |
| Add field | An always-visible control above the submit button opens the field picker so you can add fields without hunting through menus. |
| Reorder fields | Drag and drop to reorder fields on the canvas. Powered by @dnd-kit for smooth, predictable sorting. |
| Multi-column layout | Place up to 3 fields side by side (e.g. First name | Last name | Company). Drag a field beside another to create a row, drag column separators to resize, and double-click a separator to equalize widths. Title, paragraph, textarea, and file fields stay full width. |
| Field menu (⚙) | Open a compact menu on any field to mark it required, show or hide the label, delete, or duplicate—without leaving the canvas. |
| Settings sections | Sidebar settings are grouped into collapsible sections so you can focus on one area at a time. |
| Lucide icons | Consistent Lucide iconography across the builder and submissions inbox for a cleaner, more modern admin UI. |
| Sidebar inputs | All sidebar controls share unified styling. Discreet inline hints warn you when a setting needs attention. |
| Select fields | Dropdown fields show a chevron indicator so visitors immediately recognise them as select inputs. |
| Embed overlay | Copy the shortcode or follow Gutenberg block instructions from a built-in overlay—no hunting through docs while you build. |
Field types
| Feature | Description |
|---|---|
| Short text, email, link | Collect short text, email addresses, and URLs with dedicated field types and appropriate validation. |
| Long text | Multi-line textarea for messages, descriptions, or longer free-form answers. |
| Phone | Country prefix selector with E.164 formatting—all countries supported. |
| Number & date | Numeric input with optional min/max limits, and a dedicated date field with min/max date constraints. |
| Dropdown | Single-select dropdown with editable options. |
| Single choice | Radio options rendered as visual tiles on the front-end. |
| Checkboxes | Multi-option checkboxes or a simple consent checkbox. |
| File upload | Let visitors attach one file per field. Ideal for CVs, briefs, or supporting documents. |
Layout blocks
| Feature | Description |
|---|---|
| Title block | Add section headings inside the form to structure longer flows. Display-only—not submitted with the entry. |
| Paragraph block | Insert instructions, disclaimers, or helper text between fields. Display-only—not submitted. |
Per-field options
| Feature | Description |
|---|---|
| Label visibility | Show or hide the field label on the front-end—handy when the placeholder or surrounding copy is enough context. |
| Number limits | Set minimum and maximum values on number fields to prevent out-of-range submissions. |
| Date limits | Set minimum and maximum dates on date fields to constrain selectable ranges. |
| Text / email limits | Enforce minimum and maximum character counts on text and email fields for cleaner, more predictable data. |
| Phone default country | Set a default country prefix for phone fields. Visitors can change it on the front-end. |
| Textarea | Allow visitors to resize the textarea and cap its length so long messages stay within your limits. |
| Choice options | Edit select, radio, and checkbox options inline on the canvas or from the field settings menu. |
| File field | Restrict allowed file extensions via a searchable multi-select and set a max file size (default 5 MB, capped by your server limits). |
| Inline links | Insert, edit, and remove http(s) links in Paragraph text, consent checkbox labels, and multi-checkbox option labels. Select text in the canvas, then use the Link bubble—pick a published WordPress page or paste a URL. |
| Link behaviour | Links open in a new tab (noopener noreferrer). Clicking a link inside a checkbox label does not toggle the checkbox—ideal for privacy policy / terms links. |
| Link storage | Stored as sanitized HTML (<a> and <br> only). Inbox, exports, and emails use plain text for field values. |
Prefill & hidden data
| Feature | Description |
|---|---|
| URL prefill | Pre-populate scalar fields from URL query parameters on the client—useful for campaign links and still friendly to page caching. |
| Hidden fields | Capture UTM tags, referral codes, or internal IDs invisibly on the front-end. Configure inbox label, URL param, and optional default in a sidebar table. Always submitted; visible in the inbox and notification emails. |
Per-form settings
Availability
| Feature | Description |
|---|---|
| Pause | Stop accepting submissions immediately—useful for sold-out offers, maintenance, or manual review periods. |
| Auto-close | Schedule an automatic close date and time using your WordPress site timezone. The form stops accepting entries when the deadline hits. |
| Submission limit | Cap total submissions (e.g. 100 spots). Shows progress as N / max with no automatic reset—ideal for limited registrations. |
| Unavailable message | Show visitors a custom message when the form is paused, closed, or full instead of a generic error. |
After submit
| Feature | Description |
|---|---|
| What the visitor sees | Choose an inline success message on the same page, or redirect to any published WordPress page. These options are mutually exclusive. |
| Save to inbox | Store submissions in the built-in inbox. Includes auto-purge / retention when enabled on the form. |
| Send admin notification | Email up to 10 recipients when a new submission arrives. |
| Send user confirmation | Send a simple thank-you email to the visitor using a designated email field on the form. |
| Trigger webhook | POST a versioned JSON payload to a configured URL. Includes a test button in the builder. |
| Action picker | Add or remove delivery actions via a picker. Actions run in a fixed order. At least one delivery action (inbox, admin email, or webhook) must be enabled—confirmation alone does not count. Inline warnings on save if misconfigured. |
Advanced
| Feature | Description |
|---|---|
| Custom error message | Replace the default submission error text with your own copy—useful for brand voice or clearer next steps. |
Embed & integration
| Feature | Description |
|---|---|
| Shortcode | Embed any form with `[sobiforms id="3"]` or `[sobiforms slug="contact"]`. Use id or slug—whichever fits your workflow. |
| Gutenberg block | Drop in the Sobi Forms Contact block and pick a form visually—no shortcode memorisation required. |
| Page builders | Works anywhere shortcodes work: Elementor, Divi, classic widgets, and other builder plugins. |
Visitor experience
| Feature | Description |
|---|---|
| AJAX submit | Visitors submit without a full page reload—faster, smoother, and less disruptive to the browsing experience. |
| Validation | Instant HTML5 checks in the browser, then strict server-side JSON schema validation so bad data never reaches your inbox. |
| Nonce loading | Security tokens load on hover or focus so cached pages stay fast while submissions remain protected. |
| Closed form | When a form is paused or past its deadline, visitors see your custom unavailable message instead of the form. |
| Choice UI | Radio options render as visual tiles; checkboxes support multi-select lists or a single consent checkbox. |
| Responsive columns | Multi-column rows use CSS grid on the front-end and stack vertically below 600px so forms stay readable on mobile. |
| Front-end CSS | Ships with minimal, neutral styles. Developers can disable plugin CSS entirely via the `sobiforms_enqueue_front_assets` filter. |
| JavaScript | Vanilla JS on the public site—no React, no jQuery. Keeps the front-end footprint small and predictable. |
| Asset loading | CSS and JS load only on pages that actually render a form. Every other page on your site stays untouched. |
Inbox & submissions
Layout & navigation
| Feature | Description |
|---|---|
| Split view | Browse submissions in a list on the left and read the full entry on the right—like Gmail or Linear. Columns are resizable. |
| React app | List and detail mutations happen without a full page reload. Toast feedback confirms actions. |
| Views | Tabs for All, Unread, and Starred. Spam and Trashed are top-level views for quick triage. |
| Per-form filter | Narrow the inbox to a single form with a compact dropdown—handy on sites running many forms. |
| Search | Full-text search across submission content so you can find a lead without scrolling. |
| Pagination | Loads 50 submissions per page to keep the admin fast even with large volumes. |
| Admin badge | An unread count on the Sobi Forms admin menu so new submissions are hard to miss. |
Submission detail
| Feature | Description |
|---|---|
| Field data | See every submitted field plus metadata such as date received and which form it came from. |
| Source page | Records the page title and pathname at the moment of submission (query strings excluded—use hidden fields for UTM tracking). |
| Legacy submissions | Older entries submitted before source-page tracking show "Not recorded" instead of leaving a blank. |
| Admin note | Add private team notes on any submission. Never shown on the front-end or in notification emails. |
| File attachments | View the uploaded filename and download the file from the inbox—admin-only, capability-checked. |
Workflow
| Feature | Description |
|---|---|
| Read / unread & star | Mark submissions read or unread and star important leads for quick filtering. |
| Spam queue | Move suspected spam into a dedicated view. Webhooks do not fire on spam ingest. |
| Soft delete | Delete moves submissions to Trashed (recoverable). Permanent delete is only available from the Trashed view. |
| Auto-read | Opening a submission automatically marks it as read—except when browsing the Trashed view. |
| Row checkbox | The row checkbox auto-selects when you open a submission, making bulk actions faster. |
| Checkboxes UI | Custom Lucide checkboxes replace native browser checkmarks for a consistent admin look. |
| Mark all as read | Clear your entire unread queue in one click when you have caught up. |
| Bulk actions | Select multiple submissions and mark read, spam, trash, restore, or delete permanently. |
| Move all matching to trash | Bulk purge all submissions matching the current filters in one action. |
| Dashboard widget | A WordPress dashboard widget surfaces recent unread submissions as soon as you log in. |
Email & delivery
| Feature | Description |
|---|---|
| Admin notification | Send formatted HTML emails to your team when a submission arrives. Uses wp_mail() by default, or SMTP when routing is enabled. |
| Recipients | Route notifications to up to 10 email addresses per form—sales, support, and ops can all stay in the loop. |
| File fields in email | Emails include the filename and a link back to the inbox rather than attaching files directly—safer for deliverability. |
| Visitor confirmation | Send visitors a simple thank-you email confirming their message was received. Does not repeat submitted field contents. |
| Sender | Emails are sent using your site name as the sender—not the generic "WordPress" label. |
| Reply-To | When the form includes an email field, replies go straight to the visitor so you can continue the conversation in your inbox. |
| Delivery modes | Email only, inbox only, webhook only, or any combination of delivery actions—configured per form via After submit actions. |
| Mail failures | A mail transport failure after a valid submit does not show an error to the visitor. Admins troubleshoot via Settings → SMTP → Logs. |
Settings & integrations
Sobi Forms → Settings
SMTP (Core Settings)
| Feature | Description |
|---|---|
| SMTP account | Connect one SMTP provider per site so form emails are delivered through your own mail server. |
| Settings & Logs tabs | Configure SMTP in a side drawer with Settings and Logs tabs. |
| Delivery logs | Failed notification and confirmation deliveries are logged for 30 days with error code and message. Retry resends the stored email snapshot. |
| Activate SMTP routing | Master toggle for mail delivery. When off, falls back to wp_mail() instantly—credentials stay saved. |
| Testing | Run a connection test and send a test email from the admin before going live. |
| Credentials | Passwords are stored encrypted. Optionally define SOBIFORMS_SMTP_PASSWORD in wp-config.php for extra control. |
Webhooks (Integrations)
| Feature | Description |
|---|---|
| Overview & Logs | Settings → Webhooks lists forms with a configured webhook (valid URL; link to builder). Logs tab shows failed deliveries with Retry. |
| Per-form setup | Configure via After submit → Add action → Trigger webhook. Saved only when the URL is valid. |
| Payload | Sends a fixed versioned JSON payload. Uploaded files are referenced as { id: null, name, url, mime_type }. |
| Spam handling | Webhooks do not fire on spam ingest. They fire once when a submission is marked as not spam (webhook_dispatched_at). Flag cleared on delivery failure. |
| Delivery logs | Failures only, 30-day retention. Manual Retry from stored URL and payload. Resolved rows stay visible until purge. |
| Async delivery | Delivered via WP-Cron so form submissions stay fast for visitors. On low-traffic sites, may wait until the next WP request. |
| v1 limits | No replay queue or custom payload editing in v1—planned for Webhooks Advanced later. |
Exports (Core Settings)
| Feature | Description |
|---|---|
| CSV & JSON | Background export jobs per form under Settings → Exports—no page timeout. CSV uses flat columns with UTF-8 BOM for Excel and JSON-encoded multi-values; JSON uses structured records with native types. |
| Filters & preview | Filter by inbox view (all non-spam, unread, read, starred). See a row-count preview before starting a job. |
| Job status | Track each export from Pending → Processing → Ready (or Failed / Expired). Jobs run via WP-Cron so large exports stay reliable. |
| Download & retention | Secure admin-only download via signed nonces. Files retained 7 days with automatic cleanup; optional email when ready or failed (initiating admin only). Excludes trashed submissions by default. |
| File fields in exports | Exported file fields include a signed admin download URL—not the file contents—so attachments stay private. |
Anti-spam & security
| Feature | Description |
|---|---|
| Honeypot | A hidden trap field catches bots without showing visitors an ugly CAPTCHA. |
| WordPress nonce | Every submission is verified with a WordPress security token to block forged requests. |
| Rate limiting | Default 10 submissions per hour per hashed IP. Configurable under Settings → Spam protection; set to 0 to disable. |
| Cloudflare Turnstile | Optional invisible-mode Turnstile. Siteverify on submit. Failed bot checks get a discreet success message with no delivery. |
| Server validation | All data is validated against a strict JSON schema on the server—client-side checks alone are not enough. |
| File uploads | Server-side MIME checks, getimagesize() for images (SVG excluded), and a blocklist of dangerous extensions. |
| Private storage | Uploads live in uploads/sobiforms/ with .htaccess deny-all on Apache so files are not publicly browsable. |
| File download | Only logged-in admins with the right capability can download files, with path verification on every request. |
| Akismet (optional) | When enabled under Settings → Spam protection, suspected spam is quarantined in the inbox with no admin email and a discreet success message for the visitor. |
| Admin actions | Every admin action checks user capabilities and WordPress nonces before anything changes. |
| POST guard | Checks post_max_size before nonce validation on empty POST bodies with a content-length header—clearer errors on large uploads. |
Data & privacy
| Feature | Description |
|---|---|
| Custom tables | Form, submission, mail log, webhook log, and export job data live in dedicated tables—not scattered across wp_postmeta or wp_options. |
| Soft delete | Submissions have a trashed_at column for recoverable soft-delete. Permanent delete only from the Trashed view. |
| IP storage | Visitor IPs are stored as SHA-256 hashes only. Raw IP addresses are never saved. |
| Admin notes | Internal team notes stay inside the inbox. They are never exposed on the front-end or included in emails. |
| Retention | Automatically delete old submissions after a set period to support privacy frameworks like GDPR. Configured per form; manual purge also available. |
| Telemetry | No usage data is sent back to the plugin author. Your submissions stay on your server. |
| Akismet | Submission content is sent to Akismet only when you explicitly enable the integration under Settings → Spam protection. |
| Turnstile | When enabled, the Cloudflare Turnstile script loads on form pages and tokens may be verified with Cloudflare. |
Performance
| Feature | Description |
|---|---|
| Front-end weight | About 5 KB of gzipped JS and CSS on pages that render a form (~21 KB unminified source)—light enough to protect Core Web Vitals. |
| Script loading | Scripts load in the footer with defer on WordPress 6.3+ so they do not block page rendering. |
| Conditional enqueue | Assets load only when the first form on a page is rendered—not site-wide. Zero assets on pages without a form. |
| Early enqueue | On singular posts, assets can load earlier when a shortcode or block is detected—reducing flash of unstyled content. |
| Object cache | Form definitions are cached to avoid repeated database reads on every page view. |
| Inbox queries | Tab counts use aggregate queries; list rows skip the heavy data column until you open a submission. |
| Builder admin | The React builder (~39 KB gzipped, ~138 KB minified) loads only on the form edit screen. |
Admin & resources
| Feature | Description |
|---|---|
| Admin menu | Submissions, Forms, Settings, and Resources are organised in a clear top-level menu. |
| Spam protection | Settings → Spam protection — rate limit, Akismet, and Cloudflare Turnstile in one place. |
| Resources → Usage | Shortcode and Gutenberg block documentation. |
| Requirements | Requires WordPress 6.0 or newer and PHP 7.4 or newer. |
Key messages
| Angle | Line |
|---|---|
| Performance | Zero impact on pages without a form; ~5 KB gzipped when a form is shown. |
| Workflow | Gmail-style inbox + dashboard widget — never miss a lead. |
| Simplicity | Modern builder with templates and multi-column layout; shortcode or block everywhere. |
| Pro | Native SMTP, webhooks, CSV/JSON exports, visitor confirmation, Akismet spam quarantine. |
| vs heavy plugins | No React on the front, no forced reCAPTCHA. |
Core Features & Form Builder
| Feature | Description |
|---|---|
| Blazing Fast React Builder | Zero-reload canvas, drag-and-drop, ⌘/Ctrl+S, instant AJAX saving. |
| Multi-column layout | Up to 3 fields per row; drag to resize; double-click to equalize; stacks on mobile. |
| Form templates | Contact, Quote, Job, Event, and Support starters—or start blank. |
| Smart Form Scheduling | Pause manually or auto close at a date/time with custom unavailable messages. |
| Flexible Embeds | Gutenberg block, id/slug shortcodes, Elementor, Divi, and any shortcode-compatible builder. |
| Field types + layout blocks | 10+ input types, title/paragraph blocks with inline links (page picker), file upload, hidden fields, URL prefill. |
Submission Inbox
| Feature | Description |
|---|---|
| SaaS-grade split view | React list + detail with resizable columns — like Gmail or Linear. |
| Instant triage | All / Unread / Starred / Spam / Trashed, search, per-form filter, bulk actions. |
| Admin notes & source page | Private annotations and frozen page context per submission. |
| CSV/JSON exports | Background jobs under Settings → Exports; filter by view, 7-day retention, optional email when ready. |
| Dashboard widget | Unread badge on admin menu + home screen widget for new leads. |
Security & Privacy
| Feature | Description |
|---|---|
| Silent anti-spam | Honeypot, nonces, rate limits (10/hour default), optional Akismet and Turnstile. |
| Privacy by design | Hashed IPs, custom tables, soft-delete trash, no telemetry, configurable purge. |
| File uploads | Validated, private storage, admin-only downloads. |
SMTP, Webhooks & Delivery
| Feature | Description |
|---|---|
| Native SMTP | SMTP routing with delivery logs and retry. Encrypted credentials. |
| Webhooks | Versioned JSON payloads, per-form URLs, failure logs with retry. |
| Hybrid delivery | Inbox, email, webhooks—or any combination per form via After submit actions. |
| Pro-grade emails | Up to 10 recipients, Reply-To, visitor receipts, site-name sender. |