Title: Flinkform – Forms for the Block Editor
Author: Dennis Buchwald
Published: 17 junija, 2026
Last modified: 14 julija, 2026
---
Search plugins
# Flinkform – Forms for the Block Editor
By [Dennis Buchwald](https://profiles.wordpress.org/dbwmediadennis/)
[Download](https://downloads.wordpress.org/plugin/flinkform.1.4.4.zip)
* [Details](https://sl.wordpress.org/plugins/flinkform/#description)
* [Reviews](https://sl.wordpress.org/plugins/flinkform/#reviews)
* [Installation](https://sl.wordpress.org/plugins/flinkform/#installation)
* [Development](https://sl.wordpress.org/plugins/flinkform/#developers)
[Support](https://wordpress.org/support/plugin/flinkform/)
## Description
Flinkform is a form builder that lives entirely inside the WordPress Block Editor.
Forms are composed from native blocks (`block.json` v3), styled through `theme.json`
design tokens, and powered by the Interactivity API — no separate admin UI, no shortcodes,
no jQuery.
#### How it works
* **Block Editor native** — forms are built with `block.json` and the Interactivity
API, directly inside the editor
* **theme.json styling** — forms inherit your theme’s typography, colours and spacing
automatically
* **Modern stack** — WordPress 6.5+, PHP 8.1+, no jQuery, frontend JS under 15
KB gzipped
* **Multi-step forms** — split long forms into steps with a Page Break block, included
in the free core
* **Conditional logic** — show/hide fields based on user input, included in the
free core
* **WCAG 2.1 AA** — full keyboard navigation, screen-reader compatible, aria-live
announcements
* **Privacy by design** — no external services, no tracking cookies, no IP tracking—
everything stays on your server
#### Features (free core)
**Form building**
* 13 field types: Text, Email, Textarea, Number, Date, URL, Phone,
Select, Radio, Checkbox, Toggle, Hidden, Section Heading * Dedicated Consent field
for privacy-policy agreement * Multi-step forms with Page Break block, per-step
validation and progress indicator (bar, dots or numbers) * Conditional logic — show/
hide fields, skip steps, gate the submit button * Two-column layout with per-field
full-width override
**Styling**
* Automatic theme.json inheritance (colours, typography, spacing, border
radius) * Style panel: primary colour, field style (bordered/soft/underline/minimal),
label position (above/beside/floating/placeholder), submit button style (fill/outline/
ghost)
**Notifications**
* Admin notification email on every submission (configurable
recipient, merge tags) * Optional confirmation email to the submitter * Sends through
your site’s standard WordPress mail (`wp_mail`)
**Spam protection**
* Always-on honeypot + signed time-based check (zero configuration)*
Built-in proof-of-work challenge with accessible math fallback for visitors without
JavaScript * No external service, no API keys, no tracking cookies, 100% GDPR-friendly
**After submission**
* Success message or redirect to a custom thank-you URL (with
open-redirect protection) * Optional submission ID and form ID query parameters
for conversion tracking (GA4, Meta Pixel, Plausible, etc.)
**Admin**
* Submissions list with search, filter by form, sort, bulk actions *
Single-submission detail view with all field labels and values * Mark as read/unread*
Per-form data retention with automatic daily purge
### Privacy
Flinkform is built with privacy by default. Here is what the free core does and
does not do:
**What the free core stores:**
* Form submissions (the field values visitors enter)
in a dedicated database table (`{prefix}flinkform_submissions`)
**What the free core does NOT do:**
* It stores no IP addresses and no browser
user-agent strings * It sets no tracking, analytics or marketing cookies. Flinkform
sets exactly one strictly-necessary cookie — `flinkform_flash` (lifetime ~60 seconds,
httpOnly) — and only when a form submission fails validation, to carry the error
message and the visitor’s input across the page reload. Successful submissions set
no cookie at all * It contacts no external service
**Data retention:**
* By default, submissions are retained until you delete them.
To comply with the storage-limitation principle (GDPR Art. 5), set a per-form retention
period (Form block Data Retention) and Flinkform deletes older submissions automatically
each day * Individual submissions can be deleted from the admin submissions screen
at any time
**Data deletion:**
* All free-core data (the submissions table) is permanently
removed when the plugin is uninstalled through the WordPress admin * Flinkform integrates
with WordPress’s privacy tools (Tools > Export Personal Data / Erase Personal Data)
to support data-subject access and erasure requests
### Source Code
The complete, uncompiled source code (including the `src/` directory with the
unminified
JavaScript/CSS that compiles into `build/`) is publicly available at: https://github.
com/dennisbuchwald/Flinkform
Build instructions (Node.js 18+ and npm required):
1. Clone the repository: `git
clone https://github.com/dennisbuchwald/Flinkform.git` 2. Install dependencies: `
npm install` 3. Build the compiled assets into `build/`: `npm run build`
The build is powered by `@wordpress/scripts` (webpack). The `src/` sources are
excluded from the distributed plugin zip to keep it small; this repository is the
canonical, reviewable source.
## Blocks
This plugin provides 16 blocks.
* Flinkform Form A form container. Add field blocks inside to build your form.
* Text Field A single-line text input.
* Email Field An email input with format validation.
* Page Break Splits the form into steps. Place between field blocks to start
a new step in a multi-step form.
* URL Field A website URL input with format validation.
* Checkbox Group Multiple choices from a list of options.
* Consent A required consent checkbox (e.g. a GDPR data-processing agreement)
with an optional link to your privacy policy.
* Section Heading A visual divider with an optional title and description. Not
a field — nothing is submitted.
* Phone Field A phone number input.
* Date Field A date picker input.
* Toggle / Checkbox A single checkbox — great for terms-of-service style consents.
* Hidden Field An invisible field that records context with the submission (page
URL, user, date, or a static value).
* Textarea Field A multi-line text input.
* Radio Group A single choice from a list of options.
* Dropdown A dropdown — single or multi-select.
* Number Field A numeric input with optional min, max and step.
## Installation
1. Upload the `flinkform` folder to `/wp-content/plugins/`
2. Activate the plugin through the **Plugins** screen in WordPress
3. Open any page or post in the Block Editor
4. Insert the **Form** block (search for “Flinkform” or “Form”)
5. Add fields, configure settings in the block inspector, publish — done
## FAQ
### Is Flinkform free?
Yes. Flinkform is GPLv2-licensed and completely free — including multi-step forms
and conditional logic. Everything you need to build and run real forms is in the
core.
### What WordPress version do I need?
WordPress 6.5 or higher and PHP 8.1 or higher. Flinkform uses modern WordPress APIs(
Interactivity API, block.json v3, viewScriptModule) that are not available in older
versions.
### Does Flinkform work with my theme?
Yes. Flinkform reads your theme’s design tokens from `theme.json` and inherits colours,
typography, spacing and border radius automatically. Forms look native on any modern
WordPress theme — tested with GeneratePress, Twenty Twenty-Five, Astra and Kadence.
### Does Flinkform support multi-step forms?
Yes, in the free core. Insert a **Page Break** block between fields to split the
form into steps, choose a progress indicator style (bar, dots or numbers), and benefit
from per-step validation. Steps can even be skipped conditionally based on earlier
answers.
### How does the spam protection work?
Flinkform uses a layered approach that requires no setup:
1. **Honeypot** — a hidden field that bots fill in but humans never see
2. **Signed time check** — submissions faster than a couple of seconds after page
load are rejected; the timestamp is cryptographically signed so bots cannot forge
it
3. **Proof-of-work challenge** — the visitor’s browser solves a small computational
puzzle in the background; visitors without JavaScript get a simple math question
instead
No external service is contacted. No tracking cookies are set. No personal data
is shared.
### Is Flinkform GDPR-compliant?
Flinkform is designed with privacy by default — see the Privacy section below for
the full detail. In short: no IP addresses or user-agent strings are stored, no
data ever leaves your server, no external spam service is used, and Flinkform integrates
with WordPress’s privacy tools for data-subject access and erasure requests.
### My notification emails don’t arrive. What can I do?
Email deliverability depends on your host. Many hosts send `wp_mail()` unreliably.
If your notifications don’t arrive, install a dedicated SMTP plugin to route mail
through a proper provider — it will handle delivery for Flinkform too.
### Can I redirect to a thank-you page after submission?
Yes. In the block inspector’s “After Submit” panel, choose “Redirect to URL” and
enter your thank-you page URL (validated against open redirects). Optionally append
the submission ID and form ID as query parameters for conversion tracking.
## Reviews
### [Omg endlich !!](https://wordpress.org/support/topic/omg-endlich/)
[robinherbeck](https://profiles.wordpress.org/robinherbeck/) 18 junija, 2026
Fande die anderen Führenden Plugins viel zu bloated endlich gibt es eine simple
Lösung!
[ Read all 1 review ](https://wordpress.org/support/plugin/flinkform/reviews/)
## Contributors & Developers
“Flinkform – Forms for the Block Editor” is open source software. The following
people have contributed to this plugin.
Contributors
* [ Dennis Buchwald ](https://profiles.wordpress.org/dbwmediadennis/)
[Translate “Flinkform – Forms for the Block Editor” into your language.](https://translate.wordpress.org/projects/wp-plugins/flinkform)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/flinkform/), check
out the [SVN repository](https://plugins.svn.wordpress.org/flinkform/), or subscribe
to the [development log](https://plugins.trac.wordpress.org/log/flinkform/) by [RSS](https://plugins.trac.wordpress.org/log/flinkform/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 1.4.4
* Fix: forms embedded outside the current page’s own content — in a footer or header
template part, a synced pattern, a theme-builder element or a site-wide popup—
were silently rejected on submit, because the submission was matched only against
the current page’s content. Submissions now resolve the form wherever it actually
lives, so popup and footer forms save correctly.
#### 1.4.3
* Critical fix: a variable-ordering error introduced in 1.4.0 aborted the whole
frontend module on load — the proof-of-work spam solver never ran, so EVERY submission(
popup or not) was silently rejected as spam and nothing was stored. If you are
on 1.4.0-1.4.2, update immediately.
#### 1.4.2
* Fix: popup submissions now actually use the fetch path — the hidden admin-post“
action” input shadowed the form’s action property in JavaScript, so every fetch
went to a broken URL and silently fell back to the classic page-reload submit
* Change: the spam-challenge token lifetime is now 30 minutes (was 5) — visitors
who read a long page or open a popup form some minutes after page load were silently
rejected with no feedback and no stored submission
#### 1.4.1
* Fix: the spam-challenge token is now consumed when a submission is accepted instead
of when it is checked — a popup submission that failed validation can be corrected
and resubmitted without hitting the replay guard (the popup flow never re-renders
the page, so no fresh token is minted between attempts)
#### 1.4.0
* New: forms inside popups/modals now submit via fetch() without a page reload —
the success card and validation errors render inline, so the popup stays open
and the visitor sees the outcome
* Applies automatically when a form sits inside a modal container (`[role="dialog"]`,
a native `