Haych/dev Forms
Forms that don't phone home. Built with the WordPress block editor, submissions stored in your own database.
Haychdev Forms is a WordPress form builder that doesn't send your visitors' data anywhere else. Forms are built from native blocks, submissions are saved in your own database, and notification emails go out through WordPress's own mailer. Nothing in the public-facing pipeline calls a third party.
Submissions in v1 are stored as plain JSON, in the same database WordPress already uses for your posts and settings. A future release will add per-field encryption you can switch on for sensitive forms, without touching any of the forms you've already built.
Why Haych/dev Forms
- Your visitors' data stays on your site
Submissions are saved in your own WordPress database. No SaaS, no remote keys, no third-party APIs. The plugin makes zero outbound HTTP calls.
- Built with blocks, not a builder
You add fields the same way you build any page in WordPress. Text, email, phone, textarea, dropdown, checkbox, file upload, submit. Edit a form, embed it anywhere.
- File uploads that just work
Add a file field, set the file types you'll accept, and you're done. Uploads attach to the entry and download from the admin behind a private link.
- A proper inbox in your admin
Submissions land in their own admin screen with date, form, status, and a quick preview. Click one to read it. Status flips from new to read on its own.
- Notification emails out of the box
Each form has its own notify-to address. The plugin uses WordPress's own wp_mail, so it picks up any SMTP plugin you already have set up.
- Encryption-ready
Submissions in v1 are stored as plain JSON in your database. A future release will let you turn on per-field encryption for sensitive forms without changing any of the ones you've already built.
Screenshots
Free vs Pro
Free
- Block-based form builder with 7 native field types
- REST submit endpoint with server-side validation
- Admin entry viewer with single-entry delete
- Email notifications to your WordPress admin address
- Hashed IP and User-Agent metadata, no raw values stored
Pro
Everything in Free, plus:
- Per-field AES-256-GCM encryption at rest
- Honeypot, HMAC-signed time-trap, and per-IP rate-limit anti-spam
- Per-form auto-delete after N days
- Mark fields as sensitive so they stay masked in the admin
- Choose how to store metadata — keep raw, hash, or drop entirely
- File upload field with MIME allow-listing
- Per-form notification address
- Bulk actions in the entry viewer
FAQ
- Does it call any third-party APIs?
- No. Submissions go straight to your own database, and notification emails use WordPress's own wp_mail. There's no Captcha vendor, no antispam SaaS, and nothing that phones home in the background.
- How do I add a form to a page?
- Create a new Form from your admin, drag in the fields you want, save it. Then on any page or post, drop in the Form block and pick that form from the dropdown.
- Can I export submissions?
- v1 has an admin screen with per-entry detail and bulk delete. CSV export and webhooks are planned for a later release.
- What happens when I delete a form?
- Everything tied to it is deleted with it: the submissions, the uploaded files, the attachments. No orphaned data left lying around.
- Is it encrypted?
- Not in v1. Submissions are stored as plain JSON in your database, the same place WordPress keeps everything else. A future release adds per-field encryption that flips on without rewriting your existing forms.
- How big is it?
- The frontend handler is about 4 KB of plain JavaScript and 1 KB of CSS. No React on the public side, no extra bundles for visitors to download.