For static, headless and Jamstack sites
Your own form backend. Your frontend stays yours.
A WordPress you control stores the submissions, sends the emails, renders the PDFs, takes the payments and checks for spam. Your Astro, Hugo, Next.js or plain HTML site posts to it, or embeds the form with one tag. No per-submission pricing.
A readable endpoint for every form.
Name the endpoint, require a header key, allow the origins you trust. Validation, calculations and spam checks run on the server, so a hand-made request gets the same answer as the form.
- Free Webhooks post every submission as JSON to Zapier, Make, n8n or your own URL.
- Paid Submissions from other domains, with header keys and allowed origins.
- Paid Self-sizing JavaScript embed: paste one tag, and the form loads into your page and sizes itself.
- Paid Headless mode: one switch closes the public side of the WordPress install.
# From your Astro, Hugo or Next.js site
curl -X POST \
https://cms.site/wp-json/craftforms/v1/submit/quote \
-H "Content-Type: application/json" \
-H "X-Your-Key: ••••••••" \
-d '{"email":"tom@example.com", "width":120,
"height":80, "material":"dibond"}'
← 201 Created
price re-checked · saved · email + PDF sent
spam check passedSound familiar?
Where hosted form endpoints and DIY handlers run out, and what you get instead.
-
The hosted form service bills per submission, and the free tier runs out halfway through the month.
Your server, your limits. No submission caps and no per-form pricing, in the free edition too. When you outgrow hosted endpoints
-
The endpoint only forwards an email. No storage, no PDF, no payment.
A real backend. Searchable submissions with CSV and JSON export, branded emails and PDFs Free, and Stripe, PayPal, Mollie or Square checkout Paid.
-
The price is calculated in the browser. Anyone can change it before it’s sent.
Formulas run again on the server. Paid The amount charged is the amount the server calculated, not what the request said.
-
I get spam on a static form, and I don’t want a Google script on my site.
Server-side spam checks. Free Behavioural scoring with nothing for visitors to solve. Turnstile if you prefer it.
-
My static site has /en/, /de/ and /fr/. The form service speaks one language, so I built three forms.
One form, the page’s language. Translations Free; the embed reads the page’s
langand the full-page link takes?lang=dePaid. Submissions stay in one list. How it works -
I don’t want a WordPress admin exposed on the internet just for forms.
Headless mode. Paid One switch closes the public pages; your forms keep working. The locked-down setup
Built for people who read the network tab.
The parts developers ask about first.
- FreeForms built by your AI agentMCP tools create forms and fields from your own assistant. No API key stored in the plugin.
- FreeWebhooks to any URLJSON per submission, with “run only if” conditions checked on the server.
- FreeForms as filesExport a form with its emails, PDFs and images as one file; import it on staging or production.
- FreeSubmissions you ownIn your own database, exportable as CSV or JSON. GPL code.
- FreeMultilingual formsOne form in every language. Translations by CSV or XLIFF; on paid plans the embed follows the page’s lang.
- PaidREST endpoint per formYour endpoint name, header keys, allowed origins.
- PaidEmbed on any siteA self-sizing script tag, keyed to the domain, revocable in one click.
- PaidPaymentsStripe, PayPal, Mollie and Square, paid into your own accounts, price re-checked on the server.
- PaidHeadless modeClose the public side of the install in one switch.
Guides: Astro · Hugo · Static sites and web apps · MCP · Webhooks
Send us your form spec. We wire it up before you buy.
Describe the form, the fields, the prices and where the data should go. We build it on a private demo site with its endpoint, emails and PDFs, and send you the link and a sample request within 3 working days.
- Your real spec. Fields, validation, formulas, webhooks.
- Try it with curl. You get the endpoint and a working request.
- Buy only if it fits. The form exports as a file you import on your own install.
- Honest answers. If part of it isn’t possible, we say so.
What people building with CraftForms say.
-
Technically brilliant, still easy to use
CraftForms is turning out to be one of my favourite forms plugins, with its almost unlimited WooCommerce customisation options, its fast easy and quick embed form option has powered up the ability to make payments and sales on static websites with customised PDF generators and email design from your secure back-end.
Its technically brilliant while remaining easy to use and customise and the development speed is impressive.
Nathan Foley
What’s free, what’s paid, up front.
The free Community edition gives you the builder, submissions, branded emails, PDFs, SMTP, spam checks, webhooks and MCP, with no submission limits. Posting from other domains, the JavaScript embed, Headless mode, calculations and payments need a paid plan.
- No WordPress at all? CraftForms Cloud hosts the backend for you: a free plan, paid from €6 a month.
- If a yearly plan lapses, paid features switch off; forms and submissions keep working.
- Help from the developer on every plan, free included.
Questions developers ask.
More in the documentation, or on the main FAQ.
Do I have to use WordPress for the frontend?
No. WordPress is only the backend: it stores submissions, sends emails and takes payments. Your site can be Astro, Hugo, Next.js, Eleventy or plain HTML, posting to the endpoint or embedding the form.
How do I stop other sites posting to my endpoint?
Require a header key per form and list the origins you allow. Embeds use a key tied to the site’s domain, which you can revoke at any time.
Are prices and validation checked on the server?
Yes. Required fields, formats, conditions and price formulas run again on the server, so a request that skips the browser gets the same result as the form.
Where is the data stored?
In your WordPress database, on hosting you choose. Uploaded files go to private storage on the same server. Export submissions as CSV or JSON whenever you like.
Can I keep forms in git?
Forms export as files with their emails, PDFs and images, and import on another install, so you can keep them next to your code and move them between staging and production.
Does the embed work on a multilingual static site?
Yes. Translate the form once, free, and it stays one form. With a paid plan the embed takes the language of the page it’s on (its lang, or the language you set on the embed), and the full-page link takes ?lang=de. Emails and PDFs go out in the visitor’s language.
What about the WordPress admin being public?
Headless mode (paid) closes the public side of the install in one switch. Hiding the login URL is a separate step, explained in the locked-down guide.
Own your form backend.
Install the free edition on any WordPress, point your site at it, and the first submission is saved, emailed and spam-checked.