Ways to get started

• A setup wizard asks a few questions when you first turn the plugin on: how forms look, what’s kept and for how long, where email comes from, spam, and which starter forms you want
• Describe your form: tick the questions you want, such as name, email, address or a date, and get a draft to finish in the builder
• Saved blocks of questions to reuse, including a built-in Customer contact block that asks for a name, email and phone number
• Duplicate any form from the Forms list to start the next one
• Hands-on tutorials that walk you through a practice form, with nothing saved
• A “?” beside every setting in the builder, with a line of help and a link to the full guide

13 forms to start from

• Customer contact: a simple enquiry form, and a feedback, compliment or complaint form
• Complaints & reports: make a complaint, and report a fault
• Bookings & appointments: book an appointment or callback, and an event or room booking
• Data & information requests: a Subject Access Request form that suits almost any organisation, and a Freedom of Information form for public bodies only
• Council services: report a problem, book a council appointment, and council feedback, compliment or complaint
• Worked examples: two forms that show every kind of calculation, step by step

Each form says who it suits. Check the wording, settings and any dates against the rules that apply to you before you publish.

Build it your way

• Drag and drop questions onto pages, with undo and redo
• Text, email, phone, money, dates, times, addresses with an optional postcode lookup, file uploads, star ratings, sliders, and measurements in the units people know, such as stone and pounds
• Show or hide questions, groups and whole pages based on earlier answers. On the same page, a question appears as soon as it’s needed
• Filter one dropdown by another, and pick an answer in advance from a link
• Change a question’s short name and every rule, sum and email in the form that uses it changes too
• Copy a question from one form and paste it into another
• Form check flags problems as you build, such as a question with no label

The postcode lookup sends the postcode a visitor types to postcodes.io, an outside service. It’s free at the time of writing, has no service guarantee and may limit heavy use. HolmesPortfolio doesn’t provide or pay for it. For a busy site, you can use a provider that works the same way, which may charge you, and add its address in Settings. Northern Ireland postcodes need a licence from Land & Property Services for commercial use.

Let the form do the sums

• Totals, value added tax (VAT), discounts, ages, and the days or hours between two answers
• Deadlines in working days that skip the UK bank holidays you choose: England and Wales, Scotland, Northern Ireland, or all of them
• Put the date received and the reply-by date straight into your acknowledgement email
• Try a sum with sample values before you save it
• Rules and sums are worked out on your server, not in the visitor’s browser

Clear for the people filling it in

• Forms over as many pages as you need. Add a Check your answers page at the end so people can go back and change anything
• An error summary at the top of the page links to each question that needs fixing
• Built-in error messages say what to do, such as “Enter a real UK postcode”, and you can reword any of them
• Hints and errors are linked to their questions in the page code for screen readers, and the form gives screen readers a short message when a question appears or goes
• Questions that aren’t required say “(optional)”
• GOV.UK Design System styling, Bootstrap, a plain look, or your theme’s own
• People without JavaScript see a short message by default, or you can let them fill the form in without it

These features help, but they don’t make a form accessible by themselves. Test each form with a keyboard and a screen reader before you publish.

Know what came in

• Emails to your team and to the person who filled in the form, each with its own wording. A new email starts with every answer laid out, ready to trim
• A reference for every entry, such as ENQ-000042. A form can have its own letters, such as COM for complaints
• Entries kept on your own site, with search, a form filter, and separate views for unread entries and spam
• Export to a spreadsheet file, one file for each form
• File uploads are checked to be a real PDF or image, not only by their name. They’re sent with the email. Your site keeps them until the email has gone, then deletes them. They’re encrypted if you’ve added an encryption key. If the email can’t be sent, the files wait with it until you try again or remove it. If you do neither, they’re deleted when the form’s retention period ends. Any other file left on your site is deleted about 2 days after it was saved
• Form emails wait in a queue on your site. One that fails is tried 3 times. Then it’s listed on the Issues tab under Entries, where you can try again or remove it. A banner on every admin page points admins there. The plugin can’t see emails that bounce or land in spam
• Does your host limit how many emails your site can send? Enter that limit in Settings. Form emails over it then wait in the queue until the limit allows, rather than being sent and refused by your host. Only this plugin’s emails are counted, so set it a little below your host’s limit. It can’t make sure an email arrives

Look after people’s data

• Keep entries for every form, form by form, or not at all. Emails send either way
• Kept entries are deleted from your site after the time you choose, from 30 days to 2 years. Copies already sent by email, or held in backups of your whole site, aren’t affected
• Optional encryption for stored answers, with a key you add to your site and keep a spare copy of. The plugin can make a random key for you to copy. The key sits on your server, so it protects a leaked copy of the database, not someone who can read your site’s files
• Works with WordPress’s own tools for exporting and erasing someone’s personal data. They find a person’s entries by the email address they gave
• The forms set no cookies of their own
• Visitors’ internet addresses aren’t saved with their entries unless you turn that on. To limit repeat sending, the spam checks keep a scrambled copy of each address for up to 10 minutes

Keep spam out

• Checks that need no setup and give people no puzzles to solve: a hidden trap field, a timing check and a limit for each internet address
• Answers checked for swear words and slurs. You choose whether people reword them, staff see them highlighted, or the entry goes to spam
• An email to the site admin when one form gets an unusual number of entries in an hour. You set the number
• Cloudflare Turnstile or Google reCAPTCHA if you need them. They’re off unless you turn them on

Keep your work safe

• Turn on a weekly backup of every form, your saved blocks and all your settings. The last eight are kept on your site. Backups hold forms and settings, not people’s answers
• Back up now, download the file, and import it again here or on another site
• Export or import a single form from the Forms list
• Each form keeps its last 30 saves, with who saved it and a note. Compare any two and restore an earlier one
• A form open in the builder is locked to one person. Anyone else sees who has it before they can take over
• Bring back any starter form or built-in block you deleted